Privacy Policy

Dermasync is committed to your privacy and utilizes various protections intended to safeguard your data transmission and storage. All Member Consumer Health Data is encrypted and only you hold the decryption key. Below you will find our complete Privacy Policy. Thank you for taking the time to read it.

Privacy Policy Summary

This summary provides a plain-language overview of how Dermasync handles your personal information and data connected with your use of Dermasync. This summary does not replace the full Privacy Policy below, which controls if there is any inconsistency. Please read this Privacy Policy together with our Terms of Service Agreement. Initial capitalized words are defined in and have the meanings described to such terms in the Privacy Policy below.

1. Introduction

Dermasync, Inc., a Delaware corporation ("we," "us," or "Dermasync") respects your privacy and is committed to protecting the privacy, confidentiality, integrity, and security of your personal information. This Privacy Policy explains what categories of personal information we collect, how we process and use personal information, when personal information may be disclosed, how we work to protect personal information, and what rights may be available to you under applicable law.

Dermasync is a skincare guidance mobile software application available to Members on supported devices that uses a deterministic, rules-based recommendation technology — supported by AI-assisted phrasing, as described in Section 9 — to base suggestions on menstrual-cycle tracking information and certain other information that you provide or authorize to be provided to us. The Services include our mobile applications, websites, social media pages, email communication, and customer support offerings (the "Services"). The Services provide skincare education, routine support, menstrual-cycle tracking (including cycle and symptom logging, phase identification, and period and ovulation indicators), and personalized skincare guidance based on information you submit and features you authorize.

For purposes of this Privacy Policy, the following terms have the following meanings:

"Consumer Health Data" has the meaning provided under applicable consumer health data laws. Consumer Health Data may include information relating to menstrual-cycles and symptoms, medications, allergies, pregnancy status, health and wellness observations, and similar types of health and wellness information. Consumer Health Data does not include de-identified, aggregated, anonymized, or publicly available information that can reasonably be linked to an individual, household, or device, and to the extent excluded by applicable law.

“Health Data” means Personal Information that relates to or can reasonably be linked to an individual's physical or mental health, including health conditions, symptoms, treatment, medications, reproductive health, menstrual-cycles, fertility, pregnancy, biometric or genetic information, and use of health-related products or services. It includes information you provide or authorize, such as skincare information, wellness observations, and Apple HealthKit data. Health Data may include Consumer Health Data where applicable under law. Health Data does not include de-identified, aggregated, anonymized, or publicly available information that can reasonably be linked to an individual, household, or device, and to the extent excluded by applicable law.

“Personal Information” means information that identifies, relates to, or can reasonably be linked to an individual, household, or device, directly or indirectly, as applicable under law. Personal Information does not include de-identified, aggregated, anonymized, or publicly available information that can reasonably be linked to an individual, household, or device and to the extent excluded by applicable law.

2. Application of Policy; Geographic Scope

This Privacy Policy applies to Personal Information you provide or authorize us to collect or process, or that is generated in connection with your use of the Services, including the Dermasync mobile application, software, websites, online services, customer support services, beta testing programs, research, analytics, product evaluation, product improvement activities, and any other services, features, or offerings that link to or expressly incorporate this Privacy Policy.

The Services are directed to and made available only to Members located in the United States, although the Services may not be available in every state at this time. Dermasync does not currently provide the Services to residents of the European Union, United Kingdom, or European Economic Area or certain states in the United States. The Services are not currently offered to residents of Washington State, and we will update this Privacy Policy and our Consumer Health Data Privacy Policy before making the Services available to residents in Washington. If you access the Services from outside the United States or from a state where Dermasync is not currently available, you do so on your own initiative and are responsible for complying with applicable local laws.

3. Subscription-Based Business Model; No Data Broker Status

Dermasync is first and foremost a subscription-based service. Our revenue comes primarily from Member subscription fees. We do not sell, license, rent, or otherwise commercialize your identifiable Personal Information as “sale” is defined under applicable state privacy law, including Health Data and Consumer Health Data, such as reproductive health data or menstrual-cycle data, and we do not participate in data brokerage activities. Dermasync is not registered as a "data broker" under California Civil Code §1798.99.80 or any similar state data broker registry statute. We do not knowingly sell personal information to third parties with whom a Member does not have a direct relationship. If our practices change such that registration is required, we will register as required by law and update this Privacy Policy.

4. Privacy Principles

Data Minimization. We collect Personal Information only to the extent reasonably necessary to enable and improve the Services or as may be required by applicable law.

Purpose Limitation. We use and process Personal Information only for purposes disclosed in this Privacy Policy, purposes compatible with these disclosures, purposes you authorize, or purposes permitted or required by law.

Security by Design. We incorporate reasonable administrative, technical, organizational, and physical safeguards into the Dermasync mobile application to protect Personal Information against unauthorized access, acquisition, disclosure, alteration, misuse, loss, or destruction.

Encryption by Default. We apply industry-accepted encryption and other technical protections to Health Data, including menstrual-cycle data and health and wellness information you share or authorize to share with us. Health Data is encrypted on your personal device before it is transmitted and remains encrypted in transit and at rest. This includes all Health Data you provide or have authorized to import and provide to us through Connected Service provider Apple HealthKit.

Member Control. We provide in-app mechanisms to enable Members to manage consents, export their data, delete their data, change their onboarding data, and set and modify account settings (such as communications and marketing preferences and in-app push notification reminders).

5. Categories of Information We Collect

You must affirmatively acknowledge that you have read, understand, and accept the Terms of Service, this Privacy Policy, and the Consumer Health Data Privacy Policy, and have received the outline of State-level Consumer Health Data Protections included in the Consumer Health Data Policy before a personal Dermasync account can be established for you or before we can collect any Personal Information from you.

Each of these acknowledgments and consents is presented separately during the initial sign-up process and requires its own affirmative checkbox; you cannot advance or create an account until each affirmative checkbox is checked as accepted. We do not collect Health Data, Consumer Health Data, or Usage Data until you have completed these acknowledgments, and your personal Dermasync account has been created. The email address or Apple relay address you provide, and the limited technical information necessary to deliver and secure the app, are processed during the sign-up process in order to create your personal Dermasync account. You can view each of these documents, and every consent and choice you made, at any time in your personal Dermasync account profile.

We process the following general categories of information, depending on how you use the Services, what information you provide, and which features you enable.

A. Account Data

“Account Data” is data or information that is reasonably needed or used to create, maintain, and administer your Dermasync personal account. Account Data may include the name you wish to use (it does not have to be your legal name), an email address that you wish to use, your age if you choose to provide it at sign-up (you may select “prefer not to say”), account identifiers, subscription selections and billing status, communication preferences, consent records and privacy setting selections, account settings, and audit and recovery records used to document privacy consents and requests. Account Data does not include Health Data or Consumer Health Data, such as menstrual-cycle data, reproductive health information, symptom information, medication or allergy information, pregnancy information, data from Apple HealthKit or other Connected Services, or personal photographs.

We do not receive, collect, or maintain payment account or credit or debit card information or bank account numbers. Your payment of fees and charges are processed by third-party payment processing Service Providers selected and utilized by you, and all payment information is collected, processed, and stored by the third-party payment processing Service Providers under their own terms.

Login by you to your personal Dermasync account and to use Dermasync’s Services is passwordless through “Sign-in” with Apple or a one-time email code. We do not enable access through or store a Member Dermasync password.

Other than for age eligibility purposes described in Section 6 and the age you may choose to provide at sign-up, we do not ask for or maintain Members' dates of birth or age unless required by applicable law or necessary for verification in accordance with this Privacy Policy or fraud-prevention purposes.

B. Usage Data

Usage Data. “Usage Data” is data and information about how you interact with the Services, our websites, mobile applications, emails, advertisements, social media pages, and related digital properties. Usage Data may include device and browser information; mobile application usage data, website and social media events, pages or screens viewed; referring and exit pages data; clickstream data; session information; feature interactions; subscription status; campaign identifiers; approximate location derived from IP address; the geographic location you select for certain personalization features; social media engagement metrics such as likes, shares, opens; diagnostics, crash reports, performance data, and similar technical or engagement information. The Dermasync mobile application does not collect advertising identifiers (such as Apple’s Identifier for Advertisers) and does not track you across other companies’ mobile applications or websites. Usage Data does not include your Health Data or Consumer Health Data, such as menstrual-cycle data, reproductive health information, symptom information, medication or allergy information, pregnancy information, data from Apple HealthKit or other Connected Services, or personal photographs.

Usage Analytics. Usage analytics in the Dermasync mobile application are optional and off by default; they are collected only if you turn on “Usage analytics” (at sign-up or at any time in your personal Dermasync account profile). When turned on, the mobile application sends the following data to Dermasync’s servers, never to third-party analytics providers: that the mobile application was opened, session length, and which screen was open and for how long; that a check-in was completed, a routine step was checked off, a routine was finished, an insight was saved, a product was added or removed, an export or account deletion was requested, a setting or consent was changed (for example, Apple Health or weather settings), the subscription screen was viewed, or a plan was started, completed, or restored; that a beta question was shown or answered; the sign-in method used; and the mobile application version, build, iOS version, phone model, and language. We use this information in aggregate to understand things like time spent on each screen, most-used features, how many Members check in each day, retention by sign-up week, and how many subscription-screen views lead to trials. Usage analytics never include anything you log (such as symptoms, period, flow, photographs, or notes), product names or ingredients, your profile responses, your email address or account, your location, or any device or advertising identifier. Events are stored under a random identifier created on your phone that is not linked to your account, and that identifier is replaced when you turn usage analytics off or delete your account.

The Dermasync mobile application does not contain any third-party Software Development Kits (SDKs). Signing in to use the Dermasync mobile application is through Apple’s “Sign-in” or a one-time access code sent to directly to you. Subscriptions are processed through Apple’s StoreKit, and crash and performance diagnostics come from Apple’s MetricKit and remain on your phone. Website analytics and marketing measurement take place only on our public websites through cookies and similar technologies, as described in our Cookie Policy; the Dermasync mobile application does not contain advertising or marketing SDKs. We do not provide access to these technologies to collect or receive Health Data or Consumer Health Data such as menstrual-cycle data, reproductive health information, symptoms, medications, allergies, pregnancy information, data provided by Apple HealthKit or other Connected Services, or personal photographs. If we add any third-party SDK in the future, we will update this Privacy Policy before doing so.

C. Health Data (Including Menstrual-Cycle Data)

Health Data including menstrual-cycle tracking are used by Dermasync to provide personalized cycle-aware skincare routine suggestions and educational information. The Health Data used for the Services may include:

• Skincare information: skin type, skin tone (including Fitzpatrick skin type), sensitivity and sensitivity triggers, allergens, skincare concerns, conditions, sun reaction, medications, and product usage;
• Menstrual-cycle and reproductive information: menstrual-cycle dates, period start and end dates, cycle length, menstrual flow information, period and ovulation indicators, hormonal phase information, contraceptive method and use, pregnancy status, and life stage (including perimenopause and menopause status).
• Symptoms and wellness observations: mood, energy, stress, sleep, exercise, basal and wrist temperature, alcohol use, diet (such as sugar and dairy), hydration, cramps, headaches, acne flare-ups or other skin observances, and other Member-logged symptoms; and
• Imported information: information you authorize us to import from Connected Services such as Apple HealthKit, and local weather, UV Index, and data provided by Apple WeatherKit. The weather service receives only the state-level or city-level location you select, and it never receives Health Data or Consumer Health Data.

Your control over information and data. While menstrual-cycle tracking is needed to enable Dermasync mobile application to provide personalized cycle-aware skincare suggestions and information, you decide what cycle data you enter, provide, or authorize to provide to us. If you do not provide or authorize the import of menstrual-cycle data, the Services will still provide a more basic skincare experience including general education and routines, but menstrual-cycle-personalization of menstrual-phase-based skincare guidance and period and ovulation indicators will not be available and cannot be provided by the Services.

Photographs. Your personal photographs that you take to record your user journey are purely optional. In the current Dermasync mobile application, personal photographs are only stored on your personal device. We do not see, have access to, analyze, or store your photographs. If the collection or storage of your personal photographs by us is added in the future, we will update this Privacy Policy and obtain your separate, affirmative consent before that feature becomes available. Because Dermasync currently does not store or have access to your photographs, your photographs cannot be used by us to create facial-recognition templates, facial geometry maps, retina or iris scans, voiceprints, or other biometric identifiers as those terms are defined under applicable biometric privacy laws.

D. Information From Connected Services

With your permission and authorization, certain Health Data and other Personal Information is provided to us from connected services provided by third parties, such as Apple HealthKit, a weather data provider (Apple WeatherKit), or similar digital personal information storage services ("Connected Services"). We use the Personal Information you authorize to be obtained from Apple HealthKit, Apple WeatherKit, or similar Connected Services to provide the core offering of the Services: cycle awareness and personalized insights and routines synced to your cycle and local environment (weather). Connected Services are separate from and are not affiliated with Dermasync. Your Health Data that is shared with us from Apple HealthKit is encrypted and inbound only. We do not share any Personal Information, including Health Data or Consumer Health Data with Apple HealthKit. Information obtained through Apple HealthKit is used only to provide the Services to you and is used as described in this Privacy Policy, the applicable Connected Service requirements, and applicable law. Personal Information from Connected Services, including Health Data or Consumer Health Data, is not used for advertising, marketing, or data mining, is not sold, and is not included in the de-identified data sets described in Sections 11 and 21.

6. Age Eligibility and Children's Privacy

The Services are intended for women who are 18 years of age or older. We do not knowingly permit registration or use of the Services by individuals under the age of 18. Members must provide an age eligibility attestation confirming that they satisfy the minimum age requirement. At sign-up, Members may also choose to provide their age or select “prefer not to say.” If you provide your age, it is Account Data: it is not encrypted like Health Data, and it is visible to Dermasync to operate the Services. Unless required by applicable law or necessary for age verification or fraud prevention, we do not store your date of birth, and we store your age only if you choose to provide it. If we become aware that we have collected Personal Information from an individual under the age of 18, or in violation of applicable law or this Privacy Policy, we will take reasonable steps to delete the information and comply with applicable legal requirements.

Children Under 13 (COPPA). The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under the age of 13 with respect to the Children's Online Privacy Protection Act (COPPA).

Consumers Under 16 (CCPA). We do not knowingly sell or share the Personal Information of consumers under the age of 16 with respect to the California Consumer Privacy Act (CCPA).

7. Privacy-by-Design Architecture

Dermasync is designed to restrict access to Health Data, including menstrual-cycle data, and to limit the extent to which Health Data is accessible to our personnel, Service Providers, or other third parties.

Field-Level Encrypted Information. Health Data, including menstrual-cycle data, is encrypted on your personal device before it is transmitted, and is transmitted and stored only as ciphertext. Your encryption key is generated on your personal device at sign-up, is shown only to you, and can be viewed in your personal Dermasync account profile. Dermasync does not maintain a copy of your key in readable form and cannot recover it for you if it is lost. Metadata relating to non-Health Data such as your account identity, record type, record keys, timestamps, and other non-Health Data Account Data and Usage Data may remain readable to us in order to facilitate the Services and other purposes.

Member Photographs. In Dermasync's current mobile application design, your personal photographs, if you choose to retain them, are stored only on your personal device and are not provided to, seen by, or stored by us. Dermasync does not have access to your personal photographs.

Operational Information. Certain Personal Information (but not Health Data) is accessible to Dermasync to provide the Services and other purposes described in this Privacy Policy, including the name you provide, email address you provide, your age (if you choose to provide it), account identifiers, subscription information, billing status, customer support communications, consent records, audit logs, security logs, and regulatory compliance records.

8. How We Use Information

We may use Personal Information to provide the Services, including:

• Personalized cycle-aware skincare insights, suggestions, routines and reminders synchronized to your menstrual-cycle, health, lifestyle, environment, and weather information you have provided or authorized.
• Menstrual-cycle tracking features, including logging periods and symptoms, identifying where you are in the four monthly menstrual-cycle phases, estimating and recording period dates, estimating likely ovulation dates, and generating cycle history summaries;

We may also use Personal Information to create and manage your account, process subscriptions, authenticate your Member status, maintain platform functionality, provide technical support, administer the Services, detect fraud, prevent misuse, investigate security incidents, protect your interests and the interests of other Members and our systems, enforce our terms and policies, respond to your inquiries, improve your experience, comply with legal obligations, preserve records, resolve disputes, and protect legal rights. We may also use aggregated, masked, or de-identified information derived from Personal Information to conduct internal research, analytics, and service improvement.

We may also use Usage Data (if turned on by you) and Account Data to evaluate mobile application performance, website traffic, mobile application and website engagement, feature usage, customer acquisition, subscription funnel performance, advertising effectiveness, attribution, email campaign performance, referral campaign performance, and, for visitors to our public websites only, remarketing or retargeting for Dermasync products and services and other marketing analytics as described in our Cookie Policy, subject to applicable law and available privacy choices. We do not use Health Data or Consumer Health Data, such as menstrual-cycle data, reproductive health data, symptoms, medications, allergies, pregnancy information, HealthKit or Connected Services data, or personal photographs for these purposes.

9. Automated Decision-Making Rule Based Application; Artificial Intelligence

Dermasync’s personalized skincare guidance, menstrual-cycle-aware suggestions, and cycle indicators are generated by a deterministic, rules-based engine — a highly specialized, predefined set of decision trees that interprets your information to provide tailored suggestions according to fixed, auditable rules — that does not use artificial intelligence or machine learning and is not trained on or changed by your data.

Separately, Dermasync uses artificial intelligence, in the form of a third-party large language model ("AI"), for the limited purpose to phrase the wording of the already-determined suggestions and educational content in clear, approachable language, informed by a curated library of evidence-based frameworks drawn from peer-reviewed dermatological and cycle-science literature. The use of AI for this purpose does not independently search the open internet, does not independently make personalization decisions, and operates subject to internal content guardrails that are intended to block medical-claim and other prohibited language.

Dermasync’s use of AI to generate the phrasing of its suggestions and other content is provided by a third-party large language model provider that only receives a routine step, a time of day, an ingredient name, and one educational sentence identical for every Member who receives that suggestion, together with any supporting research citations, and not identifiable Health Data such as cycle data, health symptoms, or health conditions. Our agreement with this provider prohibits the provider from using any information it receives from Dermasync to train or improve its models.

Suggestions, menstrual-cycle indicators, and personalized content provided to you by the Services — including the deterministic engine’s suggestions and their AI-assisted phrasing — are informational only. The Services provided by Dermasync to you or other Members do not produce legal effects concerning Members or similarly significant effects on Members, as those concepts are used under applicable privacy laws. Menstrual-cycle indicators are estimates based on your information and only such information that you choose to provide or authorize to provide, and thus are not to be relied upon for contraception, fertility planning, or medical decisions. You may update or change personalization features, or delete or export your Health Data or Consumer Health Data in your personal Dermasync account profile of the mobile application at any time. If you do not provide your menstrual cycle data or consent to the use or sharing of such information, the Services cannot provide you with personalized features tied to your menstrual cycle. Similarly, if you do not authorize or remove consents to connect to local environment (weather), personalized skincare guidance related to weather, humidity, or UV Index cannot be provided.

10. No Medical or Health Advice; Non-HIPAA Status

Dermasync does not provide medical or healthcare advice, diagnosis, treatment, or healthcare services of any kind, including with respect to menstrual, reproductive, or fertility health. We do not use AI technologies to diagnose medical conditions, provide medical treatment, or replace advice from qualified healthcare professionals. The Services, including the menstrual-cycle tracking feature, are not intended to be, and should not be interpreted as, a medical device, a contraceptive tool, a fertility diagnostic, or a substitute for professional medical advice, diagnosis, or treatment. Period and ovulation indicators are statistical estimates derived solely from information you log or authorize, are not clinically validated, and must not be used to prevent or achieve pregnancy or to make any medical decision. You should consult a qualified healthcare professional regarding any medical concerns, symptoms, conditions, medications, allergies, pregnancy-related matters, or other health-related questions.

Non-HIPAA Status. Dermasync is not a "covered entity," "business associate," or "subcontractor" under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and the Services are not HIPAA-regulated. Consumer Health Data, including menstrual-cycle data, is protected by this Privacy Policy, our standalone Consumer Health Data Privacy Policy, and applicable consumer health data laws, not by HIPAA.

11. No Sale of Personal Information; No Targeted Advertising Using Health Data

A. No Sale of Personal Information (including Health Data)

We do not sell your identifiable Personal Information, Health Data, or Consumer Health Data, including data or information relating to reproductive health, menstrual-cycle, pregnancy, health and medical symptoms, medication, allergy, photographs or images, wellness, or health data. Some of this information may be maintained on your personal device or are otherwise encrypted as described elsewhere in this Privacy Policy. We do not participate in data brokerage activities and do not monetize identifiable Member Health Data.

We may use information in aggregated, anonymized, or de-identified data sets (that do not include identifiable Personal Information including Health Data or Consumer Health Data) (“Anonymized Datasets”) as outlined in this Privacy Policy.

B. No Targeted Advertising Using Health Data

We do not use Health Data or Consumer Health Data, such as reproductive health information, menstrual-cycle information, symptom information, pregnancy information, medication information, allergy information, HealthKit or other Connected Services data, and personal photographs, for targeted advertising, behavioral advertising, cross-context behavioral advertising, retargeting, remarketing, advertising audience creation, lookalike audiences, marketing attribution, advertising profiling, third-party marketing campaigns, marketing third-party products or services, or disclosure to advertising networks, pixels, SDKs, data brokers, attribution platforms, social media advertising systems, or other third parties for advertising or marketing purposes. We use Usage Data and Account Data (which does not include Health Data or Consumer Health Data) for digital use measurement, analytics, and attribution, and (for visitors to our public websites only) remarketing for Dermasync products and services, subject to applicable law and your privacy choices. Remarketing and advertising cookies are used on our public websites as described in our Cookie Policy. The Dermasync mobile application does not use advertising identifiers, does not track you across other third party mobile applications or websites, and does not share information collected in the Dermasync mobile application with other third party advertising networks.

12. Member Communications, Personalization, and Marketing

A. Categories of Communications

Current communications methods that we utilize include (1) push communications to you on your personal device, such as morning and evening skincare routine reminders and (2) email communications to you for customer service, security, account administration and promotional purposes, as well as for purposes relating to product experience messages, referral invitations, research invitations, or beta invitations. Push communications and email communications do not include your Health Data and thus such information is not disclosed to a third-party Service Provider providing the push communication or email communication functions. We will implement and disclose communication channels consistent with applicable law. Your consent to accept email communications can be revoked at any time. Push notifications are optional. You can turn them on or off at any time in your personal Dermasync account profile or in your personal device settings, and the mobile application continues to work without them. We do not provide cell phone text or short message service (“SMS”) communications at this time; if we add SMS communications in the future, your consent will be required at that time.

B. Data Used

We use Account Data, Usage Data, and Health Data you provide or authorize to operate and provide the Services. We may use Usage Data, Account Data, and other Personal Information to market Dermasync products and services to you directly (for example, by email communications with your consent) and to measure campaign performance, subject to applicable law, and your privacy choices. Advertising audiences, attribution, remarketing, and retargeting rely only on website data collected through cookies on our public websites pursuant to our Cookie Policy. We do not use Health Data or Consumer Health Data (including menstrual-cycle data, reproductive health data, symptoms, medications, allergies, pregnancy information, Apple HealthKit or other Connected Services data, or personal photographs) for marketing, advertising, attribution, remarketing, retargeting, advertising audience creation, or lookalike audiences.

C. Channels and Consent

For any marketing email communications we send to you, we will do so in compliance with applicable law, including the U.S. Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act). If we offer marketing text messages in the future, we will send text messages only with your prior consent as required by the U.S. Telephone Consumer Protection Act (TCPA) and applicable state laws.

D. Opt Out

You can set or change your marketing and communications preferences in your personal Dermasync account profile at any time. You also can opt out of receiving email communications at any time by selecting the unsubscribe link in the email message. Opting out of Dermasync email communications for marketing purposes does not affect communications from us to you for purposes relating to the Services.

E. Referral Programs

If you refer another individual to Dermasync, we process the referred individual's contact information solely to deliver an invitation to the Services and administer any applicable referral benefit.

13. Cookies, SDKs, and Similar Technologies

A. Cookies and Web Technologies

On our websites and browser-accessible portions of the Services, we and our Service Providers may use cookies, local storage, and similar web technologies for strictly necessary functions to operate such technologies, functional preferences, aggregate analytics, marketing, and advertising. You will be provided the opportunity to accept or decline cookie preferences on our websites to control the information you share with us pursuant to our Cookie Policy. For more information, see our Cookie Policy.

The use of the Dermasync mobile application and Services are not available through a web browser (only through Dermasync’s mobile software application on your personal mobile devise); therefore, our websites and internet landing pages do not request, track, or maintain any Health Data or Consumer Health Data. Our websites provide pricing and education about the Services, customer support services, and methods to outreach to us, as well as directing visitors to a subscription provider (e.g., Apple App Store) to open an account with Dermasync for the Services or to our social media channels for more information. We do not use cookies on any page of our websites to obtain any Health Data or Consumer Health Data (such as menstrual-cycle data or reproductive health data) because those functions do not exist on our websites.

B. Third-Party Software Development Kits and Analytics

We employ tools to aid with our software performance monitoring, crash reporting, site analytics, authentication, technical diagnostics, and, on our public websites only, marketing and advertising support. Visitors of our websites are provided an opportunity to accept or decline cookie preferences as described in the Cookie Policy. Your Health Data and Consumer Health Data (including reproductive health data, menstrual-cycle information, pregnancy information, symptoms, medications, allergies) are encrypted and only provided in connection with our mobile application as described in this Privacy Policy. Your Health Data and Consumer Health Data are never provided on our website and, therefore, are not disclosed to SDKs, analytics providers, advertising networks, or third parties who use software tools that may have access to our websites and internet advertising to evaluate marketing campaign performance.

14. Sharing of Information

We may disclose your Personal Information as described in this Privacy Policy or as otherwise required by applicable law. The table below summarizes the categories of recipients with whom we may share information, the categories of information shared, and the purposes of sharing. **

15. Recipients of Information

Service Providers. Certain functions of the Services are provided by third party Service Providers to operate, support, and improve the Services (each, a "Service Provider" and collectively, "Service Providers"). Service Providers may include cloud hosting Service Providers, payment processing Service Providers, customer support Service Providers, security and fraud prevention Service Providers, infrastructure Service Providers, communications Service Providers, AI Service Providers, and product data Service Providers, each as described in this Privacy Policy.

Service Providers receive only the information reasonably necessary to perform their contracted functions and must protect it according to contractual obligations or applicable law. We require each Service Provider and other third party that receives Personal Information from us to provide the protection of that information as described in this Privacy Policy. Service providers that process Personal Information on our behalf are generally expected to maintain reasonable safeguards to protect such information and to process it consistent with this Privacy Policy and in accordance with applicable contractual requirements and law. We may also require service providers to maintain appropriate confidentiality protections and to notify us of security incidents as required by contract or applicable law. Health Data and Consumer Health Data, to the extent accessible to Service Providers in order for Dermasync to provide the Services, is encrypted as ciphertext.

Legal Compliance and Protection of Rights. We may disclose Personal Information or Usage Data to legal, regulatory, or governmental authorities when required or permitted by applicable law, regulation, subpoena, court order, governmental request, legal process, or other legally enforceable obligation, or when we reasonably believe disclosure is necessary to protect legal rights, enforce agreements, prevent fraud, address security incidents, or protect safety. Health Information, including menstrual-cycle data, remains encrypted as described in this Privacy Policy.

Successors and Assigns. If Dermasync is involved in a merger, acquisition, financing, restructuring, reorganization, sale of assets, or similar transaction, your Personal Information may be transferred to the applicable successor or assign as part of the transaction, subject to applicable law and existing privacy commitments including this Privacy Policy.

16. Legal Basis for Processing

Where applicable law requires us to identify a lawful basis for processing Personal Information, we may rely on one or more of the following bases: your consent; performance of a contract with you; compliance with legal obligations; and legitimate business interests, including fraud prevention, security features of the mobile application, customer support, debugging, service improvement, analytics, and performance monitoring. We balance our legitimate business interests against your privacy rights in compliance with applicable law.

17. International Data Transfers

Your Personal Information that is available to us to provide the Services or other purposes as described in this Privacy Policy may be processed, stored, and transferred by us or Service Providers in the United States and other jurisdictions where we or our Service Providers operate. Privacy laws in those jurisdictions may differ from the laws in the United States or your country or state of residence.

18. Member Rights and Privacy Controls

Privacy Controls Within the Services. You may change available privacy preferences at any time through settings found in your personal Dermasync account profile. From your personal Dermasync account profile, you can view each policy you accepted and every consent and communication choice you made, review and change your answer to any question you were asked during onboarding at sign-up, export your data, delete your data, change the data you submitted at onboarding, enable or disable Connected Services such as Apple HealthKit and weather-based personalization (Apple WeatherKit), turn “Usage analytics” and “Anonymized Datasets” on or off, and set or change communications and marketing preferences.

To set up a personal Dermasync account, you are asked, in separate consents that each require their own checkbox, to read and acknowledge the Terms of Service, the Privacy Policy, the Consumer Health Data Policy, and the state-level consumer health data protections as outlined in the Consumer Health Data Policy. You are also presented with a separate, optional consent regarding de-identified data sets, as described in Sections 11 and 21. You will not be able to establish your personal Dermasync account, and no Personal Information can be shared with us through your personal Dermasync account until you provide your acknowledgment that you have read the Privacy Policy, the Consumer Health Data Policy, and the state-level data privacy protections as outlined in the Consumer Health Data Policy. You can terminate your personal Dermasync account at any time.

Global Privacy Control (GPC). We recognize and honor Global Privacy Control signals and other browser-based or platform-based opt-out preference signals recognized under applicable law as valid requests to opt out of the sale or sharing of personal information and processing for targeted advertising, to the extent applicable.

Legal Rights. Depending on your jurisdiction of residence and applicable law, you may have rights to request access, correction, deletion, export or portability, restriction of processing, withdrawal of consent, or appeal of certain decisions. At any time, you can export or delete your data, change information provided during onboarding, stop the sharing of information from Apple HealthKit or weather-data Connected Services, and change communications and marketing preferences. These privacy options can be managed in your personal Dermasync account profile section of the Dermasync mobile application. If you need assistance with your personal Dermasync account profile or privacy controls, you can contact Dermasync Customer Care or privacy@trydermasync.com for assistance. Before fulfilling privacy requests, we may verify your identity to protect account security, prevent fraud, and prevent unauthorized disclosure of personal information. Authorized agents may be required to provide proof of authorization and sufficient information to verify both your identity and the agent's authority.

19. Data Retention

We retain Personal Information depending on the information collected, why it was collected, your use of the Services, applicable legal and contractual requirements, operational needs, security requirements, dispute resolution needs, recordkeeping obligations, and legitimate business purposes. The general retention practices below are intended to align with current functionality of the Dermasync mobile application and stated compliance objectives. Actual retention periods may vary based on specific circumstances and applicable law.

Deleted information is removed within a reasonable period following the applicable retention period, subject to backup systems, legal obligations, security requirements, dispute resolution needs, fraud prevention, and other legitimate business purposes permitted by applicable law. Automated retention sweeps and purge mechanisms will be implemented and maintained to reflect the retention periods stated in this Privacy Policy. Unidentified or anonymized information does not contain any Personal Information (including no Health Data or Consumer Health Data) and may be stored and retained by us.

20. Account Deletion and Data Removal

You can delete your personal Dermasync account at any time through your personal Dermasync account profile on your personal device. Once your personal Dermasync account has been deleted, the information may not be retrievable. (Note: Deleting your Dermasync account does not terminate your subscription through Apple subscription services. Subscription termination must be done through your subscription provider (e.g., Apple Subscriptions).)

Upon initiation of the deletion process, personal identifiers will be permanently disconnected from account information; encrypted Health Data records and associated key material will be deleted, rendering any residual ciphertext permanently unreadable; and account information will become inaccessible through normal account functions. Backup systems may require up to ninety (90) days or longer for complete removal or overwriting of your Personal Information after deletion of your personal Dermasync account. Once deletion of your personal Dermasync account is completed, recovery of the deleted account and associated information may not be possible. We may retain certain records where required or permitted by applicable law, including for compliance, fraud prevention, security, dispute resolution, accounting, tax, audit, or legal defense purposes.

In the event of a Member's death, we may honor requests from a duly authorized legal representative to access limited account information or delete the Member’s personal Dermasync account, subject to identity verification and applicable law. We do not provide access to Health Data or Consumer Health Data of a deceased Member except where required by court order or applicable law.

21. Anonymized Datasets

We may use Anonymized Datasets for internal product improvement, statistical analysis, educational content, performance monitoring, quality assurance, service improvement, and, if we choose at our discretion, to share, license, or sell to third parties for research or commercial purposes. At sign-up, on its own separate consent box, we ask you for separate, optional, affirmative consent to include information in Anonymized Datasets for our use. The Anonymized Datasets may include information relating to skin type, including Fitzpatrick skin type, skin characteristics such as sensitivity, allergens, skin concerns, skin conditions, contraception, life stage, cycle length and duration, Usage Data, wellness information such as stress, physical activity, dietary characteristics (such as sugar, dairy and alcohol use), hydration, sleep, product use, and routines. Information from Apple HealthKit is not included in Anonymized Datasets. Anonymized Datasets are collected and maintained without any reference or connection to Personal Information such that the information in Anonymized Datasets cannot be reasonably linked to you or any other individual Member. Where we de-identify personal information, and consistent with California Civil Code §1798.140(m) and analogous laws, we take reasonable measures to ensure that the information cannot be associated with, or reasonably linked to, a Member, directly or indirectly, and Dermasync will not attempt to reidentify information held in Anonymized Datasets as Personal Information.

22. Security

We use reasonable, industry-standard administrative, technical, organizational, and physical safeguards intended to protect Personal Information, including Health Data and Consumer Health Data, against unauthorized access, acquisition, disclosure, alteration, loss, misuse, or destruction. These safeguards may include encryption at rest, encryption in transit, field-level encryption, role-based access controls, multi-factor authentication, security monitoring, audit logging, penetration testing, vulnerability management, and Service Provider security reviews, as appropriate to the nature and sensitivity of the information.

Privacy and Security Governance. We may, in our discretion, but without obligation, periodically conduct privacy, security, and data protection assessments to evaluate security risks, regulatory compliance obligations, Service Provider privacy and security practices, potential impacts to privacy, data minimization practices, and effectiveness of safeguards.

Security Incidents and Breach Notification. If we become aware of a security incident involving Personal Information, we will take reasonable steps to investigate, contain, mitigate, and remediate the incident; notify affected Members where required by applicable law; notify regulators or governmental authorities where required by applicable law; and cooperate with law enforcement or regulatory authorities where legally required. Depending on the circumstances, remediation may include account suspension, invalidating active sessions, requiring Members to sign in again, token rotation, enhanced monitoring, temporary service restrictions, additional security controls, and other measures designed to reduce risk of harm.

Because sign in to your personal Dermasync account is passwordless through Sign in with Apple or one-time code sent to you via an email message, there is no password to enable you access to your personal Dermasync account. We may sign you out of your personal Dermasync account and ask you to sign in again for security reason or other purposes.

The timing, form, and content of notification to you of a suspected breach that may involve involuntary disclosure of your Personal Information are governed by specific state or federal laws. It is important to note that technology is always evolving and developing, and no encryption method or security protocols, systems, or precautions are guaranteed to be unbreakable or be absolute security, and no method of transmission or storage is completely secure, and thus we cannot guarantee that Personal Information will never be accessed by an unauthorized party.

23. Changes to This Privacy Policy

We may amend or update this Privacy Policy from time to time. Changes become effective as of the effective date identified in the revised Privacy Policy unless otherwise required by applicable law. When required, notice of changes to this Privacy Policy will be distributed or disclosed through the Services, Dermasync’s websites, email messages to you, or another appropriate means as determined by us.

24. Contact Us

For questions regarding this Privacy Policy or concerns or concerns regarding your Personal Information, you may contact us at privacy@trydermasync.com or:

Privacy Officer
Dermasync
453 S. Spring Street, Suite 1212
Los Angeles, California 90013

For privacy requests, data requests, or Consumer Health Data requests, please see your personal Dermasync account Member profile section. If you have an additional request not found there, please contact us at privacy@trydermasync.com.

Appendix A — Member Feedback and Grievance Procedure

Dermasync is committed to addressing Member questions, concerns, and complaints regarding our privacy practices. You may submit feedback, concerns, or complaints about this Privacy Policy or our handling of personal information by contacting us at privacy@trydermasync.com or through your personal Dermasync profile. Submissions should describe the concern with reasonable specificity and include account information needed for identity verification. Questions, concerns, and complaints will be evaluated and responded to within a reasonable time depending upon the nature of the question, concern, or complaint.