Dermi Sub-Processors

Dermi Inc. engages the following third-party entities ("sub-processors") to process personal information. These providers support the Dermi website, the Dermi Portal, the Dermi Atlas Cloud Demo, the Dermi Atlas Companion iOS application, and administrative functions of Dermi Atlas Professional (including license verification, team member management, updates, and account notifications).

Amazon Web Services (AWS)

Entity: Amazon Web Services, Inc. and Amazon Web Services Canada, Inc.
Purpose: Cloud Infrastructure.
Data Processed: Account data, team member records, usage logs, license information, email addresses, administrative request metadata (IP address, User-Agent, timezone, confirmation tokens), diagnostics bundles.
Location: United States and Canada

MongoDB Atlas

Entity: MongoDB, Inc.
Purpose: Database Hosting.
Data Processed: Account data, team member records, license information, email addresses.
Location: United States

Stripe

Entity: Stripe, Inc. and its affiliates, including Stripe Payments Canada, Ltd.
Purpose: Payment Processing.
Data Processed: Billing information (payment methods are tokenized; Dermi does not store full card numbers).
Location: United States and Canada

Postmark

Entity: ActiveCampaign, LLC
Purpose: Email Delivery.
Data Processed: Email addresses, email contents (used for account verification, confirmation emails, notification emails, team member invitations, service communications, and marketing emails).
Location: United States

Cloudflare

Entity: Cloudflare, Inc.
Purpose: Bot protection and abuse prevention (Cloudflare Turnstile) on sign-in, registration, and password-recovery pages of the cloud-hosted Services.
Data Processed: IP address, browser and device characteristics, and challenge tokens used to distinguish human visitors from automated traffic. Turnstile does not use advertising cookies and is not used for cross-site profiling.
Location: United States (global edge network)

Apple

Entity: Apple Inc.
Purpose: App Store distribution of the Dermi Atlas Companion iOS application, including hosting, delivery, receipts, and platform-level diagnostics where the user opts in at the iOS level.
Data Processed: Apple Account identifiers (received by Apple, not by Dermi), App Store download metadata, optional iOS-level analytics and crash data (only where the user has opted in via iOS Settings).
Location: United States and Apple's global infrastructure

Vercel

Entity: Vercel Inc.
Purpose: Hosting of the dermi.ai marketing website and Vercel Web Analytics (cookieless, first-party page analytics).
Data Processed: Anonymized visitor hash, page path, referrer, country, User-Agent class. No raw IP address retained at rest.
Location: United States

Google

Entity: Google LLC
Purpose: Advertising and conversion measurement (Google Ads via the Google tag) on the dermi.ai marketing website.
Data Processed: Online identifiers (advertising cookies where advertising storage is permitted), IP address, browser and device information, page and referrer URLs. Advertising storage defaults to denied for visitors in the European Economic Area, the United Kingdom, Switzerland, and Quebec, and for browsers that send a Global Privacy Control signal.
Location: United States and Google's global infrastructure

---

Note: Health Information stored in Dermi Atlas Professional remains on your local infrastructure and is never transmitted to these sub-processors. Health Information includes Canadian Personal Health Information, U.S. Protected Health Information, Australian "sensitive information" (including "health information") as defined under the Privacy Act 1988 (Cth) and applicable Australian state and territory health records legislation, New Zealand "health information" as defined by the Health Information Privacy Code 2020, and Swiss personal data concerning health.

Cross-Border Transfer Safeguards

All sub-processors listed above (with the exception of certain AWS infrastructure located in Canada and Stripe's Canadian affiliate) process personal information in the United States or, in the case of Apple, Cloudflare, and Google, on U.S.-based and global infrastructure as applicable. Dermi maintains written data processing agreements or equivalent contractual protections with each sub-processor where commercially available. These agreements require each sub-processor to maintain safeguards for personal information that are comparable to the protections required under PIPEDA, including obligations regarding data security, confidentiality, and incident notification.

For users in Australia, Dermi takes reasonable steps in accordance with Australian Privacy Principle 8.1 to ensure that overseas recipients of personal information handle that information in a manner consistent with the Australian Privacy Principles, and identifies Canada and the United States as the destination countries for such transfers.

For users in New Zealand, under section 11 of the Privacy Act 2020 (New Zealand), personal information held by a sub-processor solely as an agent on behalf of Dermi is treated as held by Dermi, the transfer is not a disclosure under Information Privacy Principle 12, and Dermi remains responsible for the security of the information. Where a sub-processor also uses personal information for its own purposes (such as Stripe, Apple, or Google), the disclosure is made on the basis that the recipient is required, including under its agreement with Dermi, to protect the information in a way that, overall, provides comparable safeguards to those in that Act.

For users in Switzerland, personal data is disclosed to recipients in Canada, a jurisdiction recognized by Switzerland as providing an adequate level of data protection for private-sector entities, and to sub-processors in the United States on the basis of certification under the Swiss-U.S. Data Privacy Framework or standard contractual clauses recognized by the Federal Data Protection and Information Commissioner, with the adaptations required for transfers subject to Swiss law, as applicable.

For users in Ukraine, Israel, the United Arab Emirates, and Singapore, account and billing information is transferred to and processed in Canada and the United States. The transfer relies on the following bases:

• Ukraine: The data subject's unambiguous consent, given at registration, and the necessity of the transfer for the performance of the contract, in accordance with Article 29 of the Law of Ukraine On Personal Data Protection (No. 2297-VI).
• Israel: The data subject's consent, given at registration, in accordance with regulation 2(1) of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to the extent those Regulations apply.
• United Arab Emirates: The data subject's consent, given at registration, and the necessity of the transfer for the performance of the contract, in accordance with Article 23 of Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data.
• Singapore: The necessity of the transfer for the performance of the contract, and the legally enforceable obligations that bind the sub-processors listed above that act on Dermi's behalf, in accordance with section 26 of the Personal Data Protection Act 2012 and the Personal Data Protection Regulations 2021.

For team member records provided by an account holder, the consent referred to above is obtained by the account holder before the member is invited, as provided in the Dermi Terms of Service.

Personal information processed in the United States is subject to U.S. jurisdiction, including lawful access by U.S. courts, law enforcement, or national security authorities.

Updates

Dermi will provide 30 days' notice of any new sub-processors on the Dermi website or by email. Objections may be sent to privacy@dermi.ai.

If an objection is raised, Dermi will respond within 15 business days with information about the measures taken to address the concern. If the objection cannot be resolved to your reasonable satisfaction, you may terminate your subscription and receive a pro-rata refund for any prepaid, unused portion of the subscription term.

Contact

Dermi Inc.
Attention: Privacy Officer
18 King Street East, Suite 1400
Toronto, ON M5C 1C4
Canada

Telephone: +1 647-600-3140
Privacy Inquiries: privacy@dermi.ai
General Inquiries: info@dermi.ai