Privacy Policy

1. Introduction

MySkinIQ LLC ("MySkinIQ," "Company," "we," "us," or "our") operates the MySkinIQ mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

Please read this Privacy Policy carefully. By downloading, accessing, or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the App.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide when using our App:

Important: We do NOT collect or store your password. Authentication is handled securely by Apple or Google.

2.2 Health-Related Information

Our App processes health-related information that you voluntarily provide, including:

• Known allergens and sensitivities
• Family member allergen profiles and a coarse child age range (“Under 5” or “5 or older”) when voluntarily added by a parent or guardian. If an app version asks for a child’s date of birth, we use it only to set the age range and don’t store it
• Skin conditions (e.g., eczema, dermatitis, sensitive skin)
• Adverse reactions to products (if reported)

This information is considered sensitive personal data under GDPR and similar regulations and may be sensitive personal information under California law because it can concern health or health-related inferences. We process this data only with your explicit consent and solely to provide personalized product safety analysis.

2.3 Allergen identification reasoning

When you import a patch-test report from an image or PDF, MySkinIQ reads the image on your device first. The image itself never leaves the device and is discarded after OCR completes.

On devices without on-device AI, MySkinIQ asks for explicit consent before sending recognized text to Anthropic / Claude for allergen identification. If you choose "Send text this time" or "Always send text," only the recognized text is sent. If you choose "Keep matching on this device," the text stays on your device and MySkinIQ uses local dictionary matching instead. Recognized patch-test text may contain allergen names or other health-related inferences, so we treat it as sensitive. You can change persistent patch-test text matching at any time in Settings > Privacy > Send patch-test text for matching.

2.4 Automatically Collected Information

When you use the App, we automatically collect certain information:

Device Information:

• Device type and model
• Operating system and version
• Unique device identifiers (anonymized)
• App version

Usage Information:

• Features used and frequency
• Search queries (product names, URLs)
• Analysis history
• Analysis outcomes in analytics events: the verdict category shown (Clear, Caution, or Avoid), the score, and counts such as how many ingredients were flagged and how many allergens are on your profile, but not the names of your allergens or whether you use a life stage (for example pregnancy). Earlier app versions sent how many life-stage flags apply and the text of a life-stage flag you tapped.
• App performance metrics
• Crash reports

MySkinIQ does not currently offer an in-app switch for product analytics or for shop-link click records (Section 2.5). To object, email [email protected].

We do NOT collect:

• Precise GPS location
• Photos from your camera roll
• Contacts
• Browsing history outside the App

2.5 Shop Links and Affiliate Click Records

Some product pages offer a shop link to a retailer. If you buy through one, we may earn a commission at no extra cost to you. As an Amazon Associate we earn from qualifying purchases. Today the retailer network is Amazon.

When you tap a shop link, we keep a record of the tap so we can attribute commissions and see which screens people actually use. Each record is linked to your account and contains:

• Your MySkinIQ user ID
• The product (our catalog ID, its Amazon ASIN and, when supplied, its name) and the retailer network
• The screen the link was on (for example a product page, a list, or a verdict screen)
• A link-freshness flag and the time of the tap

The record does not store your allergen profile, your allergens, or the verdict (Clear, Caution, or Avoid) shown for the product, and every link on a results screen is recorded under one shared screen name so that the screen does not reveal the verdict. It can still show that a product was not rated Avoid for you, because we never show a shop link for a product rated Avoid, and some screens, such as Discover, list only products rated safe for you. We also log a Firebase Analytics event for the tap, with the product identifier, retailer network, the link's position in a list, and the placement variant. Earlier app versions also sent the verdict category shown for the product with this event, and click records created by earlier versions may include it. We do not send the click record or the event to Amazon. We use them for commission attribution and product analytics only. We do not use them to build advertising profiles, and we do not use them to track you across other companies' apps or websites.

The link itself carries only our static store tag, never your name, email, user ID, or profile. Once you open it, the retailer receives your request the way any website does, and the retailer's own privacy notice governs what it collects.

These records are included in Export My Data and are deleted when you delete your account (see Section 5). MySkinIQ does not currently offer an in-app switch to turn these records or this event off. To object to them, or to ask us to export or delete them without closing your account, email [email protected].

2.6 Profile Sharing

You can send your allergen profile to another person with a link that expires after 7 days and can be used once. When the recipient imports it, your allergens are added to the recipient's own allergen profile or saved as a new family member profile. Your child-safety and sensitivity settings are copied to a new family member profile, and to the recipient's own profile only if the recipient has not changed theirs. That copy belongs to the recipient. It carries no record of who sent it, so changing or deleting your account does not change or delete it, and deleting the recipient's account does not affect your profile. Until a link is used or expires, it holds a copy of the profile you shared. Unused and expired links are deleted, and deleting your account deletes the links you created. Do not share a link with anyone you do not want to have that profile.

3. How We Use Your Information

3.1 Primary Purposes

3.2 We Do NOT Use Your Data For

• Selling your personal information to third parties
• Sharing your personal information for cross-context behavioral advertising
• Targeted advertising based on your health data
• Building profiles for marketing purposes
• Sharing with data brokers

4. How We Share Your Information

4.1 Service Providers (Sub-Processors)

We share data with third-party service providers who perform services on our behalf:

For Product Finder, your full request and selected safety settings — including saved allergens, child-safety mode, endocrine-disruptor sensitivity, and pregnancy or nursing status — are sent to Anthropic / Claude. When Product Finder needs web search, your full request and product category are sent to Google Gemini on Vertex AI; profile names and safety settings are not sent to Google. Deterministic ingredient screening, including allergen, cross-reactor, endocrine-disruptor, and child-safety checks, runs on MySkinIQ servers. When a candidate source page needs fetching, Firecrawl receives candidate source URLs only — never your request or profile data.

Search For You uses a separate Google flow. When you use Search For You online, your saved allergen profile — the list of ingredients you want to avoid — and the product category you enter are sent to Google Gemini on Vertex AI to find and screen matching products on the web. The final deterministic ingredient screening runs on MySkinIQ servers.

4.2 Sensitive Personal Information Disclosed to Service Providers

For California residents, the sensitive personal information categories we may disclose to service providers are limited to information needed to provide the service you requested: allergen and sensitivity profiles, family member profile details and child age ranges, transitional legacy birthdates, recognized patch-test text or dictated transcripts that may contain health-related inferences, and adverse reaction information if you choose to report it.

We disclose those categories only to service providers and contractors that help operate MySkinIQ, process your requested analysis, maintain security, or comply with your privacy choices. We do not sell sensitive personal information or share it for cross-context behavioral advertising.

5. Data Retention

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption in transit (TLS 1.3)
• Encryption at rest (AES-256)
• Secure authentication (OAuth 2.0)
• Data hosted on Google Cloud Platform (SOC 2 Type II certified)

Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Privacy Rights

7.1 Rights for All Users

Regardless of your location, you have the right to:

• Access - Request a copy of your personal data
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your account and data
• Data Portability - Export your data in a machine-readable format (JSON)

How to exercise these rights:

• Export Data: Settings > Your Data > Export My Data
• Delete Account: Settings > Delete Account
• Contact Us: [email protected]

7.2 Additional Rights for EU/EEA Residents (GDPR)

• Right to Restrict Processing
• Right to Object
• Right to Withdraw Consent
• Right to Lodge a Complaint with your local Data Protection Authority

7.3 Additional Rights for California Residents (CCPA/CPRA)

• Right to Know
• Right to Delete
• Right to Opt-Out of Sale or Sharing - We do NOT sell your personal information or share it for cross-context behavioral advertising
• Right to Limit Use and Disclosure of Sensitive Personal Information
• Right to Non-Discrimination

Limit Use of My Sensitive Personal Information: Email [email protected] with the subject "Limit Sensitive Personal Information." You can also withdraw persistent backend patch-test reasoning consent in the App at Settings > Privacy > Send patch-test text for matching.

When we receive a limit-use request, we will limit health-related sensitive personal information to the uses needed to provide the services you requested, keep your account secure, honor your privacy choices, and meet legal obligations. Optional backend patch-test text reasoning will remain off unless you later give new consent.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers are located.

For EU/EEA/UK residents:

• Transfers to the US are made under Standard Contractual Clauses (SCCs) approved by the European Commission
• Google LLC participates in the EU-US Data Privacy Framework

9. Cookies and Tracking Technologies

Our website (myskiniq.shop) uses cookies and similar tracking technologies. This section provides a summary; for complete details, please see our Cookie Policy.

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help the website function correctly and allow us to understand how visitors use our site.

9.2 Cookies We Use

We do NOT use:

• Advertising or targeting cookies
• Cross-site tracking for marketing purposes
• Cookies that sell or share your data with third parties

9.3 How to Control Cookies

You can manage cookies through your browser settings. You can also opt out of Google Analytics using the Google Analytics Opt-Out Browser Add-on.

For detailed information about each cookie, third-party services, and your rights, please read our complete Cookie Policy.

9.4 Mobile App

Our iOS app does not use cookies (a web-only technology). However, it may use device identifiers for analytics and secure tokens for authentication. See Sections 2.4 and 4.1 above for details.

10. Children's Privacy

MySkinIQ is not directed to children under 13 years of age and does not offer child accounts. An adult account holder may voluntarily create a family profile about a child for product screening.

Child Safety Mode and family profiles are controlled by adult account holders. New and updated child profiles store only the parent-selected range “Under 5” or “5 or older,” not the child’s exact date of birth. “Under 5” is reconfirmed after 12 months; “5 or older” does not expire. We do not use child age information for advertising or sell/share it for cross-context behavioral advertising.

Child family member profiles and age ranges are included in data export and account deletion flows. During the transition, an exact birthdate saved by an earlier app version may remain until it is replaced or migrated; exports show the data actually stored.

If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us immediately at [email protected].

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

MySkinIQ LLC

• Email: [email protected]
• Support: [email protected]
• Website: https://myskiniq.shop

Response Time: We aim to respond to all privacy inquiries within 30 days, or sooner where required by law.

12. Health Data Disclaimer

MySkinIQ is NOT for medical diagnosis or treatment and does NOT provide medical advice. The allergen analysis and product safety information provided by our App is for informational purposes only and should not be considered medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional for medical concerns.