Privacy summary

Your photo and enquiry are handled privately.

When you choose a photo and explicitly consent, it is sent securely to this app's server and processed by an OpenAI vision model, with Vercel AI Gateway used where configured, to produce a non-diagnostic visual guide. It is also stored privately so Skin Clinic or one suitable clinic can review and respond to your enquiry.

What happens to the photo

Before the photo is sent, the app asks for your explicit consent because a skin photo and the resulting guide may reveal information about your health. The photo is stored in private application storage and is not available through a public link. An unfinished enquiry is automatically deleted after 24 hours. If you submit your contact details, the photo and enquiry are retained for up to 90 days so the clinic can respond, unless a legal obligation requires otherwise or the clinic separately creates a patient record with you.

What we collect for a photo enquiry

The current photo form collects your name, phone number, email address and postcode. Your postcode determines the country and approximate location used to match clinics. We store these details with your submitted photo and visual guide for the specific purpose of recommending one suitable clinic and allowing that clinic to contact you about assessment or treatment. We ask you to confirm that you are 18 or over and to give explicit consent before the enquiry is created. A matched clinic may pay Skin Clinic a referral fee; the enquiry is shared exclusively with that clinic, and the clinic may use it only to respond for the contact purpose you approved.

We will never use your data for marketing.

When you search for a nearby clinic

The postcode you enter is used only to calculate approximate proximity to participating clinics. It is sent securely to Postcodes.io for validation and location lookup where coordinate data is available, and is not added to a profile or journey analytics. Isle of Man results may use a broader postcode-district centre, so distances are approximate. Search results contain participating partner clinics rather than a complete directory, and a partner clinic may pay Skin Clinic a referral fee.

When you ask a listed clinic to contact you

After seeing the results, you can optionally ask one named clinic to contact you. We collect your name, your chosen phone number or email address, the searched postcode, and any treatment you select. We store the clinic name, your preferred contact method, the consent statement you accepted and the time of that consent. Skin Clinic shares those details only with the clinic you selected so it can respond to that request. Where you have completed a photo guide as part of your enquiry, the submitted photo and app result are also shared securely with that clinic for review. A clinic-search request made without a scan naturally contains no photo or app result. These contact requests are retained for up to 180 days so they can be managed, attributed and resolved, unless deletion is requested sooner or a legal obligation requires otherwise.

When you use the UK clinic marketplace

Where the UK clinic marketplace is available, each photo form accepts one photo. You enter your name, phone number, email address and postcode and submit your enquiry before seeing the review. Matching uses the participating clinics’ coverage areas. If no clinic covers your location, you can still submit: the enquiry goes privately to SkinClinic so we can help arrange a clinic match. We show matched clinic organisations, branch locations and approximate distances before you agree to sharing. All photo enquiries use the same location matching, with the original review and its advice preserved. A medical-review result does not create a separate SkinClinic approval step or exclude a matching clinic. With your explicit permission, those named clinics can consider a limited enquiry preview. This is not a ranking of clinical quality or a complete directory; distances are approximate straight-line distances, not driving distances.

In the current photo journey, the clinic-preview permission includes your submitted photo. The named clinics can see it before purchase, with embedded metadata removed. A photo may reveal health information or identify you; it is not anonymous. A separate permission covers release of your name, contact details, exact postcode and full review to the first clinic to purchase your enquiry and pay the referral fee. Older submissions keep their recorded sharing permissions. A clinic decides whether it can take your enquiry forward; an appointment or response time is not guaranteed. We record the exact permission wording, its version, time and eligible recipient snapshot. Existing permissions remain limited to their recorded recipients. A SkinClinic-only request stays private; we obtain new permission before sharing it with a clinic. Enquiries outside clinic coverage go to SkinClinic for matching and follow-up. Continue to follow the assessment advice in your review; this service is not an emergency service.

Marketplace drafts are retained for up to 24 hours. Submitted photo enquiries are retained for up to 90 days and no-photo contact requests for up to 180 days. A necessary, HTTP-only first-party cookie remembers your enquiry for up to 90 days and helps prevent repeated submissions creating repeated charges. It contains a random reference, not your name, photos or contact details. Protected, keyed contact fingerprints and your postcode help us group repeat photo forms into one lead. A matching postcode and either a matching phone number or email address link forms submitted within 30 days of the first submission. Each form keeps its own photo, review, permissions and retention period. Grouping does not give another browser access to earlier submissions. If a clinic has already accepted the lead, additional photos are shared with it only where the new form’s permissions and current clinic eligibility allow this. Submissions outside that permission remain private. Keyed request fingerprints are also used for abuse prevention, without storing the raw IP address in those records.

Understanding your visual guide

The model suggests what visible features may resemble and selects the closest Skin Clinic service area. It does not diagnose a condition, determine whether something is safe, or provide a medical urgency score. Image models can be inaccurate.

Privacy-safe journey analytics

We use Vercel Web Analytics for privacy-focused page traffic and Convex for a pseudonymous journey funnel. This records a random browser-session reference, broad device category, traffic source or campaign where available, journey steps, photo-choice method, review service success or failure, whether the WhatsApp share button was opened, and the time of each event. The app never receives or stores the friends you select in WhatsApp; only the general app link and pre-written message are passed to WhatsApp when you choose to share.

Journey analytics never contain your photo, contact details, exact possible visual match, raw model wording, treatment text or selected concern. The separately protected clinic enquiry does contain the visual guide so an authorised clinic user can understand the referral. When a review completes, the analytics system increments only a broad aggregate visual group, such as skin-tag-like, pigmentation or assessment route. This counter is not stored with the browser-session record. Groups with fewer than five reviews are hidden or combined in the private dashboard to reduce identification risk. Raw pseudonymous journey events are retained for up to 12 months; aggregate trial totals may be kept longer so Skin Clinic can evaluate the service.

During landing-page experiments, we use a first-party experiment cookie for up to 30 days so your browser continues to see the same version. We compare aggregate, statistical journey results—such as starts and booking hand-offs—to understand which version is clearest. The cookie is not used for advertising profiles, cross-site tracking or to personalise medical information.

Google Ads measurement

The Google tag loads with advertising storage, analytics storage, advertising user-data and personalisation consent denied. Before you allow measurement, Google may receive cookieless diagnostic or measurement signals, but the tag cannot use advertising or analytics cookies. If you allow measurement, Google receives only generic events showing that a photo review completed, an enquiry was submitted (photo-first or without a photo), or that the Fresha booking link was selected. A random enquiry reference may be used to avoid counting the same conversion repeatedly. We do not send the photo, possible match, condition group, treatment text or contact details. Personalised advertising signals remain disabled, and we do not use this information to create health-related remarketing audiences. You can change this choice at any time using “Advertising measurement” in the app footer.

When you contact Skin Clinic

Authorised clinic users can view the submitted image, contact information and visual guide in a protected workspace. Images are not placed in notification emails or analytics. Skin Clinic may share the enquiry exclusively with one suitable clinic for the contact purpose you explicitly approved. That clinic may pay Skin Clinic a referral fee, but it may not use the enquiry for unrelated marketing or share it with competing clinics. Selecting Fresha also hands you over to that service, and information entered there is handled under Skin Clinic's and Fresha's terms.

When a clinic requests a pilot

A clinic representative can provide a clinic name, contact name, work email, coverage area, treatment interests and, optionally, a phone number and website. We use those business contact details only to assess pilot fit and discuss referral criteria and commercial terms. A pilot request does not commit the clinic to buy anything. Requests are kept for up to 12 months unless the clinic joins the service, asks us to delete them, or a legal obligation requires longer retention.

Clinic staff accounts and payments

Clinic portal staff have individual accounts managed through Clerk. Authorised staff can access only the enquiries allocated to their organisation and permitted branches. Portal access requires an active signed-in session and the appropriate role. Lead access and important account changes are recorded in an audit log. Stripe processes clinic payments through hosted payment screens. Skin Clinic does not store full payment-card details. Payment and audit records are separate from patient photos and retained where needed for accounting, disputes and security.

Managing your information

You can ask Skin Clinic to provide, correct or delete your enquiry, or withdraw your consent, by contacting Skin Clinic through its website. Withdrawal does not affect processing that already took place lawfully, and information may still be retained where required by law. You may also raise a concern with the Isle of Man Information Commissioner.

Important

This service is not medical advice. For a new, changing, bleeding, crusting or non-healing mark—or any concern about skin cancer—contact your GP or another appropriately qualified medical professional. For an emergency, contact emergency services.