Privacy Policy

The protection of your personal data is particularly important to us - especially since DermCheck works with health-related image data. The following information provides an overview of what happens to your data when you use our website.

Philipp Schmid
Steinenberg 10
88339 Bad Waldsee
Deutschland

E-Mail: [email protected]

Data processing on this website is carried out by the website operator. You can find out which data is collected in the following sections.

When registering via Google or email, we collect:

• Email address
• Name (if provided via Google)
• Profile picture URL (if provided via Google)

• Photographs of skin lesions/moles
• AI-generated risk assessments and ABCDE analyses
• Results of ensemble AI classification (HuggingFace models)
• Assessments by registered dermatologists (for paid reviews)

Legal basis: Art. 9(2)(a) GDPR - your explicit consent when using the scan service. You can request deletion of your scan data at any time.

Payments are processed through Stripe. We do not store any credit card or bank details. Only Stripe reference IDs (Session ID, Payment Intent ID) are stored to associate payments. For more information, see Stripe's privacy policy at https://stripe.com/privacy.

Your uploaded images are transmitted to the following third-party providers for analysis purposes:

• Anthropic (Claude Vision) - for textual ABCDE dermoscopic analysis
• RunPod (USA) - GPU inference of the image classification models
• Amazon Web Services, S3 (EU region) - encrypted storage of your scan images

The website host automatically collects information in server log files:

• Browser type and version
• Operating system used
• Referrer URL
• Time of server request and IP address

Our website uses technically necessary cookies for authentication (Supabase session); these are required for operation and cannot be disabled. In addition, and only with your consent given via the cookie banner, we use statistics and marketing technologies (e.g. Google conversion tracking). You can withdraw your consent at any time via the cookie settings.

We use the following external services:

• Supabase (Hetzner, EU) - Authentication and image storage
• Anthropic (USA) - AI image analysis via Claude Vision
• HuggingFace (USA/EU) - AI classification models for skin lesions
• Stripe (USA, EU data processing) - Payment processing
• TikTok Pixel (TikTok Technology Ltd., Ireland/USA) - conversion measurement for ads; loaded only after your marketing consent via the cookie banner. No health data and no contact data is ever transmitted.

Part of the processing takes place in the United States: Anthropic (Claude Vision) analyses the image, RunPod provides the GPU inference, and Resend delivers our emails. There is no adequacy decision of the European Commission for these transfers. We therefore base the transfer of your skin image on your explicit consent under Art. 49(1)(a) GDPR, which you give before uploading and can withdraw at any time with effect for the future. For the remaining transfers we rely on the European Commission Standard Contractual Clauses under Art. 46(2)(c) GDPR. Please note that US authorities may under certain conditions access data processed there and that you may not have legal remedies comparable to those in the EU. The images themselves are stored with Amazon Web Services in a region inside the European Union.

This site uses SSL/TLS encryption for security reasons. An encrypted connection can be recognized by the lock symbol in your browser bar and the address bar starting with 'https://'.

You have the following rights at any time regarding your stored personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) - including all scan images and analysis results
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

Scan images and analysis results are stored as long as your user account exists. Upon account deletion, all associated data (images, analyses, reviews) are irrevocably deleted. Payment data is retained in accordance with statutory retention periods (10 years).

We reserve the right to update this privacy policy to comply with current legal requirements or to reflect changes in our services.