Privacy Policy

SkinDay ("we," "us," or "our") operates skinday.com and skinday.ca, a global aesthetic clinic discovery platform and clinical image tool suite. This Privacy Policy explains how we collect, use, disclose, and protect your information across all SkinDay properties.

By using any SkinDay product, you agree to the collection and use of information in accordance with this policy.

---

1. Information We Collect

• Account information: When you create an account, we collect your name and email address. If you sign in with Google, we receive your name, email, and profile photo from Google.
• Usage data: Pages visited, clinics viewed, search queries, and interaction with tools including Visualize and Studio.
• Saved clinics: When you save clinics to your shortlist, we store those preferences linked to your account.
• Clinic data: Pricing, credentials, and profile information submitted by clinic owners through the Clinic Portal.
• Visualize sessions: Photos you upload for an AI treatment preview are sent to our AI provider to produce that preview. We hold your photo only while the generation is running and delete it as soon as the generation finishes or fails. The generated preview is held briefly so it can reach your browser, and is deleted automatically within 48 hours. SkinDay does not build a lasting record of your photographs or your previews.
• Studio sessions: Photos processed in Studio are handled entirely in your browser. SkinDay does not receive or store them. The exception is a clinic using Studio inside a Visualize Pro account, which can choose to save a case to that clinic's private Library. See section 5, Visualize Pro and clinic libraries.
• Click tracking: We track clicks on external clinic links to understand patient interest patterns. No personal information is linked to these events unless you are signed in.

2. How We Use Your Information

• To provide and improve SkinDay products and services
• To personalise your experience including saving your shortlist across devices
• To communicate with you about your account or platform updates
• To analyse aggregate usage patterns and clinic performance data
• To provide anonymised market insights to industry partners. No personal patient data is shared

3. Data Sharing

We do not sell your personal information. We may share data in the following circumstances:

• Service providers: Supabase (database and authentication), Resend (transactional email), Stripe (payments for Visualize credits), and OpenAI (AI image generation for Visualize). Each processes data on our behalf under their own privacy policies.
• Industry partners: Aggregate, anonymised market data may be shared with pharmaceutical or device industry partners for research purposes. This data does not identify individual users or patients.
• Legal requirements: We may disclose information if required by applicable law or to protect the rights and safety of our users.

4. Cookies and Local Storage

SkinDay uses cookies and local browser storage to maintain your session, remember your preferences (such as language choice and saved clinics), and track anonymous usage patterns. We do not use advertising cookies or third-party tracking pixels. You can disable cookies in your browser settings, though this may affect platform functionality.

5. Visualize Pro and Clinic Libraries

Visualize Pro is our product for clinics. It works differently from consumer Visualize in one important way: it keeps records. This section explains what those records are, whose they are, and how they end.

• What is kept: A clinic can save two kinds of record to its private Library. Before and after photographs of a patient, and simulations, which pair a patient's photograph with a generated preview of a possible outcome. A simulation is a prediction, never a result.
• Whose record it is: These records are held by SkinDay on the clinic's behalf. Obtaining and holding the patient's consent is, and remains, the clinic's responsibility. What SkinDay records is that a named member of that clinic stated the consent existed, and when. We do not hold a copy of any consent form.
• Who can see it: A clinic's Library is private to that clinic. Nothing in it is public unless the clinic separately chooses to publish a specific photograph to its own website gallery, which requires its own permission. A simulation can never be published, and can never be used to guide another clinic's simulations.
• Guiding a clinic's own simulations: With the patient's permission, a clinic's own before and after photographs can be used as a visual reference for that same clinic's simulations, so results better match its clinical style. A clinic's photographs are never used as a reference by any other clinic, and never leave that clinic's account.
• How it ends: When a clinic records that a patient has withdrawn consent, the record is removed and the photographs are permanently deleted from our storage. Deletion is real, not a hidden flag. What survives is a dated note that the record existed, that consent was given, and that it was withdrawn, because the account of a deletion has to outlive the thing deleted.
• If you are a patient: Your relationship is with your clinic, not with SkinDay. To ask what is held about you, or to withdraw your consent, contact your clinic. You may also write to us and we will direct your request to them.

6. Data Retention

We retain your account data for as long as your account is active. You may request deletion of your account and associated personal data at any time by contacting us. Aggregate, anonymised analytics data may be retained indefinitely.

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), secure authentication via Supabase, and row-level security policies on our database. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights by Jurisdiction

Your privacy rights depend on where you are located. Below are the frameworks that apply to our current markets.

As SkinDay expands to additional markets, this section will be updated to reflect the applicable privacy frameworks for each jurisdiction.

9. Children's Privacy

SkinDay is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes by email. The updated date at the top of this page indicates when changes were last made. Continued use of SkinDay after changes constitutes acceptance of the updated policy.

11. Contact

For any questions about this Privacy Policy or how we handle your data:

• Email: hello@skinday.com
• Website: skinday.com