Privacy Policy

Who We Are

DermLens AI is operated by Nexa Global Limited, a company incorporated in Abu Dhabi, United Arab Emirates.

Registered Address:
Smart Station, First Floor, Incubator Building
Masdar City, Abu Dhabi, United Arab Emirates

Contact: dermlensai@gmail.com

Nexa Global Limited is the data controller responsible for your personal data as described in this Privacy Policy. We are committed to protecting your privacy and handling your data transparently, lawfully, and securely.

Data We Collect

We collect only the data necessary to provide and improve the DermLens AI Service.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

2.3 Data from Third Parties

• Authentication providers (e.g. Google Sign-In): basic profile details such as name and email, shared only with your consent
• Analytics providers: aggregated, anonymised usage statistics

How We Use Your Data

We use your personal data only for the following purposes:

• Service Delivery: to analyse your skin photos using AI and provide personalised, non-medical skincare tips and over-the-counter product recommendations
• Account Management: to create, maintain, and secure your account
• Service Improvement: to understand how the App is used and to improve its accuracy, features, and user experience
• Customer Support: to respond to your queries, feedback, and support requests
• Legal Compliance: to meet our obligations under applicable UAE law and other regulations
• Safety & Security: to detect, prevent, and address fraud, abuse, or security threats
• Communications: to send you service-related updates or (with your consent) promotional content — you may unsubscribe at any time

We do not use your data for automated individual decision-making that produces significant legal or medical effects about you.

Facial Image & AI Processing

4.1 How Facial Images Are Processed

• Uploaded photographs are transmitted securely to our AI processing systems via encrypted connection
• The AI analyses visible skin characteristics such as hydration, texture, tone variation, and pore appearance
• Images are processed for the sole purpose of generating your educational skin analysis
• Processed images are not used to identify you or match you against other individuals

4.2 Storage of Facial Images

• Session use: images used for a one-off analysis are deleted from our active systems immediately after processing, unless you choose to save them
• Saved images: if you save results to your account, images are retained until you delete them or close your account
• We do not share facial images with third parties for advertising, profiling, or any non-service purpose

4.3 AI Accuracy Limitations

Our AI analysis is based on machine learning models and has inherent limitations. Accuracy may be affected by image quality, lighting, camera resolution, and skin tone. Results are educational estimates only and must not be used for medical purposes.

4.4 Third-Party AI Processors

We may use third-party AI service providers (such as cloud AI platforms) to power our analysis. These providers act as data processors under our instruction and are contractually bound to process your data only as directed by us, with appropriate security standards in place.

Legal Bases for Processing

Where GDPR or similar frameworks apply to you, we rely on the following legal bases:

You may withdraw consent at any time for consent-based processing by contacting us at dermlensai@gmail.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

Data Sharing & Disclosure

We may share your data only in the following limited circumstances:

• Service Providers: trusted third-party companies that help us operate the Service (cloud hosting, AI processing, analytics). These parties process data only on our instructions and are bound by data processing agreements
• Affiliate & Product Partners: anonymised, aggregated trend data only — never personal or identifiable data — may be shared with skincare brand partners for general market research
• Legal Requirements: where required by applicable UAE law, a court order, or to protect the rights, property, or safety of Nexa Global Limited, our users, or the public
• Business Transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you and ensure equivalent protections remain in place
• With Your Consent: in any other circumstance, only with your explicit prior consent

Third-Party Services

DermLens AI integrates with or may use the following categories of third-party services:

Each third party is subject to its own privacy policy. We encourage you to review their policies. We are not responsible for the privacy practices of third-party websites linked from within our App.

Data Retention

When data is no longer required, we securely delete or anonymise it. You may request early deletion at any time by contacting dermlensai@gmail.com.

Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures including:

• Encryption in transit: all data transmitted between your device and our servers uses TLS/SSL encryption
• Encryption at rest: stored data, including facial images, is encrypted at rest on our servers
• Access controls: strict role-based access controls limit employee access to personal data on a need-to-know basis
• Security assessments: we conduct regular security reviews and vulnerability assessments
• Secure infrastructure: we use reputable, ISO-certified cloud platforms with industry-standard security credentials

Despite these measures, no internet transmission or digital storage system is 100% secure. We cannot guarantee absolute security, but we are committed to prompt action in the event of a suspected data breach. Where required by law, we will notify affected users and relevant authorities without undue delay.

Your Rights

Depending on your location, you have the following rights regarding your personal data. To exercise any of these rights, contact us at dermlensai@gmail.com. We will respond within 30 days.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with your local data protection authority. For UAE residents, this is the UAE Data Office.

International Data Transfers

DermLens AI is operated from Abu Dhabi, UAE. Your data may be processed by our service providers in other countries, including those in the European Economic Area, the United States, or elsewhere.

Where personal data is transferred outside the UAE or EEA, we ensure that appropriate safeguards are in place, such as:

• Standard contractual clauses approved by relevant data protection authorities
• Data processing agreements with our service providers requiring equivalent protections
• Transfers only to providers operating in countries with adequate data protection standards

You may request details of the safeguards we use for international transfers by contacting dermlensai@gmail.com.

Children's Privacy

DermLens AI is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. Users between the ages of 13 and 17 must use the Service under parental or guardian supervision.

For users in the European Economic Area, the minimum age is 16 years (or the applicable age of digital consent in your country), unless verifiable parental consent is provided.

If you believe we have inadvertently collected data from a child under 13, please contact us immediately at dermlensai@gmail.com and we will delete the information promptly.

Cookies & Tracking Technologies

DermLens AI is a Progressive Web Application (PWA) and uses the following technologies:

You can manage cookie preferences through your browser settings at any time. Disabling non-essential cookies will not affect core App functionality.

Jurisdiction-Specific Rights

UAE Residents — UAE PDPL

As a UAE-based company, we comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). UAE residents have the right to access, correct, and request deletion of their personal data, and to object to processing. Contact us at dermlensai@gmail.com to exercise these rights.

EEA / UK Residents — GDPR

If you are located in the European Economic Area or United Kingdom, you have enhanced rights under the General Data Protection Regulation (GDPR) or UK GDPR, including all rights listed in Section 10. Where we process your data, we do so on the legal bases set out in Section 5. You may lodge a complaint with your national data protection authority if you believe your rights have been violated.

California Residents — CCPA

California residents have rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information is collected and how it is used
• The right to delete personal information we hold about you
• The right to opt out of the sale of personal information — we do not sell personal information
• The right to non-discrimination for exercising your privacy rights

To submit a CCPA request, email dermlensai@gmail.com with the subject line "CCPA Privacy Request".

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the Effective Date at the top of this page
• Display a prominent notice within the App
• Where reasonably practicable, notify registered users by email

We encourage you to review this Policy periodically. Continued use of the Service after the updated effective date constitutes your acceptance of the revised Policy.