Privacy Policy

Dear User,

The protection of your personal data is not only important to you, but also to us, SkinTech Corp. GmbH as the controller of the web app and mobile app “SQIN.co” (hereinafter “we,” “us”). We greatly value your trust in our careful and legally compliant handling of your data. Your data will be treated with strict confidentiality.

With this Privacy Notice, we not only aim to fulfill our legal obligations under Art. 13 and 14 GDPR, but also to provide you with a transparent and comprehensible explanation of which personal data is processed when using our app, web app, and website – and how we handle this data.

Comprehensive Privacy Policy for SQIN.co

Privacy Policy for SQIN.co (integrated updated version)
Comprehensive Privacy Policy for SQIN.co
Privacy Policy for IQONIC.ai

IQONIC.ai is operated by SkinTech Corp. GmbH, Zimmerstraße 50, 10117 Berlin (“IQONIC.ai,” “we”). This privacy policy informs you about the processing of personal data in accordance with the GDPR.

1. Controller
The controller responsible for data processing is:
SkinTech Corp. GmbH
Zimmerstraße 50
10117 Berlin
E-mail: info@iqonic.ai

2. Data Protection Officer
Our Data Protection Officer can be reached at info@iqonic.ai.

3. Purposes and Legal Bases of Processing
We process personal data for the provision and improvement of our services, for user guidance, contract fulfillment, marketing optimization, and – based on your consent – for research and development purposes in the field of skin, hair, and health analysis.

4. Research and Development (R&D)
With explicit consent pursuant to Art. 9 (2) (a) GDPR, we process health and diagnostic data such as skin images, hair data, medical history forms, vital data (HealthKit/Google Fit), diagnostic scores, usage interactions, and pseudonymized metadata. The purpose is to train and further develop AI-based analysis and recommendation systems. Deletion or anonymization takes place after a maximum of 24 months. External partners (e.g., dermatologists, AI training providers) only receive pseudonymized data within the framework of contractual agreements.

5. Disclosure to Third Parties and Third-Country Transfers
We use, among others, Google Analytics, Firebase, Adjust, Smartlook, Meta, TikTok, Pinterest, LinkedIn, HubSpot, SendGrid, Zendesk, and Amplitude. Some data is transferred to third countries (in particular the USA), secured by EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

6. Rights of Data Subjects
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), objection (Art. 21), data portability (Art. 20), as well as the right to withdraw consent given (Art. 7 (3) GDPR).

7. Storage Period
Data is stored only as long as it is required for the stated purposes. Research data is processed in pseudonymized form and anonymized or deleted after a maximum of 24 months.

8. Changes to this Policy
We reserve the right to amend this privacy policy. The current version is always available at https://www.iqonic.ai/privacy.

Previous version of the privacy policy (as of July 2024)
Privacy Policy IQONIC.ai and SQIN

As of: July 2024 – We reserve the right to amend this privacy policy.

Data protection is a core value of SkinTech Corp. GmbH. We strive to make this topic as transparent as possible and to clearly explain for which purposes and in what way the relevant data is used. User data is handled responsibly and is only used within the framework of the applicable data protection laws, in particular the EU General Data Protection Regulation (EU GDPR).

In particular, we aim to continuously improve IQONIC, the SQIN app, and all related offerings and services, and to better tailor them to the needs of our users. However, this can only succeed if we observe and evaluate how these offerings and services are being used. The following provides users with comprehensive information on what happens to their data – especially what, how, and why it happens. All information that must be provided in accordance with the EU GDPR is also listed here.

The entity responsible for protecting personal data and ensuring compliance with the EU GDPR is SkinTech Corp. GmbH, Zimmerstraße 50, 10117 Berlin (hereinafter referred to as “IQONIC,” “SQIN,” or the “Provider”). It operates the services mentioned above. Further contact details, responsible persons, and mandatory company information regarding SkinTech Corp. GmbH can be found in the imprint or viewed on the website as well as within the SQIN app.

If you have questions about data protection or wish to exercise your data protection rights (see below), you can contact the Data Protection Officer of SkinTech Corp. GmbH. The officer can be reached at the e-mail address provided or by postal mail at SkinTech Corp. GmbH, Zimmerstraße 50, 10117 Berlin.

This Privacy Policy applies to all online offerings and services accessible under the “SQIN” and “IQONIC” brands: the SQIN website under the domain sqin.co, the IQONIC website under the domain iqonic.ai, as well as other domains pointing to these.

The aforementioned offerings and services are hereinafter referred to collectively as “Services.”

Key Points at a Glance
I. Which data is collected when using the SQIN and IQONIC services?
II. Why is this data processed?
III. Are data shared with third parties or transferred outside the EU?
► User rights as a data subject
► Individual data processing activities in detail
- A. Data processing for the provision of SQIN App services
  – Registering a user account and managing a profile (with e-mail address)
  – Contact forms and support requests (via e-mail service provider)
  – HealthKit and Google Fit integration
  – (other) cookie-based functionalities
- B. Improvement of SQIN and IQONIC services
  – Storage and processing of usage data (via GF)
  – Evaluation of usage behavior on websites and in the app (via Google Analytics)
  – Evaluation of usage behavior within the mobile application (via Google Analytics for Firebase)
  – Evaluation of user behavior in SQIN services (via Smartlook)
- C. Optimization of communication and marketing channels
  – Marketing campaigns with custom audiences (via Facebook Pixel or custom app events via Facebook SDK)
  – Marketing optimization and evaluation of usage behavior in the SQIN App (via Adjust)
► Changes to the Privacy Policy
► User rights overview
► Contact for data protection & Data Protection Officer

Key Points at a Glance

I. Which data is collected when using the SQIN and IQONIC services?

Direct entry of personal data. When users log into SQIN and IQONIC systems, register, purchase premium content, or use a contact form for support requests, the Provider asks them to provide personal data that is directly linked to their identity (“personal data”).

This includes, in particular, name, salutation, e-mail address, and password. For paid services, the Provider may also request additional contact details (postal address, phone number) and, if applicable, shopping cart details and payment data. Users may also voluntarily provide further personal information, e.g. in their user profile, which will then also be stored.

There are no services or offers specifically directed at children.

Data enrichment. The Provider may enrich user data with its own observations, but only with regard to assumed interests and only as described in this privacy notice. Example: If a user starts a session, the Provider may assume an interest in continuing it and enrich the dataset accordingly to remind the user in the app.

Data provision by third parties. In some cases, personal data is also provided to the Provider by third parties, e.g. when users log into the SQIN service using a sign-in service such as Facebook.

Pseudonymized data. In addition, data is processed that does not have a directly identifiable link to the user (“pseudonymized data”). This means that users, their computers, or browsers can be recognized under an ID (“pseudonym”), but their exact identity cannot be determined with reasonable means. Importantly, pseudonyms are not combined with personal identifiers such as name or e-mail address, as in these cases we do not need to know more than necessary.

For example, this applies when the Provider wants to know which screens in SQIN or IQONIC services are clicked most often, or when it wishes to avoid always showing the user the same content.

Further details on specific processes are provided in the chapter “Individual Data Processing Activities in Detail.”

II. Why is this data processed?

The processing of personal data takes place in particular for the following purposes and based on the following legitimate interests:

Personalization: to display user progress, to suggest SQIN App and IQONIC content that best fits user needs, or to inform users via e-mail or push notifications about relevant content, tips, and offers.
Optimization: to identify what users particularly enjoy or dislike and to improve the services accordingly; to achieve defined goals.
Operational security: to detect and repel attack patterns and identify system errors; to prevent users from receiving unwanted e-mails.
Financing: to process premium content purchases or provide users with personalized discounts, vouchers, and offers.
Customer relationship & direct marketing: to inform users about new offers and functions.
Fraud prevention: to verify delivery addresses and conduct credit checks, which may influence which payment options are offered.
Legal compliance: to meet commercial and tax obligations, provide information to authorities, and assert or defend legal claims.

The processing of personal data is carried out lawfully on the basis of the EU GDPR – depending on the case – on the basis of user consent, contractual necessity, compliance with legal/official requirements, and/or a balancing of legitimate interests (see GDPR Art. 6 (1) (a), (b), (c), and (f)).

Where processing is based on consent or a balancing of legitimate interests, it is only carried out as long as the user does not object or withdraw consent. More details are provided further below.

III. Are data shared with third parties or transferred outside the EU?

SQIN and IQONIC do not engage in commercial disclosure (sale, rental) of personal user data to third parties and do not trade addresses.

However, the Provider does rely on certain service providers. Some of these providers may need to access personal data. This applies in particular to the technology used to operate, monitor, and analyze services, as well as billing and debt collection.

All service providers are commissioned strictly in accordance with the GDPR, in writing, and are required to implement technical and organizational measures to protect entrusted data. Where necessary, data processing agreements are concluded.

Some IT service providers commissioned by the Provider are located outside the EU/EEA or store and process personal data there. Where the EU Commission does not consider these regions to provide an equivalent level of protection, the Provider requires the legally necessary safeguards for such transfers – usually EU Standard Contractual Clauses.

In some cases, data is also passed on to third parties that process it independently, e.g. Facebook when a user registers with Facebook Sign-In. Further details can be found in the next chapter.

► System Permissions

Access to your camera is required to create anamnesis images and is only used for this purpose by SQIN and IQONIC.
If you wish to upload images from your gallery, SQIN and IQONIC will require access to your device storage.
Consent to receive push notifications about status updates to your treatment is optional. Without consent, you will not receive such notifications.
When using our services on iOS devices, we may request permission to track your activities for user behavior analysis (see “Processing in connection with Apple Search Ads”). This allows us to target ads and evaluate actions triggered by ads.

► User Rights as a Data Subject
Under the EU GDPR, users have the right to access their personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), or restriction of processing (Art. 18).

Users also have the right to data portability (Art. 20), the right to withdraw consent at any time (Art. 7), and the right to object to processing based on legitimate interests (Art. 21 (4)). In addition, users have the right to lodge a complaint with the competent data protection authority.

If you have any questions about this or about data protection in general, or if you wish to exercise your rights, you can contact our Data Protection Officer at the e-mail address provided or by mail at:
SkinTech Corp. GmbH, Zimmerstraße 50, 10117 Berlin.

► Individual Data Processing Activities in Detail

To provide users with an easier overview, this Privacy Policy is structured according to whether it concerns (A) the basic provision of services and functionalities of SQIN and IQONIC, (B) the optimization of our services, or (C) the optimization of our marketing activities.

Data Processing for the Provision of SQIN and IQONIC Services

The following explains details regarding individual areas, services, and functionalities for the provision of the SQIN and IQONIC mobile applications.

Registering a User Account and Managing a Profile (with E-Mail Address)

When registering for SQIN and IQONIC Services, users are asked to provide, among other things, name, gender, interests, and goals. Registration additionally requires providing an e-mail address, which is used to create a user account. Upon registration, the user receives a confirmation e-mail to complete the registration process. In the case of direct login, a confirmation link is sent once to the specified e-mail address for verification.

This ensures that the Provider uses the correct e-mail address in subsequent communication and that the user can be correctly assigned to their user account. After successful login, an authorization token is stored in the app. This token is deleted from the smartphone when the user logs out of the account via the logout function. This authorization method prevents local storage of login data on the smartphone.

Beyond that, the app only collects user data provided during registration, login, or other contact with the app. These data are processed based on the user’s consent (see GDPR Art. 6 (1) (a)).

The Provider creates a user profile from these personal data to provide the basic functionalities of the services across different platforms (iOS, WebApp, Android). Processing of these data is thus necessary for the fulfillment of contractual obligations under GDPR Art. 6 (1) (b).

In addition, the Provider also uses certain account data for other purposes, e.g., newsletters or push notifications, orders, and support requests. Further details are provided in the respective sections below.

For the storage of these data, the Provider uses an IT service provider, namely Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“GF”).

SQIN and IQONIC have concluded a data processing agreement with GF. GF stores and processes personal data strictly in accordance with the Provider’s instructions, including outside the EU/EEA, in particular in the USA. Processing in the USA is carried out based on EU Standard Contractual Clauses.

Withdrawal / Opt-Out Option: The user may delete their profile and all associated personal data at any time by sending a withdrawal request to the Provider. The Provider will then forward this withdrawal to GF, which is contractually obligated to delete the data.

In addition, the Provider deletes the user’s account if it has not been actively used for a period of three years. If, at the time of deletion, data linked to the account is still required for purposes not yet expired, these records will be restricted to specific processing purposes instead of being deleted. This particularly applies to legally mandatory retention obligations, e.g., under commercial and tax law. Such retention periods can last up to 10 years (§ 147 (3) German Fiscal Code).

Data Processing During System Installation

Purposes
When you install our system or later access the app, data is processed for an API call log during installation and with each access. This processing takes place for the following purposes:

Enabling use of the app,
System security,
Technical administration of network infrastructure,
Evaluation of system security and stability,
Ensuring a smooth connection setup.

These data are not matched with other datasets, nor are they used to draw conclusions about your identity.

Data Types
During installation and each access, the following data are collected and stored until automated deletion after 30 days:

Date and time of installation,
Date and time of access,
Name and URL of the retrieved file or page,
Transferred data volume,
Access status (successful transfer, file not found, etc.),
Browser and operating system of the user’s device,
Name of the user’s internet access provider.

Legal Basis
The legal basis for this processing is the performance of the usage contract in accordance with Art. 6 (1) (b) GDPR.

Necessity
Provision of our app is necessary for the fulfillment of your usage contract with us. If you do not install or access the app, you cannot use it.

Storage Period
Data processed during installation or each access are automatically deleted after 30 days.

Recipients
We use a server located in Germany for providing the app’s database and storing your doubly encrypted patient record.

Right to Object
Pursuant to Art. 21 GDPR, you have the right to object to the above processing of your personal data if reasons arise from your particular situation or if your objection is directed against direct marketing.

Data Processing with Adjust

Purposes
We use Adjust to analyze your interactions with our system, to further develop it, and make it more user-friendly.

We also use Adjust for attribution, to improve our mobile advertising campaigns. Attribution analyzes where you last interacted with advertising content of SkinTech Corp. GmbH (e.g., ad, article, or social media post). We evaluate whether you viewed an ad, clicked a link, or left a comment.

Data Types
Upon your consent to the analysis of your usage behavior (“marketing analysis”) by Adjust, the following data are processed:

Time of access,
Whether you are a returning user,
Location of access,
Demographic data,
Device language, model, and platform (e.g., iOS or Android),
IDFA (Identifier for Advertising, for iOS devices) or Android Advertising ID,
IP address,
MAC address.

Demographic data include information about the website, advertisement, or social media page that referred you to our system. This helps estimate your age group and location.

Upon your consent, the following data are also transmitted to Google Analytics for further user and advertising analysis:

Time of access,
Location of access,
Whether you are actively using the system,
Whether you are a returning user,
Device language, model, and platform.

Before processing, these data are anonymized so that you can no longer be identified.

You can reset or disable the IDFA or Android Advertising ID at any time via your operating system.

Legal Basis
The legal basis for using Adjust is your explicit consent pursuant to Art. 6 (1) (a) GDPR.

Storage Period
The above data are deleted after 14 months.

Recipients
Your health data are never shared with the recipients listed below.

The personal data processed by Adjust are processed by Adjust GmbH, Saarbrücker Str. 38a, 10405 Berlin.

Data collected via Adjust are also transmitted to Google Analytics. These are processed on servers of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and transferred to the USA. Google acts as our processor under Art. 28 GDPR, and we have concluded a data processing agreement with Google. The legal basis for transfer to third countries is the use of EU Standard Contractual Clauses (Art. 46 GDPR). Google provides appropriate safeguards, available here: [link].

More information on Google’s handling of data in connection with Google Analytics can be found in Google’s Privacy Policy: [link].

Right to Withdraw Consent
You have the right to withdraw your consent at any time. Withdrawal of consent for processing via Google Analytics can be carried out in our system under Menu > Edit Account > Marketing Analysis by deactivating “Marketing Analysis.” The lawfulness of processing carried out before withdrawal remains unaffected.

Contact Forms and Support Requests (via E-Mail Service Provider)

If the user contacts SQIN or IQONIC services, the Provider’s e-mail service provider – Google, represented by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – processes the contact details as well as the content of the request.

Requests via e-mail and contact form may involve communications and contract data as well as user history. In addition, inquiries regarding the Provider’s apps that are submitted via the app store’s contact form are received by the Provider by e-mail. The data provided will be treated confidentially. The data provided and the message history with the Provider’s customer service are stored for follow-up questions and future contact.
Insofar as the user contacts the Provider by e-mail or via a form, the Provider uses the personal data transmitted by the user on the basis of legitimate interests, exclusively to answer the user’s inquiry.
SQIN and IQONIC have concluded a data processing agreement with Google Ireland for processing data on their behalf. Google Ireland stores and processes personal data strictly in accordance with the Provider’s instructions. This may also take place outside the territory of the EU or the EEA, in particular in the USA. Where processing takes place in the USA, it is carried out on the basis of the EU Standard Contractual Clauses. Requests for deletion of the user profile and newsletter unsubscribe requests submitted via our contact channels are stored by the Provider in its in-house systems to be able to trace and demonstrate that the user’s request was successfully processed (accountability obligation). The users’ data (e-mail address, name, and username) are deleted from the Provider’s system no later than one year and one month thereafter. In the case of newsletter deletion requests, a connection to the user’s account can be established via the in-house system if the request concerns the user’s registration address. In the case of requests to delete a user account, no link to the user’s account can be established. The data are stored in the system protected against unauthorized access and are not passed on to third parties.
Withdrawal / Opt-Out option: Customer inquiries from the user are deleted after 5 years or upon direct withdrawal to .
If and to the extent that data associated with users’ e-mail inquiries can still be used and must still be used for purposes that have not yet expired at the time of the intended deletion, the data records will be blocked or restricted to certain processing purposes instead of being deleted. This is particularly the case for legally mandatory retention obligations, such as under applicable commercial and tax regulations. These can be up to 10 years (see Section 147 (3) of the German Fiscal Code).

Data Processing in AI-Supported Processes
Purposes
If, when registering your user account or in your account settings, you have consented to processing in connection with the research of AI-supported teledermatological assessment, we use the photos you upload and the medical history questionnaires you complete to research an artificial intelligence that can support teledermatological assessment. This can help skin diseases be recognized faster and more effectively, enabling future patients to receive quicker and better assistance. We thank you for your support and trust if you consent to this processing. Your data will not be disclosed to third parties, but will be processed under strict confidentiality and the highest security requirements by an experienced IT laboratory commissioned by us for research purposes. Your data are processed exclusively in Germany.
Data Types
For the research of an AI-supported teledermatological assessment, we process the photographs you upload and the medical history questionnaires you complete.
Legal Basis
The legal basis for this processing is your consent pursuant to Art. 9 (2) (a) GDPR.
Storage Period
We use the above data relating to you for the research of an AI-supported teledermatological assessment until you withdraw your consent.
Recipients
We use a server located in Germany to provide the database of our app and to store your doubly encrypted patient record.
The research of an AI-supported teledermatological assessment takes place exclusively in Germany under strict confidentiality and the highest security requirements in an IT laboratory specialized in AI research.
Your Right to Withdraw Consent
You have the right to withdraw your consent to the processing of the above data for the purpose of researching an AI-supported teledermatological assessment. You can do this by logging into our system and deactivating “Product Development” in the account settings under “Product Development.” The lawfulness of processing carried out on the basis of your consent before withdrawal remains unaffected.

Data Processing for Newsletters
Purposes
Our newsletters are intended to provide you, in addition to news from SQIN and IQONIC, with recommendations and information in the field of skin analysis as well as on everyday life topics.
Data Types
Providing an e-mail address is sufficient to receive the newsletter. We process the time of your newsletter sign-up and the IP address entered by your Internet Service Provider (ISP), which we convert into an anonymized user identifier. This serves to determine if someone has misused your e-mail address to sign up for the newsletter.
Legal Basis
The legal basis for this processing is your consent pursuant to Art. 6 (1) (a) GDPR.
Storage Period
We use your e-mail address to send our newsletter until you withdraw your consent.
To fulfill our accountability obligation under data protection law pursuant to Art. 5 (2) GDPR, we retain a deletion log of the removal of your e-mail address for up to three years. The legal basis for this is compliance with our legal obligation pursuant to Art. 6 (1) (c) GDPR.
Recipients
We use a German processor with servers located in Germany to provide our e-mail server.
We use a server located in Germany to provide our system database.
As part of our newsletter delivery, we analyze your user behavior. This evaluation serves the needs-based design and continuous optimization of our newsletter.
Data Types
The following data types are processed:
– E-mail reading and click behavior (open rate and click-through rate within the newsletter),
– The type of device used (desktop, tablet, mobile phone),
– Whether you are a user or patient of our system,
– The time and date of your access to specific newsletter e-mails,
– Number of cases submitted in the system,
– The redirect URL (i.e., which websites linked in the newsletter you open via the newsletter).
Legal Basis
The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in providing you with an effective and user-friendly newsletter (i.e., personalized direct marketing).
Storage Period
We store the above data until you withdraw your consent, i.e., unsubscribe from our newsletter.
To fulfill our accountability obligation under data protection law pursuant to Art. 5 (2) GDPR, we retain a deletion log of the removal of your e-mail address for up to three years. The legal basis for this is compliance with our legal obligation pursuant to Art. 6 (1) (c) GDPR.
Recipients
We use a German processor with servers located in Germany to provide our e-mail server.
We use a server located in Germany to provide our app’s database.
Your Right to Object
Pursuant to Art. 21 GDPR, you have the right to object to the above processing of your personal data if reasons arise from your particular situation or if your objection is directed against direct marketing.

Data Processing for Review Requests
Purposes
To ask our existing customers for reviews, you will receive a one-time review request from us after each treatment. This serves to improve our services based on your evaluation.
Data Types
For sending the review request, we process your e-mail address that you provided when registering in our “SQIN” system and the IQONIC services.
Legal Basis
The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in improving our service based on your review, i.e., carrying out personalized direct marketing.
Storage Period

We use your e-mail address to send our review requests until you object to our use of your e-mail address for the purpose of sending direct marketing.
In the event of deletion of your user account, we delete your e-mail address and no further direct marketing will be sent to you.

Recipients
We use a server located in Germany to provide the database of our app and to store your doubly encrypted patient record.

Data Processing for Direct Mailings

Purposes
To keep our existing customers informed about our offers and services, to provide them with valuable content, and to request reviews, you will regularly receive an information letter from us. In this context, we analyze your user behavior. This analysis serves to tailor the information letters to your needs and to continuously optimize both our mailings and our services.

Data Types
The following data types are processed:
– E-mail reading and click behavior (open and click rates within the customer information letters),
– The type of device used (desktop, tablet, mobile phone),
– Whether you are a user or patient of our system,
– The time and date of access to newsletter e-mails,
– The redirect URL (i.e., which websites linked in the information letters you open).

Legal Basis
The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in carrying out personalized direct marketing.

Storage Period
We remove your e-mail address from our direct marketing distribution list once you object to our use of your e-mail address for this purpose.
To comply with our accountability obligation under data protection law pursuant to Art. 5 (2) GDPR, we retain a deletion log of the removal of your e-mail address for up to three years. The legal basis for this is compliance with our legal obligation under Art. 6 (1) (c) GDPR.

Recipients
We use a German processor with servers located in Germany to provide our e-mail server.
We use a server located in Germany to provide the database of our system.

Your Right to Object
Pursuant to Art. 21 GDPR, you have the right to object to the above-described processing of your personal data if reasons arise from your particular situation or if your objection is directed against direct marketing.

Data Processing via Contact Form

Purposes
Through our contact form within the system, you can contact us at any time if you have questions about the use of our system, while logged into your user account.

Data Types
As part of your inquiry, we process your user ID, your case ID, and the content of your request. Further details may be provided voluntarily.

Necessity
Processing your user ID and, where applicable, case ID is necessary for handling your inquiry and assigning it to your patient record. If you submit your inquiry via the system’s contact form, this information is automatically transmitted to us.

Recipients
We use a server located in Germany to provide our app.

Contact by Phone or E-Mail

Purposes
Via the e-mail addresses and telephone numbers listed on our website, you may contact us. Do not use this communication channel to transmit health data to us.

Data Types
To handle your inquiry, we use the e-mail address or telephone number you provide. Further information is only collected directly from you if it is necessary and relevant for answering your inquiry and you provide it voluntarily.
Do not use this communication channel to transmit health data to us.

Legal Basis
Processing for the purpose of contacting us is carried out to perform a contract with you or to take pre-contractual measures at your request pursuant to Art. 6 (1) (b) GDPR.

Necessity
Processing your e-mail address or telephone number is necessary for handling your inquiry and to enable us to contact you in this context. If you do not provide this data, we cannot process your inquiry.

Storage Period
If contact takes place in the context of a treatment contract, we retain your information as part of your patient record for ten years in accordance with §§ 630a ff. German Civil Code (BGB). Otherwise, the data you provide are deleted once your inquiry has been resolved.

Recipients
We use a German processor with servers located in Germany to provide our e-mail server.

Data Processing in Connection with Meta

Purposes
We use Facebook Pixel for advertising purposes and to optimize our campaigns. We use this tool to display ads on Facebook and Instagram to people who have visited our website or shown interest in certain topics. By analyzing your user behavior, we evaluate the effectiveness of our Facebook and Instagram campaigns and adapt them to user interests.
Through our use of Facebook Pixel, Facebook is informed when you click on one of our ads on Facebook or access the corresponding page of our website.
Facebook provides us with the collected data in anonymized form so that we cannot personally identify you or draw conclusions about your identity.

Data Types
If you consent to marketing analysis within our system, the following data about you will be collected:
– Your access time and location to our system,
– Whether you are actively using our system,
– Whether you are a returning user of our apps,
– Your demographic data (gender, age group, interests),
– The language, device model, and device type you use (e.g., iOS or Android).

If you have a Facebook or Instagram account, these data will be linked to your respective account.
If you do not have a Facebook account, Facebook stores your IP address and other identifying characteristics.

Legal Basis
The legal basis for this processing is your explicit consent pursuant to Art. 6 (1) (a) GDPR. You provide this consent via our cookie banner by selecting and agreeing to the category “Marketing Analysis.”

Storage Period
The storage period is limited to 24 months.

Recipients
Facebook Pixel is a product of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). Facebook acts as our processor, and we have concluded a data processing agreement pursuant to Art. 28 GDPR with Facebook. The legal basis for this transfer is the EU Standard Contractual Clauses under Art. 46 GDPR. Information on the appropriate or suitable safeguards Facebook provides for third-country transfers can be found here [link] and here [link].

Your Right to Withdraw Consent
You can withdraw your consent to processing for user behavior analysis in our web app under Settings > Marketing Analysis by deactivating the “Marketing Analysis” function. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Data Processing in Connection with TikTok

Purposes
We use TikTok Pixel, a service of TikTok Technology Ltd., to show you ads on TikTok when you have shown interest in our services as a TikTok user. TikTok Pixel enables the definition of target groups for displaying ads. By analyzing your user behavior, we evaluate the effectiveness of our TikTok campaigns and adapt them to user interests.

Data Types
The following data types are processed as part of advertising on TikTok:
– Your user behavior, if you have visited TikTok’s platform or are a TikTok user, including:
• The number of our ads you have viewed and your clicks on our ads,
• Events triggered in our system (e.g., registration, creation of cases, payment for diagnoses),
• Information about your operating system and device ID,
• Anonymized, aggregated data for creating custom audiences if you have shown interest in our services.

We process information on triggered events (registration, case creation, purchase) in our system only if you have consented to processing for “marketing analysis” within our app.
If you have a TikTok account and have consented to personalized advertising in your TikTok account, TikTok will transmit your location and gender to us if provided during your TikTok registration.

Legal Basis
If you have consented to processing for “marketing analysis” within the system, the legal basis for this processing is your consent pursuant to Art. 6 (1) (a) GDPR.

Storage Period
The personal data processed in the context of advertising are deleted after 18 months.

Recipients

The above-mentioned personal data relating to you are processed on our behalf by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”). The above-mentioned personal data relating to you are transferred to the USA. For this purpose, we have concluded a data processing agreement pursuant to Art. 28 (3) GDPR including Standard Contractual Clauses pursuant to Art. 46 GDPR with TikTok Technology Limited as part of the terms of use.
Information on the appropriate or suitable safeguards TikTok provides for third-country transfers can be found here [link] and here [link].

Your Right to Withdraw Consent
You have the right to withdraw your consent at any time. Withdrawal of your consent to processing activities for user behavior analysis is possible within our system under Menu > Edit Account > Marketing Analysis by deactivating the “Marketing Analysis” function. The lawfulness of processing carried out on the basis of your consent before its withdrawal remains unaffected.

Data Processing in Connection with Social Media Plugins

Purposes
Social Media Plugins are extensions for external sites, i.e., modules integrated into our websites that allow you, by clicking, to directly access the corresponding social network profile. We use Social Plugins on our website from Instagram (part of Facebook Ltd.) and TikTok to make the content of our website more informative and interesting for you.

Data Types
If you access a page containing an embedded video or a social plugin and have given consent to processing in “Other Media” within the consent banner, a connection is established to the servers of Facebook and TikTok. The following data types are processed about you:
– The browser you use,
– The IP address of your device,
– The page of this website you visited,
– The content displayed to you,
– The language, device model, and platform (e.g., iOS or Android) of your device.

Legal Basis
The legal basis for this processing is your consent to processing in “Other Media” pursuant to Art. 6 (1) (a) GDPR.

Storage Period
The above-mentioned personal data relating to you are stored for 24 months.

Recipients
We use a web host with servers located in Germany to provide our website.

Facebook Pixel is a product of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). Facebook acts as our processor, and we have concluded a data processing agreement pursuant to Art. 28 GDPR with Facebook. The legal basis for this transfer is the EU Standard Contractual Clauses pursuant to Art. 46 GDPR. Information on the appropriate or suitable safeguards Facebook provides for third-country transfers can be found here [link] and here [link].

The above-mentioned personal data relating to you are processed on our behalf by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok”). These personal data are transferred to the USA. For this purpose, we have concluded a data processing agreement pursuant to Art. 28 (3) GDPR including Standard Contractual Clauses pursuant to Art. 46 GDPR with TikTok Technology Limited.
Information on the appropriate or suitable safeguards TikTok provides for third-country transfers can be found here [link] and here [link].

Your Right to Withdraw Consent
You have the right to withdraw your consent at any time. The lawfulness of processing carried out on the basis of your consent before its withdrawal remains unaffected.

Data Processing in Connection with Pinterest

Purposes
We use the Pinterest Tag, a service of Pinterest Europe Ltd., to tailor our Pinterest campaigns, further optimize them, and measure their success. If you arrive at our website via a Pinterest ad, we can track your subsequent actions. By analyzing your user behavior, we evaluate the effectiveness of our Pinterest campaigns and adapt them to the interests of our users.

Data Types
If you consent to the analysis of your user behavior within our system (i.e., “Marketing Analysis”), the following data are also processed:
– Your last ad view (relevant for conversions),
– The number of ads you viewed and your clicks on our ads (frequency),
– Your access time and location when using our system,
– Whether you are actively using our system,
– Whether you are a returning user of our system,
– Events you triggered within the system (e.g., registration, case creation, payment for cases you created),
– The language, device type, and operating system (e.g., iOS or Android) of your device,
– Demographic data (gender, age, interests).

We receive the above-mentioned data on the last ad view and the number of viewed and clicked ads per placement from Pinterest in the form of statistical evaluations. This means we receive information on how many users clicked on our ads and were redirected to the App or Play Store.

Legal Basis
The legal basis for this processing is your consent to processing for marketing analysis pursuant to Art. 6 (1) (a) GDPR, provided you have given this when registering your account or via account management.

Storage Period
The personal data processed in connection with the advertising are deleted after 180 days.

Recipients
The above-mentioned personal data relating to you are processed on our behalf by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). These personal data are transferred to the USA. For this purpose, we have concluded a data processing agreement pursuant to Art. 28 (3) GDPR including Standard Contractual Clauses pursuant to Art. 46 GDPR with Pinterest.
Information on the appropriate or suitable safeguards Pinterest provides for third-country transfers can be found here [link].

Data Processing in Connection with YouTube

Purpose
To optimize our website, we embed videos from YouTube.

Data Types
If you access a page that contains an embedded video, a connection to YouTube’s servers is established. The following data types are processed about you:
– The browser you use,
– The page of this website you visited,
– Device-specific information including the IP address of your device,
– The content displayed to you from YouTube.

We use the “enhanced privacy mode” option provided by YouTube. According to YouTube, in “enhanced privacy mode,” the above-mentioned data are only transmitted to YouTube’s servers in the USA if you watch the video.

Legal Basis
The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in supplementing our offering with dermatological information for you.

Storage Period

On the one hand, the Provider uses Google Analytics for Firebase to optimize system functionalities and designs in so-called A/B tests. In such tests, the original version of the system is tested against a slightly modified version. The Provider then analyzes how well the new function is received compared to the previous version. In this way, the Provider can continuously improve the design and functionalities of the system and increase user-friendliness. To collect these comparative data, Google Analytics for Firebase processes users’ usage data in our system.

The Provider uses Google Analytics for Firebase services under the EU General Data Protection Regulation due to its interest in making the system as user-friendly as possible for users and thereby optimizing the user experience. Furthermore, the Provider can use Google Analytics for Firebase to evaluate user behavior in the system and better understand how users use the services and what improvements can be made. In doing so, Google Analytics for Firebase processes user data such as the IP address, demographic characteristics of users, technical data about the mobile device used and the installed software version, and usage data such as the number of accesses to the system and actions within the system (e.g., program purchase). Such usage data are also used by Google Analytics for Firebase for statistical extrapolations that compare the behavior of users with that of other users of the system and thus, with a certain statistical probability, indicate, for example, whether a user may be interested in purchasing a program. Based on these statistics, the Provider can send the user more targeted offers and discounts for SQIN and IQONIC that may be of interest to them.

The Provider uses Google Analytics for Firebase services under the EU General Data Protection Regulation due to its interest in designing its product to be user-friendly and in addressing users in marketing communication as specifically as possible according to their interests and providing them only with truly relevant offers. To use Google Analytics for Firebase, the Provider has integrated its “Software Development Kit” (SDK) into the SQIN and IQONIC system. This creates an interface through which Google can access the above-mentioned data about the system. The information generated by the SDK about the user’s use of the SQIN and IQONIC services (including the IP address) is transmitted to a Google server in the USA and stored there. According to Google, the IP address of the user will in no case be associated with other Google data. However, Google may store and process the relevant personal data in all facilities operated by Google, its internal sub-processors, or the providers of digital infrastructure it uses. In all cases where these data leave the EEA (European Economic Area) or Switzerland, the transfer takes place using the Standard Contractual Clauses.

Withdrawal / Opt-Out Option: For all requests relating to personal data, the user may contact by e-mail. The Provider will forward these requests to Google, which has agreed to comply with all obligations arising from the EU General Data Protection Regulation. These include access, correction, restriction of access, and deletion of personal customer data. These obligations will be implemented insofar as EU law on retention periods permits.
If and to the extent that data associated with the user’s account can still be used and must still be used for purposes not yet expired at the time of the intended deletion, the data records will be blocked or restricted to certain processing purposes instead of being deleted. This is particularly the case for legally mandatory retention obligations, such as corresponding commercial and tax law provisions. The latter can amount to up to 10 years (see § 147 (3) of the German Fiscal Code).

Evaluation of User Behavior in the SQIN and IQONIC Services (via Smartlook)

For session recording, the Provider uses the Smartlook service, which is operated by Smartsupp.com s.r.o., Milady Horakove 13, 602 00 Brno, Czech Republic. With the Smartlook service, user behavior is recorded on video and can be analyzed by the Provider afterwards. For this purpose, the software sets a cookie on the user’s computer (see relevant sections on cookies in this policy). The Provider does not store personal data when using this service.

The Provider uses Smartlook only if the user has consented to it. The legal basis for the processing of users’ personal data after consent is Art. 6 (1) (a) GDPR.

Processing users’ personal data enables the Provider to analyze user behavior. By evaluating the collected data, the Provider is able to compile information on the use of the individual components of the SQIN and IQONIC services. This helps the Provider to continuously improve the SQIN and IQONIC services and their user-friendliness.

Withdrawal / Opt-Out Option: The Provider does not store personal data of users. Only anonymous analysis data are processed for evaluation purposes. Anonymized usage logs are stored in accordance with legal requirements and automatically deleted after 30 days. Further information can be found in Smartlook’s privacy policy: .

Cookies are stored on the user’s computer and transmitted to the Provider. Therefore, the user has full control over the use of cookies. By changing the settings in their internet browser, the user can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for the Provider’s website, not all functions of the website may be fully usable. By clicking the following link , the user can prevent future tracking by Smartlook.

C. Optimization of Our Communication and Marketing Activities

Marketing Campaigns with Custom Audiences (via Facebook Pixel and Custom App Events via Facebook SDK)

The Provider uses services of the social network Facebook, represented by Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, in its services. To measure and optimally control marketing campaigns, the Provider uses so-called “remarketing tags” in the SQIN and IQONIC services. On the SQIN and IQONIC website, this involves the so-called “Facebook Pixel,” which is activated when visiting a page and informs Facebook that the page has been accessed. In the system, so-called “Custom App Events” are activated, which, via an interface (SDK), inform Facebook about which pages a user accesses in the system. When the user uses the SQIN and IQONIC services, a direct connection to the Facebook server is established via the remarketing tags. Based on the user’s IP address, Facebook receives the information that the user has used the SQIN and IQONIC services and records several individual actions within the SQIN and IQONIC services, for which the advertisements are optimized. When using the website, the following actions are distinguished and recorded:
– Accessing a specific landing page (e.g., homepage)

► You Have the Right

– pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if not collected from us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;

– pursuant to Art. 16 GDPR, to request without undue delay the rectification of inaccurate personal data stored by us or the completion of your personal data;

– pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing of such data is required for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;

– pursuant to Art. 18 GDPR, to request the restriction of processing of your personal data where the accuracy of the data is contested by you, the processing is unlawful but you oppose the erasure of the data and we no longer need the data, but you require them for the establishment, exercise, or defense of legal claims, or you have objected to processing pursuant to Art. 21 GDPR;

– pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request the transmission of those data to another controller;

– pursuant to Art. 7 (3) GDPR, to withdraw your consent at any time. Such withdrawal has the consequence that we may no longer continue processing the data based on this consent in the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected;

– pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your habitual residence or place of work, or at our registered office. The supervisory authority responsible for our registered office is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Phone: +49 30 13889-0
E-mail:

Links to Other Providers’ Websites:
Our system may contain links to other providers of internet content, in addition to the links already outlined to our presences on social media platforms. This Privacy Policy applies exclusively to the processing carried out within this system. We have no influence over the processing on linked sites. Please refer to the respective providers’ privacy policies for information about their processing activities.

Retention and Deletion of Data

As a rule, we store your personal data only for as long as is necessary to fulfill our contractual obligations. Therefore, all stored personal data and pseudonymized usage data are deleted once they are no longer required for the purposes for which they were collected, or if you expressly request their deletion and we are not legally required to retain them. Applicable retention and documentation obligations may arise from commercial law, tax law, or the German Civil Code (BGB). These laws sometimes stipulate retention periods of 10 years or more. In such cases, data are automatically deleted upon expiry of the statutory retention period.

Disclosure of Personal Data

Apart from the recipients mentioned above, we do not disclose your personal data to third parties. Disclosure will only take place if:

– you have given your explicit consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR,
– disclosure is necessary pursuant to Art. 6 (1) (f) GDPR for the establishment, exercise, or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in preventing the disclosure of your data,
– there is a legal obligation to disclose pursuant to Art. 6 (1) (c) GDPR, or
– disclosure is legally permissible and necessary pursuant to Art. 6 (1) (b) GDPR for the performance of contractual relationships with you.

► Contact for Data Protection and Data Protection Officer
If you have any questions regarding the collection, processing, or use of personal data, or if you require information, rectification, blocking, or deletion of data, as well as the withdrawal of consent previously given, you may – where applicable – contact us at any time by e-mail at or by post at:

SkinTech Corp. GmbH
Zimmerstraße 50
10117 Berlin

The Data Protection Officer of the Provider can be reached at the e-mail address or by post at: