Consumer Health Data Privacy

This Consumer Health Data Privacy notice is required by Washington's My Health My Data Act (MHMD) and is written to also cover Nevada's consumer health data law, Connecticut's consumer health data rules, and similar US state rules. It is in addition to the Privacy Policy. If the two conflict on consumer health data, this notice controls for residents of those states.

A US App Store listing is available to residents of those states. We do not claim that Skintinel is incorporated in Washington, Nevada, or Connecticut. The registered legal entity and jurisdiction are TBD.

Skintinel is a photo diary, not a medical device. Nothing here is medical advice.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Skintinel that includes, if it exists:

• photographs of a skin spot;
• body zone of a spot;
• dates of photographs;
• optional notes you type;
• Fitzpatrick skin-type answers;
• the fact that you use a skin-photo diary, if that fact is linked to you on our systems.

It does not include information that has been deidentified so it cannot reasonably be linked to you, or information we do not collect. Diary fields are photos, dates, body zone, and optional notes you type.

The current iOS app does not collect consumer health data onto Skintinel servers. Photos, dates, body zone, optional notes, and skin type are processed and stored on your device. We do not receive a copy unless you send one to us (for example by emailing a PDF) or until a future cloud feature is turned on with a separate consent.

The website does not collect photos or diary contents. An email you give us for the waitlist is not consumer health data by itself. We do not infer a health condition from joining the waitlist.

If that architecture changes, we will update this notice and the Privacy Policy, give material-change notice, and obtain any consent or authorization the law requires before health data is collected onto our systems.

Consumer health data in Skintinel comes only from you:

• the camera, when you photograph a spot;
• your photo library, if you import a picture;
• information you type or tap (notes, flags, skin type, body-map placement).

We do not buy consumer health data. We do not scrape it from other companies. We do not take it from Apple HealthKit.

On-device consumer health data is processed only to:

• keep a photo history of spots you choose to watch;
• check on the device whether a frame is in focus and at a usable angle and distance (that check is not biometrics, is not stored as a template, and does not leave the phone);
• show two photographs of the same spot side by side, with their dates;
• build a PDF you can take to a visit;
• remind you, locally, if you turned reminders on.

We do not use consumer health data to advertise, to geofence a hospital or clinic, to profile you for a third party, or to train a model that names or scores a spot. Optional “help improve capture quality” processing is not active in this version.

We do not sell consumer health data. We do not share it with insurers, employers, data brokers, or advertisers.

In this version we also do not share it with processors, because we do not receive it. Apple may hold a copy if you enable iCloud Backup; that is your relationship with Apple, described in the Privacy Policy §13. If you export a PDF, you are the one disclosing it.

If we later offer cloud storage, the processors would be named in the Privacy Policy subprocessors table, and we would collect a separate consent (and, where MHMD requires it, a separate authorization for any sale - which we do not intend to do).

We may disclose data if required by law or to protect a person from serious imminent harm, to the extent those exceptions apply.

Before the first capture, the app asks for explicit, unbundled consents: process photos on this device (required for the diary); cloud copy (optional, not offered in this version); help improve capture quality (optional, not active). Details are in Privacy Policy §7.

You may withdraw consent by turning the relevant toggle off (when Settings expose it), deleting spots or the app, or emailing hello@skintinel.com. Withdrawal does not undo a PDF you already sent to someone else.

If you are a consumer covered by Washington MHMD, Nevada consumer health data law, Connecticut consumer health data rules, or a similar state law, you may request that we:

• confirm whether we collect, share, or sell your consumer health data (today: we do not collect it onto our servers, and we do not sell it);
• provide a copy of consumer health data we hold;
• delete consumer health data we hold;
• withdraw consent to our collection or sharing of consumer health data.

If we hold none, we will say so in the reply. For data that exists only on your phone, we cannot see it. Access and deletion happen in the app: delete the spot, the photo, or Skintinel. For data we actually hold (today: website and email records, which we do not treat as consumer health data), we will honour a deletion request as described in the Privacy Policy.

We will not require you to create an account to make a request. Email hello@skintinel.com with the subject “consumer health data request”. Tell us which right you want to exercise and enough information to identify the email or device in question. We will respond within 45 days, or the shorter statutory period (we aim for 30 where we can).

If we refuse a request, you may appeal by emailing hello@skintinel.com with the subject “consumer health data appeal” and the reason you disagree. We will review the refusal and reply within 30 days, with a short written reason.

If the appeal is denied, Washington residents may contact the Washington Attorney General. Nevada residents may contact the Nevada Attorney General. Connecticut residents may contact the Connecticut Attorney General. Other states: use your Attorney General's consumer-protection complaint process.

We do not use consumer health data, location, or the fact that you use Skintinel to implement a geofence around a healthcare facility for advertising, or to send ads based on a visit to such a facility.

We review this notice at least once a year. We will update it if we begin collecting consumer health data onto our servers, share it with a processor, or change the purposes above. Material changes will be posted here and, where the law requires, notified in the app or by email at least 30 days in advance.

Operator: Skintinel. Registered legal entity name and address: TBD. Email: hello@skintinel.com.

General privacy practices: Privacy Policy.