Privacy Policy

1. Overview

Skin Edit ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Québec, with Loi 25 (Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25). Where Québec law imposes a stricter standard, it prevails.

2. Information We Collect

We collect the following categories of personal information, limited to what is necessary for each purpose:

• Account information: name, email address, phone number, password (hashed — never stored in plain text)
• Skin profile data: skin type, concerns, goals, sensitivities, acne severity, and routine preferences
• Health-related disclosures: pregnancy or breastfeeding status, prescription medication use, severe skin sensitivities, and known allergies — provided voluntarily to tailor safe product recommendations
• Progress photos: images you voluntarily upload to your skin diary
• AI skin analysis photos: facial photographs submitted for AI-assisted skin analysis (treated as sensitive personal information)
• Purchase history: products and services purchased through the platform
• Appointment data: booking requests and appointment history
• Loyalty data: points balance, redemption history, referrals
• Usage data: pages visited, features used, device type, and IP address

Health-related disclosures and facial photographs are treated as sensitive personal information and are subject to heightened protection. You may decline to provide this information; doing so may limit certain features.

3. Purpose of Collection

We collect information only for the specific, explicit purposes listed below:

• Provide, operate, and improve the Service
• Personalize your skincare routine recommendations based on your skin profile
• Generate AI-assisted skin analysis reports (facial photos only, with your consent)
• Screen product recommendations for safety contraindications (health disclosures)
• Process appointments and purchases
• Manage your loyalty rewards account
• Send transactional emails (booking confirmations, receipts, routine updates)
• Send optional push notifications about your routine and rewards
• Respond to your inquiries and provide customer support
• Ensure the security and integrity of the platform

We do not sell your personal information to third parties. We do not use your information for advertising profiling or behavioural targeting.

4. AI Skin Analysis & Automated Processing

If you choose to submit photos for AI skin analysis, your images are processed by Anthropic's Claude API (claude-opus-4-5 vision model) to identify visible skin characteristics. This constitutes automated processing of sensitive personal information. The following applies:

• AI analysis results are reviewed and approved by a qualified clinic staff member before you can view them
• Analysis results are not a medical diagnosis — they describe visible aesthetic characteristics for skincare planning purposes only
• You may request that your AI analysis data be deleted at any time
• Photos submitted for analysis are stored in a private, access-controlled bucket and are never publicly accessible
• Submitting photos for analysis is entirely voluntary

5. Sharing of Information

We share your information only as described below:

• Your clinic: when you book an appointment or interact with clinic features, relevant information (name, email, skin profile, appointment notes) is shared with the clinic that invited you
• Anthropic: facial photographs and questionnaire context are transmitted to Anthropic's API solely for AI skin analysis, under Anthropic's data processing terms
• Supabase: database and file storage provider (servers located in Canada or the United States via AWS); bound by a Data Processing Agreement
• Stripe: payment processing; your financial data is handled directly by Stripe and is not stored on our servers
• Resend: email delivery; recipient addresses and email content are transmitted for delivery only
• Legal authorities: if required by law or court order, or to protect our rights or the safety of our users

Cross-border transfers: some service providers process data outside of Canada (primarily in the United States). Where personal information is transferred internationally, we ensure appropriate contractual protections are in place consistent with PIPEDA and Loi 25 requirements.

6. Data Storage & Security

Your data is stored on servers located in Canada or the United States via Supabase (hosted on AWS). We implement the following security measures:

• Encryption in transit (TLS 1.2+) for all data transfers
• Encryption at rest for all stored data
• Row-level security on our database — each user can only access their own records
• Private storage buckets for progress photos and skin scan images (not publicly accessible)
• HTTP security headers (Content Security Policy, HSTS, X-Frame-Options) on all pages
• Regular security reviews and access control audits

No system is completely secure. Please use a strong, unique password and do not share your login credentials with others.

7. Security Incidents

In the event of a security incident involving your personal information that poses a real risk of significant harm, we will notify you and the applicable privacy authority (the Office of the Privacy Commissioner of Canada, and/or the Commission d'accès à l'information du Québec) within the timeframes required by applicable law (72 hours for Québec residents under Loi 25).

8. Progress Photos & Skin Scan Photos

Photos you upload are stored securely in private, access-controlled storage. Progress photos are only visible to you and your treating esthetician. Skin scan photos are additionally processed by AI for analysis as described in Section 4. Photos are never shared publicly or used for marketing without your explicit written consent. You may delete your photos at any time from the app.

9. Push Notifications

If you enable push notifications, we may send reminders about your skincare routine, loyalty points, and appointments. You can disable push notifications at any time through your device settings or within the app. Disabling notifications does not affect your access to any features.

10. Cookies

We use essential session cookies to keep you logged in. These are necessary for the Service to function and cannot be disabled. We do not use third-party advertising cookies, behavioural tracking cookies, or analytics cookies that identify you individually. If this changes, we will update this policy and seek your consent where required.

11. Your Rights

Under PIPEDA and, where applicable, Loi 25 (Québec), you have the following rights:

• Access: request a copy of the personal information we hold about you
• Correction: request that inaccurate or incomplete information be corrected
• Deletion: request deletion of your account and associated personal information
• Portability (Québec — Loi 25): request your personal information in a structured, commonly used, machine-readable format for transfer to another service provider
• Automated decision-making (Québec — Loi 25): request human review of any decision made solely by automated means that significantly affects you, and be informed of the personal information used and the reasons behind the decision
• Withdrawal of consent: withdraw consent for optional data uses (push notifications, AI skin analysis) at any time
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, for Québec residents, the Commission d'accès à l'information (www.cai.gouv.qc.ca)

To exercise any of these rights, contact our Privacy Officer at privacy@myskinedit.org. We will acknowledge your request within 10 business days and respond fully within 30 days.

12. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specific retention practices:

• Skin profile data: retained while your account is active; deleted within 30 days of account deletion
• Skin scan photos and AI analysis results: retained until you delete them or your account is closed
• Purchase and payment records: retained for 7 years as required by Canadian tax law
• Server logs (IP addresses): retained for up to 90 days for security purposes

When personal information is no longer necessary for its purpose and no legal retention obligation applies, we securely destroy or anonymize it.

13. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date and, where required, by sending an email notice to registered users at least 15 days before the changes take effect. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Privacy Officer & Contact

We have designated a Privacy Officer responsible for our compliance with PIPEDA and Loi 25. For any privacy-related questions, access requests, or complaints, please contact:

Privacy Officer, Skin Edit
Email: privacy@myskinedit.org

If you are a Québec resident and are not satisfied with our response, you have the right to lodge a complaint with the Commission d'accès à l'information du Québec: www.cai.gouv.qc.ca