This Privacy Policy explains what information DermaScan ("we", "us") collects when you use the DermaScan mobile app, how we use it, and the choices you have. DermaScan is a hair care guidance app that provides personalized product recommendations based on a short quiz and, optionally, scalp/hair photos. By creating an account or using the app, you agree to the collection and use of information as described here.
1. Information We Collect
Account information: name, email address or phone number, and (if you sign in with Google) your Google profile name/email. Quiz responses: your answers to the hair/scalp assessment questions used to generate your recommendation. Scalp/hair photos: images you choose to upload of your scalp, hairline, and the back of your head — these are optional and only used to refine your recommendation. Order information: shipping addresses, order history, and payment method chosen (Cash on Delivery or online payment) — we do not store your card or UPI details ourselves; those are handled directly by our payment processor. Device information: a push-notification token so we can send you order updates, and basic technical data (app version, device type) for troubleshooting.
2. How We Use Your Information
To generate and improve your personalized hair care recommendation. To create and manage your account, and verify your identity via OTP or Google Sign-In. To process, ship, and provide support for your orders, and to send you order-status and account notifications. To detect and prevent fraud, abuse, or security issues. To comply with legal and tax obligations (e.g. GST invoicing). We do not sell your personal information to third parties.
3. Scalp & Hair Photos — Special Care
Photos of your scalp/hairline can be sensitive. Uploading photos is always optional — you can skip this step and still receive a recommendation based on your quiz answers alone. When our admin-configured analysis mode is "Rule-Based", your photos are stored securely and are not analyzed by any automated or AI system. When "AI-Based" mode is enabled by us, your photos may be sent to a third-party AI provider (Anthropic's Claude or OpenAI's GPT, depending on our current configuration) solely to generate your recommendation; these providers process the images under their own data-handling terms and we do not permit them to use your photos to train their models beyond what's necessary to return a result to us. You can delete your photos at any time by deleting your account (see Section 7).
4. Third-Party Service Providers
We share the minimum necessary information with the following categories of service providers to operate the app: payment processing (Cashfree, for online payments); SMS delivery (our SMS gateway provider, to send OTP login codes); push notifications (OneSignal and/or Firebase Cloud Messaging); sign-in (Google, if you choose Google Sign-In); and, only when AI-based analysis mode is active, AI providers (Anthropic and/or OpenAI) as described in Section 3. Each of these providers processes data under their own privacy policy and terms.
5. Data Storage & Security
Your data is stored on secured servers with access restricted to authorized personnel. We use industry-standard measures (encrypted connections, access controls, and encrypted storage for sensitive fields such as API credentials) to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
6. Data Retention
We retain your account, quiz, and order data for as long as your account is active, and for a reasonable period afterward as required for legal, tax, or dispute-resolution purposes (e.g. GST invoices). Scalp/hair photos are retained only as long as your account exists, unless you delete them or your account sooner.
7. Your Rights
Subject to applicable law (including India's Digital Personal Data Protection Act, 2023), you have the right to access, correct, or delete your personal information. You can update your profile and addresses directly in the app, and you can permanently delete your account and associated data — including your quiz answers, photos, and addresses — at any time from Account → Delete My Account. Some information (such as records required for tax/accounting purposes) may be retained for a limited period after deletion as required by law. To exercise any other rights, contact us using the details in Section 10.
8. Children's Privacy
DermaScan is not directed at children and is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by other reasonable means before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our Grievance Officer at [grievance-officer-email@dermascan.example] or write to us at [Company Legal Name, Registered Address]. [This section is a placeholder — please replace with DermaScan's actual registered business details before launch.]