Last updated: 2 October 2026
This policy covers Dermly only. It explains what the app sends off your device, what stays on it, and who processes it.
Dermly does not diagnose. It provides educational information about skin concerns. It has no regulatory clearance.
When you run a scan, the following is sent over HTTPS to our processing endpoint and then to OpenAI, solely to produce your result:
The photo you take of the skin concern
Your answers about the concern — how long it has been there, where on the body, symptoms, what you have already tried
Limited profile details — your age band, your skin type, and whether you have recorded eczema/asthma/hay fever, psoriasis, a condition or medication that weakens the immune system, diabetes, or that you are pregnant
When you use AI Chat, the messages you type and the context of the scan you are asking about are sent the same way.
Your first name
Your allergies
Your scan history and saved photos
Any data when you are simply browsing the app
Photos and scan results are stored only on your iPhone, using the app's own storage. They are not stored in iCloud, not stored on our servers, and are excluded from device backups. Deleting the app, or using Delete all scans in Settings, removes them permanently.
Processor
What they receive
Why
Cloudflare
The photo and text, in transit
Routes the request and applies rate limits
OpenAI
The photo and text
Generates the analysis
Apple
Purchase and subscription events
Processes payment
RevenueCat
Subscription status, an anonymous app user ID
Tells the app whether you are subscribed
OpenAI retention: requests are sent with storage disabled, so they are not saved to our OpenAI account. OpenAI does not use API data to train its models. Under OpenAI's API policy it may retain request data for up to 30 days to detect abuse, after which it is deleted.
Rate limiting: to prevent abuse, our endpoint stores the requesting IP address with a count of requests made that day. This record is deleted automatically after about 26 hours and is never linked to your photos, answers or scans.
We do not use analytics SDKs, advertising SDKs, or tracking of any kind. We do not sell or share your data. We do not build a profile of you.
Photographs of your skin and the health details listed above are special category personal data under the UK and EU GDPR (Article 9).
We process them only with your explicit consent, which you give by choosing to run a scan, and only to produce the result you asked for. You can withhold that consent at any time by not scanning; the rest of the app continues to work.
Our lawful bases are Article 6(1)(b) (performing the service you asked for) and Article 9(2)(a) (your explicit consent) for health data.
You may:
Delete everything — Settings → Delete all scans, or delete the app
Withdraw consent — stop scanning; nothing further is sent
Request information about how your data is handled
Object, or complain to your local data protection authority
Because scans are stored only on your device and our endpoint keeps no copy, we usually hold nothing to export or erase on your behalf.
Dermly is not intended for children under 13, and we do not knowingly collect data from them. An adult may use the app to ask about a child's skin; in that case the adult is responsible for the information they provide.
Material changes to this policy will be reflected here with a new date.
drexplod@gmail.com