Privacy summary

Your photo guide is private.

When you take or choose a photo for analysis, it is sent securely to this app's server and processed by an OpenAI vision model, with Vercel AI Gateway used where configured, to produce a non-diagnostic visual guide. You see the result without submitting your name, phone number or email address. Your photo and guide are stored privately for up to 24 hours and are not automatically shared with a clinic when you choose its booking page.

What happens to the photo

The photo controls explain that taking or choosing a photo agrees to AI analysis and temporary private storage. There is no separate checkbox in this test version. A skin photo and the resulting guide may reveal information about your health. The photo is stored in private application storage and is not available through a public link. New photo guides use a temporary record scheduled for deletion after 24 hours. Earlier submitted enquiries retain their existing permissions and retention periods, described below.

When you choose online booking

After seeing your guide, you can search by postcode and choose a participating clinic. Your guide's suggested treatment is used to filter clinics. We check that the clinic is eligible to receive online bookings, then open its booking page. You choose a time and enter your booking details with that clinic and its booking provider under their own terms and privacy information. We do not send your photo, guide or contact details to that provider.

We charge the clinic £20 when you click through to its booking page. A first-party, HTTP-only cookie with a random reference helps prevent repeat charges from the same browser to the same clinic within 30 days. It contains no photo, contact details or postcode. The cookie lasts up to 30 days after use; the protected duplicate-check reference in the click record is removed after 30 days. We retain the clinic, time and financial transaction record for accounting and disputes. This does not establish that an appointment was made.

We will never use your data for marketing.

When you search for a nearby clinic

The postcode you enter is used only to calculate approximate proximity to participating clinics. It is sent securely to Postcodes.io for validation and location lookup where coordinate data is available, and is not added to a profile or journey analytics. Isle of Man results may use a broader postcode-district centre, so distances are approximate. Search results contain participating partner clinics rather than a complete directory, and a partner clinic may pay Skin Clinic a referral fee.

Earlier requests for a clinic to contact you

If you previously asked one named clinic to contact you, we collected your name, your chosen phone number or email address, the searched postcode, and any treatment you select. We store the clinic name, your preferred contact method, the consent statement you accepted and the time of that consent. Skin Clinic shares those details only with the clinic you selected so it can respond to that request. Where you have completed a photo guide as part of your enquiry, the submitted photo and app result are also shared securely with that clinic for review. A clinic-search request made without a scan naturally contains no photo or app result. These contact requests are retained for up to 180 days so they can be managed, attributed and resolved, unless deletion is requested sooner or a legal obligation requires otherwise.

Earlier UK clinic marketplace enquiries

The previous marketplace journey collected your name, phone number, email address and postcode with your photo enquiry. Existing submissions keep their original sharing permissions. Matching used participating clinics’ coverage areas and showed named clinic organisations, branch locations and approximate distances before you agreed to sharing. A request made privately to SkinClinic remains private until you agree to an introduction. With your recorded permission, the named clinics can consider the permitted enquiry preview. This is not a ranking of clinical quality or a complete directory; distances are approximate straight-line distances, not driving distances.

For earlier photo enquiries whose recorded permission includes a photo preview, The named clinics can see it before purchase, with embedded metadata removed. A photo may reveal health information or identify you; it is not anonymous. A separate permission covers release of your name, contact details, exact postcode and full review to the first clinic to purchase your enquiry and pay the referral fee. Older submissions keep their recorded sharing permissions. A clinic decides whether it can take your enquiry forward; an appointment or response time is not guaranteed. We record the exact permission wording, its version, time and eligible recipient snapshot. Existing permissions remain limited to their recorded recipients. A SkinClinic-only request stays private; we obtain new permission before sharing it with a clinic. Enquiries outside clinic coverage go to SkinClinic for matching and follow-up. Continue to follow the assessment advice in your review; this service is not an emergency service.

Marketplace drafts are retained for up to 24 hours. Submitted photo enquiries are retained for up to 90 days and no-photo contact requests for up to 180 days. A necessary, HTTP-only first-party cookie remembers your enquiry for up to 90 days and helps prevent repeated submissions creating repeated charges. It contains a random reference, not your name, photos or contact details. Protected, keyed contact fingerprints and your postcode help us group repeat photo forms into one lead. A matching postcode and either a matching phone number or email address link forms submitted within 30 days of the first submission. Each form keeps its own photo, review, permissions and retention period. Grouping does not give another browser access to earlier submissions. If a clinic has already accepted the lead, additional photos are shared with it only where the new form’s permissions and current clinic eligibility allow this. Submissions outside that permission remain private. Keyed request fingerprints are also used for abuse prevention, without storing the raw IP address in those records.

Earlier messages with your clinic

The previous clinic workspace supported emails and permission-based texts about enquiries, quotes or proposed appointments. New clinic messages through SkinClinic are now disabled. Resend processed emails and Twilio processed texts. Existing records retain the message text, sender, recipient, time and delivery status with the enquiry. Previously delivered copies may remain in the recipient's inbox. Photos and attachments were not included. If a reply cannot be matched confidently, only SkinClinic administrators can review it and assign it to the correct enquiry.

SMS permission is optional. Reply STOP to stop texts from all clinics using the shared SkinClinic number. We retain minimal phone-number records to honour opt-outs and prevent late replies reaching the wrong clinic. Conversation content follows the original enquiry's retention period and becomes unavailable to the clinic when access expires or permission is withdrawn. Unmatched replies are retained for up to seven days. Delivery services and copies already received in email inboxes have their own retention arrangements; withdrawing an enquiry cannot recall a delivered email or text. A clinic may also choose to contact you in its own WhatsApp app; that conversation stays outside SkinClinic and is handled by WhatsApp and the clinic.

Understanding your visual guide

The model suggests what visible features may resemble and selects the closest Skin Clinic service area. It does not diagnose a condition, determine whether something is safe, or provide a medical urgency score. Image models can be inaccurate.

Privacy-safe journey analytics

We use Vercel Web Analytics for privacy-focused page traffic and Convex for a pseudonymous journey funnel. This records a random browser-session reference, broad device category, traffic source or campaign where available, journey steps, photo-choice method, review service success or failure, whether the WhatsApp share button was opened, and the time of each event. The app never receives or stores the friends you select in WhatsApp; only the general app link and pre-written message are passed to WhatsApp when you choose to share.

Journey analytics never contain your photo, contact details, exact possible visual match, raw model wording, treatment text or selected concern. The separately protected clinic enquiry does contain the visual guide so an authorised clinic user can understand the referral. When a review completes, the analytics system increments only a broad aggregate visual group, such as skin-tag-like, pigmentation or assessment route. This counter is not stored with the browser-session record. Groups with fewer than five reviews are hidden or combined in the private dashboard to reduce identification risk. Raw pseudonymous journey events are retained for up to 12 months; aggregate trial totals may be kept longer so Skin Clinic can evaluate the service.

During landing-page experiments, we use a first-party experiment cookie for up to 30 days so your browser continues to see the same version. We compare aggregate, statistical journey results—such as starts and booking hand-offs—to understand which version is clearest. The cookie is not used for advertising profiles, cross-site tracking or to personalise medical information.

Google Ads measurement

The Google tag loads with advertising storage, analytics storage, advertising user-data and personalisation consent denied. Before you allow measurement, Google may receive cookieless diagnostic or measurement signals, but the tag cannot use advertising or analytics cookies. If you allow measurement, Google receives only generic events showing that a photo review completed, an enquiry was submitted (photo-first or without a photo), or that a clinic booking link was selected. A random enquiry reference may be used to avoid counting the same conversion repeatedly. We do not send the photo, possible match, condition group, treatment text or contact details. Personalised advertising signals remain disabled, and we do not use this information to create health-related remarketing audiences. You can change this choice at any time using “Advertising measurement” in the app footer.

When you contact Skin Clinic

Authorised clinic users can view the submitted image, contact information and visual guide in a protected workspace. Images are not placed in notification emails or analytics. Skin Clinic may share the enquiry exclusively with one suitable clinic for the contact purpose you explicitly approved. That clinic may pay Skin Clinic a referral fee, but it may not use the enquiry for unrelated marketing or share it with competing clinics. These existing enquiry permissions do not apply to new photo guides or automatically transfer their photos to a booking provider.

When a clinic requests a pilot

A clinic representative can provide a clinic name, contact name, work email, coverage area, treatment interests and, optionally, a phone number and website. We use those business contact details only to assess pilot fit and discuss referral criteria and commercial terms. A pilot request does not commit the clinic to buy anything. Requests are kept for up to 12 months unless the clinic joins the service, asks us to delete them, or a legal obligation requires longer retention.

Clinic staff accounts and payments

Clinic portal staff have individual accounts managed through Clerk. Authorised staff can access only their organisation's permitted branches and booking click-through activity. Owners manage credits and billing. Earlier lead records are retained for authorised administration and are no longer available in the clinic workspace. Portal access requires an active signed-in session and the appropriate role. Billing activity and important account changes are recorded in an audit log. Stripe processes clinic payments through hosted payment screens. Skin Clinic does not store full payment-card details. Payment and audit records are separate from patient photos and retained where needed for accounting, disputes and security.

Managing your information

You can ask Skin Clinic to provide, correct or delete your enquiry, or withdraw your consent, by contacting Skin Clinic through its website. Withdrawal does not affect processing that already took place lawfully, and information may still be retained where required by law. You may also raise a concern with the Isle of Man Information Commissioner.

Important

This service is not medical advice. For a new, changing, bleeding, crusting or non-healing mark—or any concern about skin cancer—contact your GP or another appropriately qualified medical professional. For an emergency, contact emergency services.