MyDermAssist
MyDermAssist Privacy Policy
How Innov-Cell collects, uses and protects personal data in the MyDermAssist app.
Innov-Cell Therapeutics Lda (“Innov-Cell”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and share personal data when you use the MyDermAssist mobile application (“MyDermAssist” or the “App”), and how you can exercise your rights under Regulation (EU) 2016/679 (GDPR).
1. Who we are and how to contact us
Innov-Cell Therapeutics Lda located at Avenida da Liberdade 129B, 1250-140 Lisboa, Portugal, VAT number 516675842, is the data controller responsible for determining the purposes and means of processing personal data collected through the MyDermAssist application.
Privacy and Data Protection Contact
For questions regarding the processing of personal data or the exercise of rights under Regulation (EU) 2016/679 (GDPR), please contact Innov-Cell at info@innovcell.com.
Innov-Cell is responsible for ensuring compliance with applicable data protection legislation and responding to data-subject requests within the legally prescribed time limits.
Website: www.innovcell.com
Data Processor
Upgraide Artificial Intelligence Lda, Rua do Teatro 193, Porto, Portugal, develops and technically operates MyDermAssist on behalf of Innov-Cell, acting as a data processor under a data processing agreement in accordance with Article 28 GDPR.
Upgraide processes personal data solely on Innov-Cell’s documented instructions and may engage sub-processors only with Innov-Cell’s prior written authorization, subject to equivalent data-protection obligations.
Access to personal data, including health-related information, is restricted to authorised personnel where necessary for their assigned responsibilities, subject to appropriate confidentiality and security obligations.
2. Personal data we collect
2.1 Account data: We collect personal data necessary to create, manage and maintain your MyDermAssist account, including your name, email, account identifier, authentication information, preferred language and account creation/deletion dates. The App also collect your year of birth to assess eligibility under the minimum age requirement specified in Section 21, and your country of residence to provide applicable country-specific legal information, including the provisions in Section 23. Gender information may be provided voluntarily.
2.2 Scar and health related data: MyDermAssist allows you to voluntarily record scar-related information, including scar location and type, injury or surgery dates, observations, symptoms, care or product use, application dates and duration, photographs, measurements, self-reported progress ratings and personal notes. Information revealing your health status, including relevant photographs, symptom records and derived Evolution Scores, constitutes special-category personal data subject to the additional protections established under Article 9 GDPR.
2.3 Collection, storage and use of photographs: Photographs uploaded through MyDermAssist are stored in secure cloud infrastructure to enable access across devices, visual comparisons over time and the generation of progress reports. Embedded photographic metadata is removed, and photographs are encrypted during storage. Access is controlled through temporary links that expire after one hour and is restricted to the user and authorised personnel or service providers where necessary for the purposes described in this Privacy Policy.
Photographs are not analysed or used to calculate the Evolution Score. Any use of photographs for scientific research requires separate explicit consent, as described in Section 8. Photographs are subject to the data retention, deletion and backup arrangements established in Sections 18 and 19.
3. Device and technical information
We process device type, operating system and App version, language, time zone, push token, IP address, diagnostics, crash reports and security logs as needed to operate and secure the App. Your time zone is used to schedule reminders at local times. We limit logs to necessary technical information and do not record health related content.
4. How we use your data
We use your data to manage your account; provide scar tracking, scores, progress messages, reminders and reports; respond to support requests; secure and maintain the App; improve reliability and usability; and meet applicable legal obligations or handle legal claims. Optional research is a separate purpose. We do not sell health related data or use it for targeted advertising.
5. Legal bases
| Purpose | GDPR basis |
|---|---|
| Account management and non-health service functions | Contract — Article 6(1)(b). |
| Scar records, photographs, scores, progress messages, reports, health-related reminders and health information you provide for support | Explicit consent — Articles 6(1)(a) and 9(2)(a). |
| Optional scientific research | Separate explicit consent — Articles 6(1)(a) and 9(2)(a). |
| Optional push notifications | Consent — Article 6(1)(a). Device permission is separate from consent to process underlying health data. |
| Technical security, fraud prevention, diagnostics, non-health support and necessary service improvements | Legitimate interests — Article 6(1)(f): keeping the service safe, reliable and usable. We assess necessity and balance these interests against your rights; this basis does not itself authorise health-data processing. |
| Consent evidence and compliance with applicable legal duties | Legal obligation — Article 6(1)(c), including evidence of consent under Article 7(1). |
| Establishing, exercising or defending legal claims | Legitimate interests — Article 6(1)(f); Article 9(2)(f) where health data is strictly necessary for legal claims. |
6. Explicit consent for health data
Innov-Cell obtains users’ explicit consent before processing health-related personal data for the App’s scar-recording, Evolution Score, reminder and report functions. Consent is requested separately from acceptance of the Terms of Use through an affirmative action, using the following statement:
“I expressly consent to Innov-Cell Therapeutics Lda processing the health-related information and photographs I provide through MyDermAssist, including scar details, symptoms, ratings, notes and photographs, as well as derived scores, for the purpose of providing the scar-tracking, Evolution Score, reminder and report functions described in the Privacy Policy. I understand that I may withdraw my consent at any time in Settings, without affecting the lawfulness processing carried out before withdrawal.”
Consent for optional processing activities, including scientific research and any additional purposes requiring consent, is requested separately through independent consent choices. Refusing or withdrawing consent for scientific research does not restrict access to the App’s standard functions.
You may withdraw your consent for health-data at any time, as easily as you gave it, through Settings → Consents & Privacy → Health-Data Use or by contacting info@innovcell.com. Withdrawal will result in the discontinuation of processing based on that consent and the unavailability of App functions requiring such data.
As the App’s core functionalities rely on the processing of this data, withdrawing your consent means that we will no longer be able to provide you with access to the App’s functionalities. Before completing the withdrawal process, you will be clearly informed that withdrawing your consent will result in the termination of your access to the App and the deletion of your account and associated personal data, following the same procedure as the “Delete My Account” functionality (see Section 19 – Deletion), unless a separate lawful basis and, where applicable, an appropriate condition under Article 9 GDPR justify limited retention.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Refusing research consent does not affect App access.
7. Evolution Score and medical disclaimer
The Evolution Score is generated using predefined calculation rules applied to scar-related ratings entered by the user. It summarises changes in self-reported information over time and is not derived from photographic analysis. The score and associated messages are intended solely to support personal record-keeping and review of user-reported information.
Calculation of the Evolution Score involves automated processing and evaluation of health-related information, constituting profiling within the meaning of Article 4(4) GDPR. This processing is based on the user’s explicit consent under Section 6. Innov-Cell does not use the Evolution Score to make solely automated decisions that produce legal or similarly significant effects concerning users, as described in Article 22 GDPR.
MyDermAssist is intended exclusively as a personal routine and scar progress-tracking application. It is not a medical device and is not intended to assess wound healing, identify complications, diagnose or monitor medical conditions, evaluate treatment effectiveness or provide medical recommendations. The Evolution Score and associated messages do not constitute a clinical assessment and should not be relied upon to make healthcare decisions or delay professional medical advice. Users should consult a qualified healthcare professional regarding any medical concerns or treatment decisions.
8. Optional scientific research
Participation in scientific research is entirely voluntary, disabled by default and subject to separate explicit consent. Refusing or withdrawing research consent does not affect access to the App’s standard functions. Before requesting consent, Innov-Cell provides information about the research purpose or specific study, the categories of personal data involved, any photographic analysis, data recipients and applicable retention periods.
Where consent is provided, research data is pseudonymised and stored separately from account information, with access restricted to authorised personnel. Direct account identifiers are replaced by a random research identifier, while Innov-Cell retains the ability to link the records to you. Pseudonymised records remain personal data under the GDPR, and removal of photographic metadata does not, by itself, render photographs anonymous. Research processing is subject to appropriate safeguards under Article 89(1) GDPR and Article 31 of Portuguese Law No. 58/2019, including data minimisation, pseudonymisation and, where required, prior approval by a competent ethics committee.
You may withdraw research consent in Settings → Consents & Privacy → Scientific Data Use or by contacting info@innovcell.com. Following withdrawal, Innov-Cell will cease research processing based on that consent, including further use of previously collected identifiable or pseudonymised data, and erase the associated research records without undue delay, unless a separate lawful basis and, where applicable, an appropriate condition under Article 9 GDPR justify limited retention. Any such exception will be explained to the user and will not automatically authorise continued research use. The legal basis will not be retrospectively changed to circumvent consent withdrawal.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. Research findings and results that have been genuinely anonymized and can no longer reasonably be linked to an identifiable individual, including aggregated results in scientific publications, may be retained. Deleting your account also ends research participation and triggers deletion under section 19. Withdrawal of research consent alone does not affect personal data processed for standard App functions under the separate health-data consent described in Section 6.
9. Notifications and reminders
Product reminders are scheduled on your device. Check-in reminders use our servers, Expo and Apple or Google push services. These services receive your push token and notification text, which excludes health information and scar names. Notification text is kept generic so that it does not reveal health information on your lock screen. You can disable reminders in App or device settings. Research consent is not required for reminders.
10. Reports you share
You can create and share a PDF progress report through a channel you choose, for example with your clinician. Sharing is initiated by you. The recipient is responsible for their subsequent use of the report; choose recipients and channels carefully. Reports are generated on our servers and retained until you delete them or delete your account or withdraw your consent. We then delete them within 30 days.
11. Analytics and improvements
The App currently has no third-party analytics, advertising or tracking software. Internal usage statistics use aggregated information. Where underlying records are personal data, we minimise them and apply the relevant basis in section 5; aggregation or pseudonymisation does not automatically make them anonymous. Health content is not included in general usage analytics. New optional analytics requiring consent will be explained and enabled only after consent is obtained.
12. Cookies and similar technologies
The mobile App does not use cookies. The App stores or accesses information on your device (such as login session data, settings and the push token) only where strictly necessary to provide the service you request. Any non-essential access, such as optional diagnostics, requires your prior consent, in line with Article 5(3) of Directive 2002/58/EC as implemented by Portuguese Law 41/2004. Any web functionality using cookies or similar technologies will explain them separately and obtain consent for non-essential technologies where required. We do not use health information for advertising tracking.
13. Data received from other sources
Authentication and App-store services may provide account or transaction information needed for the service. Where Article 14 GDPR applies, we provide the required information within its applicable deadlines. Infrastructure providers processing information on our behalf are described in section 14.
14. Providers and recipients
The following providers support the App. Their roles and access depend on the service; providers acting on our behalf are bound by Article 28 agreements. Apple and Google act as independent controllers for App distribution and their push-notification services, under their own terms and privacy policies.
| Provider | Service | Reported location |
|---|---|---|
| Upgraide Artificial Intelligence Lda. | Development and technical operation | Portugal |
| Supabase | Database and authentication | Frankfurt, Germany |
| Cloudflare R2 | Photograph and file storage | European Union |
| Railway | Application servers | European Union |
| Expo / 650 Industries | Push delivery | United States |
| Apple and Google | App distribution and push delivery | Worldwide |
Health data is disclosed for research only within the scope of your separate consent. We may also disclose necessary data where legally required or necessary for legal claims, subject to the applicable safeguards.
15. International transfers
15.1. Data storage and processing within the European Economic Area
Personal data collected through MyDermAssist, including health-related information and photographs, is stored on servers located within the European Union (EU).
As described in Section 14, our principal service providers include Upgraide Artificial Intelligence Lda (Portugal), Supabase (Germany), Cloudflare R2 (EU) and Railway (EU), which support the App’s technical operation, database management, authentication, file storage and application hosting.
Although data is hosted within the EU, certain service providers may access personal data from countries outside the European Economic Area (EEA) for authorised technical support, maintenance or security purposes. Such access may constitute an international transfer under the GDPR.
15.2. Transfers Outside the European Economic Area
Certain App services involve the disclosure or transfer of limited personal data to providers located outside the EEA, particularly for push-notification delivery and related technical operations.
The following table identifies the relevant providers, categories of information and transfer arrangements.
| Recipient or provider | Personal data involved | Destination | GDPR transfer mechanism |
|---|---|---|---|
| Expo / 650 Industries | Push tokens and generic notification content | United States | EU-U.S. Data Privacy Framework (650 Industries, Inc. is self-certified), complemented by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) where required. |
| Apple and Google | Push-notification identifiers and App distribution or account information, as applicable (including Google sign-in, where the user chooses it) | Receiving entities for EEA users: Apple Distribution International Ltd. (Ireland) and Google Ireland Limited (Ireland), with onward processing by their affiliates, including in the United States. | Apple and Google act as independent controllers for App distribution, account services and their push-notification services. Any onward transfers are carried out by them under their own transfer mechanisms (EU-U.S. Data Privacy Framework certifications of Apple Inc. and Google LLC and the Standard Contractual Clauses), as described in their privacy policies. |
| Supabase, Cloudflare R2 and Railway, where non-EEA remote access occurs | Personal data accessible for authorised technical support, maintenance or security | Data is hosted in the EU (Supabase: Frankfurt, Germany; Cloudflare R2: EU jurisdiction; Railway: Netherlands). Remote access for support, maintenance or security may occur from the United States and, for Supabase, from other countries where its personnel and sub-processors are located (including Singapore). | Supabase, Inc.: Standard Contractual Clauses (Module 2, Decision (EU) 2021/914) incorporated in its Data Processing Addendum, with supplementary measures. Cloudflare, Inc.: EU-U.S. Data Privacy Framework certification, with the Standard Contractual Clauses incorporated in its Data Processing Addendum as an additional basis. Railway Corporation: Standard Contractual Clauses (Decision (EU) 2021/914) incorporated in its Data Processing Addendum. |
Push-notification content does not include scar names or health-related details. Nevertheless, technical identifiers and associated information may constitute personal data and are subject to applicable data protection requirements.
15.3. Safeguards for International Transfers
Where personal data is transferred outside the EEA, the transfer must comply with Chapter V of the GDPR and be supported by an applicable legal transfer mechanism.
Depending on the recipient and destination, this may include:
- An adequacy decision adopted by the European Commission under Article 45 GDPR, including the EU–U.S. Data Privacy Framework where the recipient holds a valid certification covering the relevant processing.
- Standard Contractual Clauses approved by the European Commission under Article 46 GDPR, together with supplementary technical, contractual or organisational safeguards where necessary.
- Another legally recognised transfer mechanism, where applicable.
International transfers are subject to appropriate contractual and security measures, including restrictions on access and onward transfers where required.
Users may request further information about the applicable transfer arrangements and obtain copies of relevant safeguards, subject to necessary redactions, by contacting info@innovcell.com.
15.4. Additional Requirements for Users in Türkiye
For users located in Türkiye, personal data collected through MyDermAssist, including health-related information and photographs, is processed and stored outside Türkiye, principally within the European Union, as described in Sections 14 and 15.1.
Further information about the rights of users in Türkiye is provided in Section 23 of this Privacy Policy.
16. Security
We apply technical and organisational measures appropriate to the risks of health-data processing, including encryption, restricted access and incident management. Our safeguards include encryption in transit and at rest, authentication and access controls, role-based permissions, logging, backups, vulnerability management, security monitoring and incident-management procedures. We assess incidents and notify the supervisory authority and affected individuals where the GDPR requires it. No internet-based service can guarantee absolute security.
17. Data minimization
We identify required and optional fields at collection. Required fields are name, email, year of birth and country, gender is optional. Required account information is needed to create and operate your account; without the relevant health information and consent, scar-tracking functions cannot operate. Optional information and research participation are not contractual requirements.
Only provide information necessary for your use of the App. The App is intended for your own records. Do not upload information about another person. Avoid unrelated identifiable people or confidential documents in photographs.
18. Retention
We retain personal data only while necessary for the stated purpose. The following limits apply, with any lawful exceptions restricted to the data and period needed.
| Data | Retention period |
|---|---|
| Account data | While your account is active. If you delete your account, we delete this data within 30 days. |
| Inactive accounts | If you do not use the App for 24 months, we notify you and delete the account and its data 30 days later unless you log in. |
| Scar records, photographs, calculated progress scores and generated text (health related data) | Until you delete them or delete your account or withdraw your consent. We then delete them within 30 days. |
| Consent records | For as long as your consent is in force and, afterwards, for the legal period during which claims could be brought against us. |
| Records needed for legal obligations or legal claims | For the period required by law or until the claim is finally resolved. |
| Research records | Until research consent is withdrawn, the account is deleted, or five years have elapsed from collection, whichever occurs first, subject to the lawful retention exceptions described in section 19. |
| Support records | 12 months after the request is closed. |
| Security logs (including IP address) | 6 months. Where a security incident is under investigation, only the relevant logs are kept until the investigation is closed. |
| Push token | Until sign-out, disabling notifications or token expiry. |
| Anonymised data | Data that has been irreversibly anonymised is no longer personal data and may be kept without time limit. |
| Backups | Deleted data is overwritten in backups within 90 days. |
19. Deletion
You may delete individual records or your account in Settings → Consents & Privacy → Delete My Account, or request erasure of your personal data by contacting info@innovcell.com. Following an account-deletion request, Innov-Cell will discontinue the associated data processing and erase personal data from active systems without undue delay, ordinarily within 30 days. This includes account information, scar records, photographs, Evolution Scores, generated content and linked pseudonymised research records. Account deletion also terminates participation in any ongoing research activities.
Residual copies in protected backups will be removed in accordance with the documented backup-retention cycle, which does not exceed 90 days. During this period, backup data will not be used for routine processing. Any restoration will be subject to appropriate safeguards to prevent the reintroduction of personal data previously deleted.
Personal data may be retained only where a valid legal exception applies, including compliance with a legal obligation or the establishment, exercise or defence of legal claims. Any such retention will be restricted to the specific purpose and period necessary, and users will be informed of the applicable justification and retention limits.
Pseudonymisation or previous research use alone does not justify continued retention following an erasure request. Genuinely anonymised information, including anonymous aggregated research results, is no longer considered personal data and is therefore not subject to erasure obligations under the GDPR.
Further information on applicable retention periods is provided in Section 18.
20. Your rights
Subject to the applicable conditions, you may access, correct or erase your personal data; restrict processing; receive portable data; object to processing based on legitimate interests; and withdraw consent. You also have protections concerning solely automated decisions with legal or similarly significant effects.
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.
Data portability. You can request your records and photographs by sending an email to info@innovcell.com. Requests are generally free; any lawful fee or refusal must be justified. We request additional identity information only where reasonably necessary. We respond within one month of receiving your request; this may be extended by two further months for complex or numerous requests, in which case we will tell you within the first month.
You may complain to a supervisory authority, particularly where you habitually reside, work or the alleged infringement occurred. In Portugal: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. If we refuse a request, we explain why and inform you of your right to complain to a supervisory authority and to seek a judicial remedy.
21. Minimum age
MyDermAssist is intended for users aged 16 and over. When you create an account, we ask for your year of birth and do not allow registration if you are under 16. We do not knowingly collect data directly from users under 16. Contact info@innovcell.com if this occurs so we can assess and erase the data as appropriate.
22. Policy changes
The current policy is available in the App and at https://mydermassist.devupgraide.com/privacy. We notify you of material changes before they take effect in the App and obtain fresh consent before any new processing that requires it. Previous versions are available on request.
23. Additional information for users in Türkiye
If you use MyDermAssist in Türkiye, Innov-Cell also processes your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”). This section adds to the rest of this Privacy Policy; where KVKK gives you more protection, KVKK applies. Together with the rest of this Privacy Policy, this section is our information notice under Article 10 KVKK; explicit consent is requested separately from this notice.
Data controller representative in Türkiye: ASYAMED TIBBİ MALZEMELER VE SAĞLIK ÜRÜNLERİ LTD. ŞTİ, Perpa Tic. Merk. A Blok Kat: 7 No: 861, 34384 Şişli. Privacy Contact Email: info@innovcell.com Registration in the Data Controllers’ Registry (VERBIS): Pending
Health information and photographs are special categories of personal data under Article 6 KVKK. They are processed only with your explicit consent, which the App asks for separately and which you can withdraw at any time (see sections 6 and 8), except where processing is strictly necessary to establish, exercise or protect a right (Article 6(3)(e) KVKK, as amended by Law No. 7499), consistent with section 5.
For other personal data, the legal bases in section 5 correspond to Article 5(2) KVKK: performance of a contract (c), compliance with a legal obligation (ç), establishment, exercise or protection of a right (e) and our legitimate interests (f), provided they do not harm your fundamental rights. Optional push notifications rely on your explicit consent.
Your data is stored in the European Union (see sections 14 and 15) and is therefore transferred outside Türkiye. This transfer is made in accordance with Article 9 KVKK. Under Article 11 KVKK you have the right to: learn whether your personal data is processed; request information about that processing; learn the purpose of the processing and whether your data is used for that purpose; know the third parties in Türkiye or abroad to whom your data is transferred; request correction of incomplete or inaccurate data; request erasure or destruction of your data; request that third parties to whom your data was transferred are informed of a correction or erasure; object to a result against you arising from analysis exclusively by automated systems; and claim compensation for damage caused by unlawful processing.
You can exercise these rights by contacting Innov-Cell or its representative in Türkiye at info@innovcell.com. Requests can be sent in writing, by registered electronic mail (KEP) or from the email address registered in your account. Requests are answered free of charge within 30 days at the latest, unless the response involves an additional cost, in which case a fee may be charged under the tariff set by the Personal Data Protection Board. You may also lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) after first applying to us, within 30 days of our response or within 60 days of your request if we do not respond (Article 14 KVKK).
A Turkish version of this Privacy Policy is available in the App and prevails for users in Türkiye.
