SkulptAI Privacy Policy

Effective Date: January 4, 2026  |  Last Updated: March 2026

Your Privacy Matters. This Privacy Policy describes how eResonance (referred to as "we," "us," or "the Company") collects, uses, stores, and protects your information when you use the SkulptAI application. We prioritize your data privacy, especially concerning sensitive personal and biometric information.

Section 1

Data Collection

A. Personal Identifiable Information (PII)

Identity (Stripped) Sensitive

We collect your name, email, and user ID for account management. This data is stripped before any AI processing and is never sent to third-party AI services.

Precise Location (Stripped) Sensitive

We use your precise GPS coordinates only internally to fetch hyper-accurate environmental data. This data is immediately stripped and never shared with the AI.

B. Clinical and Contextual Data (Shared with AI)

User Profile

Age, sex, skin type, medical history, and goals.

Environmental Data

General location (city, country), UV Index, and Air Quality Index (AQI).

Skin Analysis Data

Metrics like IGA, CEA, Hydration scores, and skincare history.

C. Biometric and Image Data

Facial Images Sensitive

Images captured via the skin analysis function are used to calculate proprietary skin metrics. Images are temporarily processed and are never used for facial recognition, identification, or biometric profiling.

Important Disclosure: Face Data Collection & Use

When you use our skin analysis features, we process facial images as follows:

What We Capture

Quick Scan: A single photo using the front camera (with optional TrueDepth depth) or rear camera ("Scan a Friend" mode, 2D only — no LiDAR). 3D Scan: Short video segments using the front-facing TrueDepth camera for facial geometry analysis.

On-Device Processing

Facial landmark detection is performed locally on your device using Apple Vision and ARKit frameworks. No raw face geometry data is transmitted to any server.

AI Analysis

Images are temporarily sent to Google Gemini AI for skin texture analysis and skincare recommendations.

What We Don't Do

We never use face data for facial recognition, identification, authentication, or biometric profiling. We never sell face data to third parties.

Retention Period

Face images are NOT stored on our servers. Google's maximum retention is 48 hours for processing, after which images are automatically purged.

Your Control

You can delete all derived analysis data at any time through Settings → Delete My Data.

Section 2

The Core Privacy Guarantee: Data Stripping

Our application employs a mandatory PII Stripping mechanism before any data is ever sent to the external AI model (Google Gemini). This ensures your clinical data remains separate from your identity.

The app removes all direct PII (Name, Email, Precise GPS Coordinates) automatically.
The AI service only receives the non-identifiable context (Age, Skin Type, City, UV Index) needed for a safe and accurate recommendation.
Your identity and sensitive personal data never leave your device in an identifiable form.

Third-Party AI Processing Partner

We use Google Gemini AI to analyze skin images and provide personalized skincare recommendations.

Data Protection Guarantees

Paid API Tier: Your data is NOT used to train AI models.
No human review of your images for model improvement.
Data transmitted via encrypted TLS 1.3 connection.

Google's Data Retention

File uploads48 hours max
In-memory cache24 hours
Abuse monitoring~30 days
Section 3

Data Usage

Your data is used solely to provide and improve the App's core functionality:

Service Provision

To generate personalized skincare recommendations and daily insights.

Safety and Bias Mitigation

To ensure recommendations are safe for your specific Fitzpatrick skin type and medical history.

Service Improvement

Your de-identified, aggregated data may be used to improve the accuracy and fairness of our skin analysis algorithms.

Clinic Data Sharing (Optional)

You may optionally share your skin analysis data with dermatologists or skincare clinics. Sharing requires your explicit consent and generates a time-limited QR code. Clinics can only access data you choose to share, and all access is logged for your records.

Section 4

Data Storage and Security

Data Retention

Your data is retained as follows: Scan data for 2 years, routines for 1 year, clinical scans for 5 years (medical records), anonymized research data for 10 years. Data is automatically archived or deleted after these periods unless you request earlier deletion.

AI Vendor Data

As we only transmit PII-safe context, our AI vendor receives only anonymized, contextual data for analysis.

Image Handling

Facial images are processed for metrics. Raw images may be temporarily stored to generate these metrics, but they are protected by encryption and are not used for any other purpose.

Security Measures

Encryption at rest (AES-256) via Google Firebase
Encryption in transit via TLS 1.3
Sensitive credentials stored in iOS Keychain
App sandboxing and least-privilege access
Section 5

Your Rights

Under applicable data protection laws (including GDPR), you have the following rights:

Access

Request a copy of the personal data we hold about you.

Rectification

Request corrections to any inaccurate PII in your profile.

Erasure (Right to be Forgotten)

Request the deletion of your account and all associated data. This can be initiated within the App settings.

Opt-Out of Research

Request that your anonymized data not be used for future algorithm improvement.

Section 6

AI Data Sharing Consent

Before any data is sent to the AI service, SkulptAI displays an explicit consent dialog clearly identifying:

What data is sent: Skin scan results, age, sex, skin type, Fitzpatrick type, medical history (allergies, medications, conditions), lifestyle, skincare goals, and environmental context (city, UV index, air quality).
Who receives it: Google Gemini AI (paid API tier — data not used for model training).
What is NOT sent: Your name, email, photos, precise GPS coordinates, account ID, date of birth, and ethnicity are never transmitted to the AI service. All personal identifiers are stripped before transmission.
User control: You can revoke AI data sharing consent at any time in Settings → Data Privacy. If you decline, the app will continue to function without AI-powered recommendations.
Section 7

Volume Analysis Disclaimer

Our 3D volumetric analysis features use AI algorithms to estimate facial volume and detect potential filler artifacts. Please understand the following:

Volume analysis is provided for wellness self-monitoring purposes only.
Results are AI-estimated and not a substitute for professional medical assessment.
Filler detection is algorithmic and may not be 100% accurate.
Always consult a qualified healthcare professional for medical decisions.

Contact Us

For any privacy-related questions or to exercise your data rights:

info@eresonance.ch

eResonance  |  Zurich, Switzerland