DRAFT — NOT LEGAL ADVICE. This document was prepared as a thorough starting point, not by a lawyer. It handles health information and must be reviewed by an Australian privacy lawyer before you publish it or launch the app. Yellow-highlighted fields must be completed.
1. Who we are
Charles J Maher trading as Skin Trace (ABN 38 725 055 198) ("Skin Trace", "we", "us", "our") operates the Skin Trace mobile application (the "App").
Registered address: 16 Holm Park Rd, Beaconsfield VIC 3807
Privacy contact: privacy@skintrace.com.au
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Because the App collects health information, we are also subject to the additional obligations that apply to organisations handling sensitive information, and to the Health Records Act 2001 (Vic) where applicable.
This Policy explains what we collect, why we collect it, who we share it with, and what rights you have. Please read it carefully. If you do not agree with it, do not use the App.
2. A plain-English summary
This summary is provided for convenience and does not replace the full Policy below.
The App collects information about your skin — including photographs, symptoms, products used, sleep, stress and hydration. This is health information and is treated as sensitive.
We use it to give you tracking, pattern analysis and AI-generated insights.
Your data is processed by third parties on our behalf, including services located outside Australia (primarily the United States).
We do not sell your personal information.
You choose whether to share data with a dermatologist, what categories to share, and you can revoke that access at any time.
We may use your skin photographs in de-identified form for marketing and promotional purposes. See section 9. You may object to this at any time.
You can request access to, correction of, or deletion of your data.
3. What information we collect
3.1 Account information
Your name (or the name you choose to provide)
Your email address
An encrypted representation of your password (we never store your password in readable form)
Your account type (patient or dermatologist)
The date you created your account
3.2 Health information (sensitive information)
The following is health information within the meaning of the Privacy Act, and is therefore sensitive information attracting a higher standard of protection:
Your self-reported skin condition (for example eczema, acne, psoriasis, rosacea)
Daily log entries, including how your skin feels, symptoms, and flare-up status
Photographs of your skin that you choose to upload
Products, cosmetics and detergents you record using
Supplements and vitamins you record taking
Medications you record taking
Self-reported stress levels
Self-reported sleep duration and sleep quality
Self-reported water and hydration intake
Environmental factors you record (for example travel, swimming, heat)
Free-text notes you choose to write
AI-generated analysis derived from the above, including trigger correlations, insights, and elimination plans
3.3 Technical and usage information
Device type, operating system and app version
Push notification identifiers, if you enable notifications
Crash reports and diagnostic logs
Approximate usage patterns within the App (for example which screens are opened)
3.4 Subscription information
If you purchase a subscription, the transaction is processed by Apple. We do not collect, receive or store your payment card details, billing address, or Apple ID password. We receive from our subscription management provider only your subscription status, product identifier, and expiry date.
3.5 Support correspondence
If you contact us through the App, we collect your message, your name, your email address, and the category you select.
3.6 Information we do not collect
We do not collect your precise geolocation.
We do not access your contacts, microphone or calendar.
We do not collect your payment card details.
We do not purchase personal information from data brokers.
4. Consent to collect sensitive information
Under APP 3, we may only collect sensitive information (including health information) with your consent, and only where it is reasonably necessary for our functions.
By creating an account and entering health information into the App, you consent to us collecting, holding, using and disclosing that information for the purposes described in this Policy.
Providing health information is voluntary. You may use only the features you are comfortable with. However, most of the App’s core functionality — including trigger analysis, insights and elimination plans — depends on this information, and will not work without it.
You may withdraw your consent at any time by deleting your account (see section 12). Withdrawal of consent does not affect the lawfulness of anything done before withdrawal.
5. Why we collect and use your information
5.1 Primary purposes
To create and administer your account
To store and display your daily logs and photographs
To generate AI-powered analysis of patterns and possible triggers
To generate suggested elimination cycles and product suggestions
To send you the reminders and notifications you have enabled
To enable you to share data with a dermatologist, where you choose to do so
To manage your subscription and provide access to paid features
To respond to your support enquiries
5.2 Secondary purposes
To detect, investigate and prevent fraud, abuse and security incidents
To fix bugs, diagnose faults and improve the App
To produce aggregated, de-identified statistics that do not identify any individual
To use de-identified photographs for marketing and promotional purposes, as described in section 9
To comply with our legal obligations, or to respond to a lawful request from a court, regulator or law enforcement agency
5.3 What we will not do
We will not sell your personal information.
We will not disclose your identifiable health information to advertisers, insurers, employers, or data brokers.
We will not use your identifiable health information for targeted advertising.
6. Artificial intelligence processing
The App uses a third-party large language model service — provided by Anthropic, PBC — to generate insights, trigger analysis, product suggestions and elimination plans.
When you request an AI-generated insight, the contents of your recent logs (which may include your condition, symptoms, products, supplements, medications, sleep, stress and hydration data) are transmitted to that service for processing. Your name and email address are not transmitted.
This processing occurs on servers located outside Australia, primarily in the United States. See section 8.
AI OUTPUT IS NOT MEDICAL ADVICE. AI-generated insights are statistical suggestions based on data you have entered. They may be incomplete, inaccurate or wrong. They are not a diagnosis, and must not be relied upon as a substitute for advice from a qualified healthcare professional. See the Terms and Conditions, section 5.
7. Who we disclose your information to
We disclose your information to the following categories of recipient, only to the extent necessary:
7.1 Service providers
Supabase — database hosting, authentication and file storage
Anthropic, PBC — AI processing (see section 6)
RevenueCat — subscription status management
Apple Inc. — App distribution and payment processing
These providers are permitted to use your information only to perform services for us, and are bound by contractual obligations of confidentiality and security.
7.2 Dermatologists you choose to share with
The App allows you to generate a join code and provide it to a dermatologist, who may then link to your account. If you do this:
You control which categories of information are shared (AI insights, daily logs, and/or photographs).
Nothing is shared until you enable the relevant category.
The dermatologist’s access is read-only. They cannot alter your data.
You may revoke access at any time, immediately, from within the App.
You may share with more than one dermatologist, with different permissions for each.
IMPORTANT — WE DO NOT VERIFY CREDENTIALS. We do not independently verify that a person holding a dermatologist account is a registered medical practitioner, dermatologist, or healthcare professional of any kind. You are solely responsible for confirming the identity and qualifications of any person to whom you give your join code. Only share your code with a practitioner you know and trust.
7.3 Legal and safety disclosures
We may disclose your information where we reasonably believe it is necessary to comply with a law, court order, subpoena or lawful request from a regulator or law enforcement agency; to enforce our Terms and Conditions; or to prevent a serious and imminent threat to the life, health or safety of any person.
7.4 Business transfer
If our business is sold, merged, or transferred, your information may be transferred as part of that transaction. We will take reasonable steps to require the recipient to handle your information in a manner consistent with this Policy, and we will notify you before your information becomes subject to a materially different privacy policy.
8. Overseas disclosure
Under APP 8, we must tell you if we disclose personal information overseas.
Your information — including your health information and photographs — is stored and processed on servers located outside Australia, primarily in the United States, by the service providers listed in section 7.1.
We take reasonable steps to ensure that these overseas recipients handle your information in accordance with the Australian Privacy Principles. However, you acknowledge that:
Information stored overseas may be subject to the laws of that jurisdiction, including lawful access requests by foreign government agencies.
Australian privacy law may not be enforceable against an overseas recipient in the same way it is against an Australian entity.
By using the App, you consent to this overseas disclosure.
9. Photographs and promotional use
9.1 How your photographs are stored
Photographs you upload are stored in our file storage system and are linked to your account. They are visible only to you, and to any dermatologist you have expressly granted photograph access to.
9.2 De-identified promotional use
We may use photographs you upload, in de-identified form only, for marketing, advertising, promotional, demonstration, educational and case-study purposes relating to the App. This includes use on our website, in App Store listings, in social media, and in printed or digital marketing material.
Your agreement to this use is set out in clause 9 of the Terms and Conditions.
9.3 What "de-identified" means
Before any photograph is used for a purpose described in section 9.2, we will remove or irreversibly obscure every feature that could reasonably identify you, including:
Your face, or any part of your face, whether by cropping, blurring, pixelation or masking
Your eyes and any identifying facial features
Tattoos, scars, birthmarks and other distinctive markings that are not part of the skin condition depicted
Jewellery, clothing, and personal items
Any background element that could identify you or your location
All embedded file metadata, including EXIF data, geolocation coordinates, device identifiers and timestamps
We will never publish your name, username, email address, or any other identifying detail alongside a photograph used under this section, unless you have separately and expressly agreed in writing.
9.4 Your right to object
You may object to the promotional use of your photographs at any time, for any reason, without giving a reason, by contacting us at the address in section 1. On receiving your objection we will:
Cease all further promotional use of your photographs;
Remove your photographs from any material still within our control; and
Make reasonable efforts to withdraw material already published, noting that we may not be able to recall material already distributed to third parties or printed.
10. Data security
We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include:
Encryption of data in transit using TLS
Encryption of data at rest
Row-level access controls, so that your data is accessible only to your account and to those you have authorised
Passwords stored only as salted cryptographic hashes
Access to production systems restricted to authorised personnel
No method of transmission or storage is completely secure. While we take security seriously, we cannot guarantee absolute security, and you provide information to us at your own risk.
If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.
11. How long we keep your data
Account and health information: retained while your account is active.
After account deletion: deleted from live systems within 30 days.
Backups: residual copies may persist in encrypted backups for up to 90 days, after which they are overwritten.
De-identified photographs already used in published marketing material: may be retained, as they no longer constitute personal information.
Records we are required by law to keep (for example transaction records for taxation purposes): retained for the period required by law.
Aggregated, de-identified statistics: retained indefinitely.
12. Your rights
12.1 Access
Under APP 12, you may request access to the personal information we hold about you. We will respond within 30 days. We may refuse access in the limited circumstances permitted by the Privacy Act, and if we do we will tell you why in writing.
12.2 Correction
Under APP 13, if information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it. Most information can be corrected directly in the App.
12.3 Deletion
You may delete your account at any time from within the App. Deleting your account will permanently remove your logs, photographs, insights, plans and profile, and will revoke any dermatologist access.
Deletion is permanent and cannot be undone. We cannot recover deleted data.
12.4 Withdrawal of consent
You may withdraw your consent to our handling of your health information at any time by deleting your account. You may separately object to promotional use of your photographs under section 9.4 without deleting your account.
13. Children and young people
The App is available only to persons aged 18 and over. By creating an account, you confirm that you are at least 18 years old.
We do not knowingly collect personal information from a person under 18. If we become aware that we have collected personal information from a person under 18, we will delete it as soon as practicable and close the associated account.
14. Complaints
If you believe we have breached the Australian Privacy Principles, please contact us first, at the address in section 1. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
Online: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
15. Changes to this Policy
We may update this Policy from time to time. If we make a material change — particularly a change to how we use your health information or photographs — we will notify you in the App and by email before the change takes effect, and where the law requires it, we will seek your fresh consent.
The date at the top of this Policy indicates when it was last revised. Continued use of the App after a change takes effect constitutes acceptance of the revised Policy.
16. Contact us
Charles J Maher trading as Skin Trace 16 Holm Park Rd, Beaconsfield VIC 3807 Email: privacy@skintrace.com.au