Dermi Privacy Policy

1. Introduction

Dermi Inc. ("Dermi," "we," "us") collects and manages user data according to this Privacy Policy ("Policy").

Compliance Framework:

• For Dermi: As a Canadian commercial organization, Dermi complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, such as the Act Respecting the Protection of Personal Information in the Private Sector in Quebec, regarding the collection of your Account Data. Where Dermi collects or handles personal information of users in Australia, Dermi also complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where Dermi collects or handles personal information of users in New Zealand, Dermi also complies with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles. Where Dermi collects or handles personal data of users in Switzerland, Dermi also complies with the Swiss Federal Act on Data Protection. Where Dermi collects or handles personal data of users in Ukraine, Dermi also complies with the Law of Ukraine On Personal Data Protection (No. 2297-VI). Where Dermi collects or handles personal data of users in Israel, the United Arab Emirates, Singapore, or Hong Kong SAR, Dermi also complies with the applicable requirements of the Protection of Privacy Law, 5741-1981 (Israel), Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (United Arab Emirates), the Personal Data Protection Act 2012 (Singapore), and the Personal Data (Privacy) Ordinance (Cap. 486) (Hong Kong SAR). In Ukraine, Israel, the United Arab Emirates, Singapore, and Hong Kong SAR, the Services are offered solely to clinics, practices, and other business or professional users acting in the course of their trade, business, or profession, and are not offered to consumers.
• For Users: This Policy addresses users in Canada, the United States, Australia, New Zealand, Switzerland, Ukraine, Israel, the United Arab Emirates, Singapore, and Hong Kong SAR.

This Policy covers data collected through:

1. Dermi Portal and Dermi Atlas Cloud Demo (Cloud Services)
2. Dermi Atlas Professional and Dermi Atlas Manager (On-Premises Software)
3. Dermi Atlas Companion (iOS Mobile Application)
4. Dermi website (dermi.ai), including newsletter subscriptions and contact form submissions

2. Information Collection

A. Cloud Services (Portal and Cloud Demo)

We collect:

• Account Data: Name, email address, hashed password, organization details, and any tax registration number provided for billing purposes. Where an account holds a license for Dermi Atlas Professional, this also includes the team member invitations and memberships associated with that license, each including the member's name, username, email address, account type, and membership status.
• Billing Data: Payment method details are collected and processed by our third-party payment processor, Stripe, Inc. Dermi does not store or have access to full card numbers. Stripe's collection and use of your payment information is governed by the Stripe Privacy Policy.
• Usage Logs: Login history, IP addresses, and interaction logs.
• Anti-Abuse Verification Data: Sign-in, registration, and password-recovery pages in the Cloud Services, and the contact form on the dermi.ai website, are protected by Cloudflare Turnstile, a bot-protection service operated by Cloudflare, Inc. When a protected page or form is used, Cloudflare processes technical signals from the browser (IP address and browser and device characteristics) to distinguish human visitors from automated traffic. Turnstile does not use advertising cookies and is not used for cross-site profiling.
• Marketing Communications Data: If you subscribe to the Dermi newsletter through the dermi.ai website, Dermi collects your email address together with the IP address and User-Agent of the submitting browser, used solely for delivery, anti-abuse, and rate-limiting purposes. Dermi may also use the email address in your Account Data to send you marketing emails about Dermi products and features. You may unsubscribe from the newsletter and from marketing emails at any time through the unsubscribe link in each message or by contacting privacy@dermi.ai.
• Contact Form Data: If you submit the contact form on the dermi.ai website, Dermi collects the reason for contact, name, email address, and message that you provide, together with the IP address and User-Agent of the submitting browser and approximate location and timezone information derived from the request, used solely for anti-abuse, rate-limiting, and support purposes.

B. On-Premises Software (Atlas Professional and Atlas Manager)

• Local Data Separation: Patient data, medical images, and clinical notes entered into Dermi Atlas Professional are stored locally on your infrastructure. Dermi does not access, collect, or store this data on its servers.
• Administrative and Security Telemetry: To provide license verification, team member management, and account security features (such as 2FA configuration, password resets, and account change confirmations), the software transmits specific administrative data to Dermi infrastructure.
  • Data Transmitted: License token, deployment and device identifiers, username, name, email address, account type, request type, non-sensitive confirmation tokens (for link validation), technical client metadata (IP address, User-Agent, timezone), and installation metadata (the installed Dermi Atlas Professional and Dermi Atlas Manager versions, the host operating system name and version, the processor architecture, and the Docker version where available). License verification also transmits aggregate totals alone for the installation (the numbers of patients, images, tags, and team member accounts, and the total image storage size), which include no health information and can be turned off in Dermi Atlas Manager under Administration => Deployment Statistics.
  • Team Member Records: The software keeps the team member records described in Section 2.A in sync with the user accounts on your installation.
  • No Health Information: Canadian "Personal Health Information", U.S. "Protected Health Information" (PHI), Australian "sensitive information" (including "health information") as defined under the Privacy Act 1988 (Cth) and applicable Australian state and territory health records legislation, New Zealand "health information" as defined by the Health Information Privacy Code 2020, and Swiss personal data concerning health as defined by the Swiss Federal Act on Data Protection are never included in these requests.
• Diagnostics Data: If you send diagnostics from Dermi Atlas Manager, the software transmits technical logs, settings (without passwords or keys), software and operating system versions, the device name and system details, and any message you provide, used solely for technical support purposes.

C. Dermi Atlas Companion (iOS Application)

The Dermi Atlas Companion is a native iOS application that connects to a Dermi Atlas Professional server on your local network, or, optionally, to the Dermi Atlas Cloud Demo. The Companion App operates as a thin client. Health Information accessed through the Companion App is fetched from, and remains on, the Atlas server you connect to. The Companion App does not transmit Health Information to Dermi.

• Layered Consent: The Companion App is downloadable and installable without account creation. Before any account-bearing or data-bearing feature is available, you must complete an explicit acceptance step: account registration in the Dermi Atlas Cloud Demo, which requires you to affirmatively accept the Dermi Terms of Service and this Policy at the point of registration, or in a Dermi Atlas Professional instance, which requires you to accept the Dermi Atlas Professional EULA at the point of registration; or, for each session of Cloud Demo use, the Dermi Atlas Cloud Demo Disclaimer.
• Data Stored on the Device: Server names, hostnames, ports, color and icon preferences, certificate fingerprints, LAN certificates that you have trusted, and user preferences. No patient data, no images, and no account credentials are persisted to the device filesystem outside the iOS WebKit session and standard browser caches.
• iOS Permissions: Local Network access (to reach your Atlas server); Camera (only when you initiate a capture); Photo Library (only when you choose to upload). The Companion App contains no analytics, telemetry, advertising, or crash-reporting SDKs.
• Transmission to Dermi: The Companion App does not contact Dermi-operated servers other than (i) optionally connecting to demo.atlas.dermi.ai when you enable the Cloud Demo preference, and (ii) when you tap a help or legal link that opens a Dermi-hosted page in your browser.

3. How We Use Your Information

We use collected data to:

• Provide and secure the Services.
• Process payments and verify licenses.
• Deliver transactional and security emails (e.g., 2FA configuration, password resets).
• Send administrative and support emails.
• Send service communications, including notices of software updates, security advisories, and changes to the Services.
• Send marketing emails about Dermi products and features, as described in Section 2.A.
• Comply with legal obligations.

We do not sell your personal information. We do not disclose personal information to third parties for their advertising purposes, except for the advertising and conversion measurement described in Section 11 (Cookies and Analytics).

4. Disclosure of Information

We share information with:

• Sub-Processors: Infrastructure, distribution, anti-abuse, analytics, and advertising measurement providers (AWS, MongoDB, Stripe, Postmark, Cloudflare, Apple, Vercel, Google). For a complete list and the categories of data shared with each, refer to the Dermi Sub-Processors document.
• Legal Authorities: If required by law.
• Business Transfers: In the event of a merger or acquisition.

5. Sub-Processors

We use third-party sub-processors. For a comprehensive list including data categories, please refer to the Dermi Sub-Processors document. Payment processing is handled by Stripe, Inc.; for details on how Stripe processes personal data, refer to the Stripe Privacy Policy.

6. Data Retention

• Account Data: Retained while the account is open. Deleted within 30 days after account closure. Team member records are retained until the account holder deletes them or the account is closed.
• Demo Data: Patient records, entries, images, and clinical metadata uploaded to the Dermi Atlas Cloud Demo are purged on a regular schedule (no less frequently than once per week) and may also be wiped without notice for maintenance or operational reasons. Account credentials, user preferences, and acceptance logs in the Cloud Demo are preserved separately and follow the Account Data retention rule above.
• Newsletter Data: Email addresses are retained until you unsubscribe. The IP address and User-Agent associated with a subscription event are retained for no longer than 12 months and used solely for anti-abuse and rate-limiting purposes.
• Contact Form Data: A submission is delivered to the Dermi support mailbox and retained there, together with any ensuing correspondence, as business correspondence. The stored submission record and its associated technical metadata are retained for no longer than 12 months.
• Diagnostics Data: Diagnostics bundles are retained for no longer than 90 days, and their associated records for no longer than 12 months. Any message you provide is retained in the Dermi support mailbox as business correspondence.
• Transmission Logs: Logs regarding emails sent and API requests processed are retained for no longer than 90 days for security auditing and delivery troubleshooting.
• Billing Records: Billing and transaction records are retained for a minimum of 7 years after the end of the applicable subscription period, as required for tax and audit compliance.

7. Security

We use HTTPS/TLS encryption and industry-standard security practices to protect your information.

Payment Security: All payment transactions are processed by Stripe, Inc., which is certified as a PCI-DSS Level 1 Service Provider (the highest level of certification in the payment card industry). Dermi does not store, process, or have access to full credit card numbers. Payment data is transmitted directly from your browser to Stripe over encrypted connections. For more information, refer to Stripe's security documentation.

Customer Security Responsibility: You are responsible for securing the server where Dermi Atlas Professional is installed to protect the Health Information stored locally. You agree to act as the custodian or trustee of such data in accordance with the privacy laws applicable to your jurisdiction, such as PHIPA in Ontario, the Act Respecting the Protection of Personal Information in the Private Sector in Quebec, HIPAA in the United States, the Privacy Act 1988 (Cth) and applicable state and territory health records legislation in Australia, the Privacy Act 2020 and the Health Information Privacy Code 2020 in New Zealand, the Swiss Federal Act on Data Protection and applicable cantonal health legislation in Switzerland, the Law of Ukraine On Personal Data Protection (No. 2297-VI) in Ukraine, the Protection of Privacy Law, 5741-1981 in Israel, Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields in the United Arab Emirates, the Personal Data Protection Act 2012 in Singapore, or the Personal Data (Privacy) Ordinance (Cap. 486) in Hong Kong SAR.

Mobile Device Security: Where you use the Dermi Atlas Companion on iOS, you are solely responsible for the physical and logical security of the device, including but not limited to device passcode or biometric lock, screen visibility, screenshot and screen-recording controls, AirDrop policy, and, where required by the privacy laws applicable to your practice, disabling iCloud Backup of the Companion App. Dermi has no control over iOS-level mechanisms that may persist or transmit content rendered from your Atlas server. Communications between the Companion App and your Atlas Professional server traverse your local network; Dermi has no visibility into, control over, or responsibility for the security of your local network or for any interception, modification, or loss of data occurring on that network.

8. Your Rights

You may request access to, correction of, or deletion of, your personal account data or team member record by contacting our Privacy Officer at privacy@dermi.ai. The right of correction is recognized under PIPEDA, applicable Canadian provincial privacy laws, U.S. state privacy laws, Australian Privacy Principle 13 under the Privacy Act 1988 (Cth), Information Privacy Principle 7 of the Privacy Act 2020 (New Zealand), the Swiss Federal Act on Data Protection, the Law of Ukraine On Personal Data Protection (No. 2297-VI), the Protection of Privacy Law, 5741-1981 (Israel), Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (United Arab Emirates), the Personal Data Protection Act 2012 (Singapore), and the Personal Data (Privacy) Ordinance (Cap. 486) (Hong Kong SAR). Users in Ukraine may exercise their rights of access, correction, and deletion under Law No. 2297-VI through the same channel.

Right to Withdraw Consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time by contacting privacy@dermi.ai. Withdrawal of consent may require termination of your account if the consent relates to processing that is essential for providing the Services. Withdrawal of consent is subject to legal or contractual restrictions and reasonable notice.

Right to Complain: If you believe that your privacy rights have been violated, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Users in the United States may contact the applicable state attorney general or regulatory authority. Users in Australia may file a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Users in New Zealand may file a complaint with the Office of the Privacy Commissioner (New Zealand) at www.privacy.org.nz. Users in Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch. Users in Ukraine may file a complaint with the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) at www.ombudsman.gov.ua. Users in Israel may file a complaint with the Privacy Protection Authority at www.gov.il/en/departments/the_privacy_protection_authority. Users in the United Arab Emirates may file a complaint with the UAE Data Office. Users in Singapore may file a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg. Users in Hong Kong SAR may file a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

Quebec Residents: In accordance with the Act Respecting the Protection of Personal Information in the Private Sector, Quebec residents may also request that computerized personal information collected from them be communicated in a structured, commonly used technological format (data portability), and may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca. The Privacy Officer identified in the Contact section below is the person in charge of the protection of personal information for the purposes of that Act.

Note: Requests regarding patient records must be handled by you (the clinic or provider), as Dermi does not hold this data.

9. Data Breach Notification

In the event of a breach of security safeguards involving personal information under Dermi's control that creates a real risk of significant harm, Dermi will:

• Notify affected individuals as soon as feasible after the breach is confirmed, by email to the address associated with the affected account.
• Report the breach to the Office of the Privacy Commissioner of Canada as required under PIPEDA.
• Where the breach involves personal information of Quebec residents and presents a risk of serious injury, notify the CAI and the affected individuals, and record the incident in the confidentiality incident register maintained under the Act Respecting the Protection of Personal Information in the Private Sector.
• Where the breach affects individuals residing in the United States, notify those individuals and the applicable state authorities as required by U.S. state breach notification laws with respect to the account data held by Dermi.
• Where the breach is an "eligible data breach" affecting users in Australia under Part IIIC of the Privacy Act 1988 (Cth), notify the OAIC and affected individuals as required under the Notifiable Data Breaches scheme.
• Where the breach is a notifiable privacy breach affecting users in New Zealand under the Privacy Act 2020 (New Zealand), notify the Office of the Privacy Commissioner (New Zealand) and affected individuals where the breach has caused, or is likely to cause, serious harm.
• Where the breach affects users in Switzerland and is likely to result in a high risk to their personality or fundamental rights, notify the FDPIC as required by the Swiss Federal Act on Data Protection, and inform affected individuals where necessary for their protection or where the FDPIC so requests.
• Where the breach affects users in Ukraine, Israel, the United Arab Emirates, Singapore, or Hong Kong SAR, inform affected individuals where necessary for their protection or where required by applicable law, and notify any authority where and to the extent so required.
• Maintain records of all breaches of security safeguards as required by applicable law.

Users in the United States should review applicable state breach notification laws regarding their own obligations for locally stored data within Dermi Atlas Professional installations. Users in Australia should review the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) and applicable state and territory health records legislation regarding their own obligations for locally stored data within Dermi Atlas Professional installations. Users in New Zealand should review the notifiable privacy breach provisions of the Privacy Act 2020 and the Health Information Privacy Code 2020 (New Zealand), and users in Switzerland should review the breach reporting duties under the Swiss Federal Act on Data Protection, regarding their own obligations for locally stored data within such installations.

10. International Data Transfers

Personal information collected by Dermi may be processed in Canada and in the United States by Dermi's sub-processors. Data processed in the United States may be subject to U.S. law, including lawful access by U.S. courts, law enforcement, or national security authorities.

Dermi maintains written data processing agreements or equivalent contractual protections with its sub-processors, where commercially available, that require safeguards for personal information comparable to the protections required under PIPEDA. Personal information relating to Quebec residents may be communicated outside Quebec, including to sub-processors located elsewhere in Canada and in the United States; such communications are made in accordance with the assessment and contractual requirements of the Act Respecting the Protection of Personal Information in the Private Sector.

For users in Australia, Dermi takes reasonable steps in accordance with Australian Privacy Principle 8.1 to ensure that overseas recipients of personal information handle that information in a manner consistent with the Australian Privacy Principles, and identifies Canada and the United States as the destination countries for such transfers.

For users in New Zealand, under section 11 of the Privacy Act 2020 (New Zealand), personal information held by a sub-processor solely as an agent on behalf of Dermi is treated as held by Dermi, the transfer is not a disclosure under Information Privacy Principle 12, and Dermi remains responsible for the security of the information. Where a sub-processor also uses personal information for its own purposes (such as Stripe, Apple, or Google), the disclosure is made on the basis that the recipient is required, including under its agreement with Dermi, to protect the information in a way that, overall, provides comparable safeguards to those in that Act.

For users in Switzerland, personal data is disclosed to recipients in Canada, a jurisdiction recognized by Switzerland as providing an adequate level of data protection for private-sector entities, and to sub-processors in the United States on the basis of certification under the Swiss-U.S. Data Privacy Framework or standard contractual clauses recognized by the FDPIC, with the adaptations required for transfers subject to Swiss law, as applicable.

For users in Ukraine, Israel, the United Arab Emirates, and Singapore, account and billing information is transferred to and processed in Canada and the United States. The transfer relies on the following bases:

• Ukraine: The data subject's unambiguous consent, given at registration, and the necessity of the transfer for the performance of the contract, in accordance with Article 29 of the Law of Ukraine On Personal Data Protection (No. 2297-VI).
• Israel: The data subject's consent, given at registration, in accordance with regulation 2(1) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to the extent those Regulations apply.
• United Arab Emirates: The data subject's consent, given at registration, and the necessity of the transfer for the performance of the contract, in accordance with Article 23 of Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data.
• Singapore: The necessity of the transfer for the performance of the contract, and the legally enforceable obligations that bind the sub-processors that act on Dermi's behalf, in accordance with section 26 of the Personal Data Protection Act 2012 and the Personal Data Protection Regulations 2021.

For team member records provided by an account holder, the consent referred to above is obtained by the account holder before the member is invited, as provided in the Dermi Terms of Service.

Patient data processed in Dermi Atlas Professional deployments is not collected, accessed, or stored by Dermi and remains on the customer's own infrastructure, and the Cloud Demo must not be used with real patient data. For a complete list of sub-processors and their locations, refer to the Dermi Sub-Processors document.

11. Cookies and Analytics

The Dermi Portal, the Dermi Atlas Cloud Demo, and the Dermi Atlas Companion use only essential session and authentication cookies required for the operation of the Services, and do not use advertising cookies or third-party tracking cookies.

The dermi.ai marketing website uses Vercel Web Analytics, a cookieless, first-party analytics service that records aggregated pageview metrics (page path, referrer, country, and an anonymized visitor hash). Vercel Web Analytics does not set tracking cookies, does not retain raw IP addresses at rest, and is not used for advertising or cross-site profiling.

The dermi.ai marketing website also uses the Google tag (gtag.js) for Google Ads advertising and conversion measurement, operated by Google LLC. The Google tag processes IP address, browser information, and page and referrer URLs; where advertising storage is permitted, it may also set advertising cookies and process online identifiers. Advertising storage defaults to denied for visitors in the European Economic Area, the United Kingdom, Switzerland, and Quebec, and for browsers that send a Global Privacy Control signal. Visitors may opt out of advertising storage by enabling a Global Privacy Control signal in their browser or through a browser extension (effective from the next page visit), or by blocking cookies for the dermi.ai website in their browser settings; previously set cookies may be deleted at any time. Visitors may also manage how Google personalizes advertising through Google Ads Settings. Google's processing of this data is described in the Google Privacy Policy.

12. Children's Data

The Services are not directed to individuals under the age of 18. Dermi does not knowingly collect personal information from minors. If Dermi becomes aware that personal information has been collected from an individual under 18, that information will be deleted promptly.

Contact

Dermi Inc.
Attention: Privacy Officer
18 King Street East, Suite 1400
Toronto, ON M5C 1C4
Canada

Telephone: +1 647-600-3140
Privacy Inquiries: privacy@dermi.ai
General Inquiries: info@dermi.ai