English

Version: 4.0

Privacy Policy

1. Introduction

Skin Vision B.V. ("SkinVision", "we", "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you use the SkinVision App or website (the "Services"), why we collect it, how long we keep it, and what rights you have. If you use SkinVision through your healthcare provider, some additional arrangements apply to you. These are set out in Section 14.

For more detail on how our Services work, please see our Instructions for Use. For information about how we use cookies, please see our Cookie Policy.

Skin Vision B.V. is the data controller for the processing described in this Policy. Our registered address and contact details are set out in Section 13. Please contact us if you have any questions about this Policy.

We may update this Policy from time to time. Where a change affects the basis on which we hold your consent, we will notify you before the change takes effect and, where required, ask for your consent again.

2. The personal data SkinVision collects

The table below sets out each category of data we collect and why. Legal bases and retention periods for each are set out in Sections 4 and 10.

3. How SkinVision uses your skin images

Images of your skin lesions are central to the Service and are sensitive health data. This is why we explain how we handle them separately:

Analysis: we process each image through our algorithm to identify patterns associated with skin cancer risk.

Storage: we store your images so you can track a lesion over time and see how it changes.

Clinical quality review: a limited team of in-house dermatologists and clinical experts may review images for quality control.

Algorithm training and research: see Section 6.

We only store and process your skin lesion images if you give your explicit consent to this (Section 4). Without this consent, we cannot provide the assessment Service.

4. Purposes and legal bases

We use your data for the following purposes:

Providing the Service: to assess your skin lesion images and keep track of them over time (Section 3), and to follow up on our advice (Section 5).

Account and payments: to create and manage your account and to process payments for paid Services.

Customer support and communications: to answer your questions, send you messages about your assessments and the Service, and ask for your feedback.

Insurer-sponsored access: to check whether you are eligible for free access through your health insurer.

Marketing: to send you news about SkinVision, if you have agreed to this. We never use your health data for marketing.

Improving and securing the Service: to fix bugs, prevent fraud and understand how the Service is used.

Algorithm development and research: to improve our algorithm using anonymised images, and to take part in research on how effective and accurate the Service is (Section 6).

Legal purposes: to comply with the law, for example the Dutch rules that require your BSN, and to handle legal claims, disputes and regulatory investigations.

We rely on the following legal bases:

Contractual necessity: to create and manage your account, process payments and provide customer support.

Explicit consent (Art. 9(2)(a)): to process your skin lesion images, their location on the body map, your comments and your answers to follow-up messages. This is health data, so we ask for your explicit consent before you use the Service. Without it, we cannot provide the assessment. This consent also covers using your images to improve our algorithm (Section 6).

Consent: to send you marketing messages and to check whether you are eligible for insurer-sponsored access.

Legitimate interests: to improve and secure the Service, and where needed for customer support and legal claims.

Legal obligation: to comply with the law, such as the Dutch rules on the BSN, and to cooperate with regulatory investigations.

Scientific research: where a research protocol requires pseudonymised data, we rely on your explicit consent or on the rules for scientific research (Section 6.2).

You can withdraw your consent at any time (see Section 12).

5. Follow-up Messages

After certain assessments, we may check whether you acted on our advice, for example whether you sought medical care for a lesion we flagged. We do this by sending you a short, general email (for example, "Did you follow our advice?") with a button that takes you to the App, where you can answer.

Your answer can show whether you sought medical care, so we treat it as health data and protect it in the same way as your other health data.

We rely on your explicit consent (Art. 9(2)(a)) for this processing. This is part of the consent you give under Section 3, because following up on our advice serves the same purpose.

6. Algorithm Training and Research

6.1 How we use images to develop our algorithm

We use  skin lesion images to train, test, and improve the SkinVision algorithm, so it becomes more accurate over time at detecting irregular patterns associated with skin cancer.

Before we use an image for this purpose, we separate it from your account and profile details and crop it so that it shows only the lesion. Using your images to improve our algorithm is covered by the explicit consent you give for your assessment (Section 4).

6.2 Research collaborations with third-party institutions

We work with selected academic and research institutions on studies into how effective and accurate the SkinVision Service is. When we share data with them, it is aggregated and anonymised, so it cannot be traced back to you. If a research protocol requires pseudonymised data, we apply the safeguards for scientific research in Art. 89 GDPR and Article 24 of the Dutch GDPR Implementation Act (UAVG). This includes a documented assessment of whether sharing the data is necessary and proportionate.

6.3 Formal clinical or research studies

If you use SkinVision as part of a clinical or research study, we, or the research institution, will ask you to sign a consent form for that study. We then process your data under the study protocol and that consent form, in addition to this Policy. Study images are stored only on SkinVision servers, unless we agree otherwise with you.

6.4 Histopathology reports

If you choose to share a histopathology report with us, we use it only for algorithm development and post-market surveillance. It does not affect the result of any past or future assessment. If you delete a report you shared, we anonymise it immediately and keep only the anonymised version.

7. SkinVision and third parties

We share personal data with selected third parties where this is needed to provide the Service. Most of them are our processors, which means they only process your data on our instructions. We work with the following sub-processors:

• We use Survicate to ask you to rate our Service (Net Promoter Score) and leave comments. For this, we share your email address.
• We use Survio to send surveys to some of our users to get feedback on our Service. For this, we share your email address.
• We use Branch.io for deep linking, so that links to our App take you straight to the right place. Branch.io collects tracking and analytics data from the moment you click a link sent to you by SkinVision or, where applicable, by your health insurer or another partner that gives you access.
• We use Firebase Crashlytics to record crash data and share it with our development team, so we can keep improving the Service. Crash data is collected from the moment you open the App.
• We use Firebase to send you push notifications.
• We use Braze for marketing automation and customer support. We share with Braze the user attributes and event data needed for our campaigns.
• Sendgrid sends the service emails that are part of the Service. For this, we share your email address.
• Twilio sends the text messages (SMS) that are part of the Service. For this, we share your phone number.
• We use Zendesk as our main customer support tool for handling emails.
• We may use Zivver for secure communication with our customer support.
• We use Adyen to process payments. Adyen may process your email address, address and phone number to handle your payment. Adyen does not receive any health data.
• We use AWS to host our database.
• We use the OpenWeatherMap API to show you a personalised UV index. For this, OpenWeatherMap receives your location data.
• In the Netherlands, we use Vecozo to check your insurance details and Promeetec to send invoices to the health insurers we work with.
• We use Datadog to monitor our infrastructure and the performance of our applications. For this, it may process technical data such as system metrics, logs and performance data.

You can turn off “tracking and analytics consent” in the settings of your App. This covers the collection of tracking and analytics data by Branch.io, Crashlytics, Firebase and Braze.

Health insurers are not our processors, they are responsible for their own processing. Where the law or our contract with your health insurer requires it, we share your name, date of birth, and insurance number or BSN with your health insurer for billing. We never share health data with your insurer.

If you access SkinVision through your healthcare provider, we may share your data with your healthcare provider and, if applicable, PharmaPartners. Please see Section 14 for more details.

8. SkinVision and social media

Our Website contains links to SkinVision’s pages on social media platforms, so you can follow us there. Visiting our Website does not, by itself, send your personal data to these platforms. When you click one of these links, you leave our Website and go to the relevant platform. That platform then processes your personal data under its own privacy policy, particularly if you are logged in to your account there.

If you visit, follow or interact with our social media pages, the platform processes your personal data as an independent controller. We may see your public interactions with our pages, such as comments, and any messages you send us. We may also receive aggregated statistics about visits to our pages. SkinVision does not control how social media platforms process your personal data. We recommend you read their privacy policies.

9. International Transfers

We store your data on secure servers in Ireland, with backups in France. Some of our processors are located outside the European Economic Area (EEA). Before we transfer data to them, we make sure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.

10. Data Retention

We keep your personal data only for as long as we need it for the purposes described in this Policy. After that, we delete or anonymise it.

While your account is active, we keep your data so that we can provide the Service. Your answers to follow-up messages are kept for as long as your assessment history, because they belong to the same assessment.

If you delete your account, we keep your account data for 12 months to wind down our obligations to you, or longer if the law requires it. After that, we delete it.

After you delete your account, we keep your skin lesion images in anonymised form to train our algorithm. Where post-market surveillance requires it, we keep them in pseudonymised form for 10 years, as required by the EU Medical Device Regulation. Where a research protocol requires pseudonymised images, we keep them for the period set out in that protocol.

If you delete a histopathology report you shared with us, we anonymise it immediately and keep only the anonymised version for research and post-market surveillance.

We keep support messages, technical and usage data, marketing preferences and survey responses for 5 years.

We keep payment records for 7 years, as required by Dutch tax law.

We keep documents that are relevant to legal claims until the matter is resolved, or for as long as the law requires, so that we can establish, exercise or defend our legal rights.

11. Personal Data of Children

You must be 18 or older to use our Service. If we find that we hold personal data of someone under 18, we will delete it.

12. Your rights

You can ask us to give you access to, correct, delete, or provide a copy of your personal data, and you can object to or ask us to restrict our processing. Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it. You also have the right to complain to your national Data Protection Authority (in the Netherlands, the Autoriteit Persoonsgegevens).

To use these rights, contact us using the details in Section 13. We will need to confirm your identity before we act on your request. We will respond within one month.

13. Contact and Controller Details

Skin Vision B.V. owns and operates the Website and the App. Our principal place of business is Kraanspoor 28, 1033 SE Amsterdam, the Netherlands. You can reach us, including our Data Protection Officer, by post at the address above, through the contact form on our Website or in the App, or by email at privacy@skinvision.com.

For our users in the UK:

Skin Vision B.V. ICO Registration Reference: ZC232365

UK GDPR representative

International Associates Limited. ICO registration: https://ico.org.uk/ESDWebPages/Entry/ZA257920.

Authorised representatives under Medical Device Regulations

Depending on local regulatory requirements, SkinVision may appoint a local authorised representative or sponsor. Where post-market vigilance procedures require it, we may share personal and health data with them. We will always tell you if this applies to you.

UK: SkinVision UKRP Ltd, 124-128 City Road, London, EC1V 2NX, UK

Australia: Emergo, 201 Sussex Street, Level 20, Tower II Darling Park, Sydney, NSW 2000, Australia

New Zealand: Carsl Consulting, 11 Mill Road, RD 2, Pukekohe, Auckland, New Zealand

Argentina: PHARMASSIST SRL, Caracas 1649, CABA, Argentina

14. SkinVision through your Healthcare Provider

This section applies if you use SkinVision through your healthcare provider, for example your general practitioner (GP). It sets out the arrangements that apply in addition to the rest of this Policy.

14.1 How you get access

Your healthcare provider can give you access to SkinVision in two ways:

• by sending you an invitation email with a personal link that opens the SkinVision App on your phone or
• through your patient portal (such as MijnGezondheid.net or the MedGemak app), where you can open SkinVision directly (see Section 14.5).

14.2 Sharing your results with your healthcare provider

We only share your results with your healthcare provider if you give your explicit consent (Art. 9(2)(a)). If you do, your healthcare provider can see in a secure online environment the information you share through SkinVision: your name, email address, date of birth and skin type; your assessment results, including the photos, their location on your body map, the symptoms you reported, the outcome of our dermatologists' review and the health report; and your earlier results, including those from before you gave consent."Within the practice, your results are available to the general practitioners and practice staff (such as a practice manager or assistant) who work in this environment for your healthcare provider.

Through this environment, your healthcare provider can also send you messages about your results, for example to invite you for an appointment or to ask you to take a new photo later. You receive these as a message in the App and as a push notification.

You can withdraw this consent at any time via email to support@skinvision.com, we will process your withdrawal as soon as possible. From that moment, your healthcare provider can no longer see your results in this environment. Information that your healthcare provider has already added to your medical file stays there.

14.3 Who is responsible

SkinVision and your healthcare provider are joint controllers for sharing your results through this environment. We have agreed the following:

• SkinVision is responsible for your data in the App and for the sharing, including asking for your consent and informing you about it.
• Your healthcare provider is responsible for how it uses your results in your care, for your medical file, and for the content of the messages it sends you through the App.

For questions or requests about your medical file, please contact your healthcare provider. For all other questions or requests, please contact us using the details in Section 13. You may also contact either of us to use your rights under the GDPR.

14.4 Our partnership with PharmaPartners

SkinVision works with PharmaPartners B.V. (PharmaPartners). PharmaPartners provides Medicom, an information system that healthcare providers use to keep their patient files. It also provides MijnGezondheid.net and the MedGemak app, which patients use to access their healthcare provider's services online. PharmaPartners processes the data in these systems on behalf of your healthcare provider.

14.5 Opening SkinVision from your patient portal

If you open SkinVision from your patient portal (such as MijnGezondheid.net or the MedGemak app), we first need to find out who your healthcare provider is. With your explicit consent, we send PharmaPartners the email address you have confirmed with us, together with your first name, last name, date of birth and insurance number. PharmaPartners uses these details to find you in your healthcare provider's records. If it finds exactly one match, it sends us the identification details of your healthcare provider (its AGB code and organisation codes). We use these details only to link your SkinVision account to your healthcare provider. If PharmaPartners cannot find you, or finds more than one possible match, it sends us nothing. PharmaPartners does not send us your BSN in this process.

If you withdraw this consent, we delete the details we received from PharmaPartners within one month, unless the law requires us to keep them longer. We keep a record of your consent and of the exchange with PharmaPartners for up to five years, so that we can show it took place lawfully.

14.6 When your healthcare provider opens SkinVision from HIS (huisartsinformatiesysteem)

Your healthcare provider can open SkinVision directly from your patient file in their HIS (such as Medicom). When it does, PharmaPartners sends us, on your healthcare provider's instructions, the following details from your patient file: your name, initials, date of birth, gender, email address, phone number and BSN, and your healthcare provider's AGB code. We use your BSN only to check whether you have a SkinVision account; we do not store or log it. If you have shared your results with this healthcare provider, we open your page in our secure environment. If you do not use SkinVision, or have not shared your results with this healthcare provider, we use your name and email address only to fill in an invitation that your healthcare provider can send you, and we delete them within one hour. Other details, such as your gender or phone number, are not used.

14.7 What happens when you delete your SkinVision account

If you delete your SkinVision account, we remove your data from the environment for healthcare providers. Your healthcare provider can then no longer see your results. We keep only what we must keep by law or to show that the sharing took place lawfully, such as a record of your consent and of who accessed which results. Information that your healthcare provider has already added to your medical file stays there.