The short version

Photos

Sent once to our AI provider, Anthropic, through DermCase’s own server for analysis. DermCase does not store them. Anthropic states that it deletes API inputs and outputs within 30 days, and keeps them up to 2 years only if a request is flagged for a usage policy violation.

Case details

Age, sex, body site, duration, skin type and notes travel with the photo. DermCase stores them only if you press Save, and notes are never stored.

Saved cases

With an account, in our database (Supabase), visible only to you. Without an account, only in this browser on this device.

Model training

Anthropic states that by default it does not use API inputs or outputs to train its models.

Tracking

Anonymous counts only. Page views are counted without cookies or any persistent ID, and the app counts how many analyses run and how they end, with no photo, case text, account or IP address in the count. No advertising, no advertising identifiers, no tracking cookies. Nothing is sold. Details under “Usage counts”.

Security

HTTPS only, a strict content-security policy, no third-party scripts, and a server that checks requests come from the app’s own pages and applies rate and daily limits. To report a vulnerability, see security.txt.

Pilot

Use de-identified cases only. See “Patient information” below.

What is collected, and why

When you run an analysis

Up to three photos, which your browser resizes to at most 1200 pixels on the long side and re-encodes as JPEG, plus the details you type: age, sex, body site, duration, skin type and notes. They are used for one purpose: to produce the literature brief you asked for. While it works, the AI may run web searches. The search queries are written by the model from the case, and they run through Anthropic’s search tool.

When you save a case

The structured brief (differential, references, treatment options) and the case details: age, sex, body site, duration and skin type. Never the photo and never the notes.

If you create an account

Your email address and a password, which our authentication provider stores in hashed form. An account is optional. The app works without one.

On your device

Saved cases when you are not signed in (up to 50), your language and theme choice, your sign-in session if you have an account, and a cache of the app’s own pages so it opens offline. You control all of it from your browser or Android app storage settings.

Share links

“Share link” puts the brief and the case details into the part of the link after the #. Your browser does not send that part to any server, but anyone who has the link can read everything in it. Share only de-identified content.

Server records

Our host, Vercel, records standard request metadata such as IP address, time and URL to run the service. DermCase’s own code does not log or store the contents of an analysis request.

Usage counts

To learn whether the tool is useful and stable, DermCase keeps two kinds of anonymous counts. First, page views on the home, about, app and privacy pages, counted by Vercel Web Analytics. It sets no cookies and builds no profile of you. It is not loaded at all if your browser sends Do Not Track or Global Privacy Control, and it never runs on shared reports, the sign-in page or your library. Second, a daily tally in our own database of how many analyses started, how each ended (finished, not a clinical photo, cut off, failed), the report language and the total time taken. That tally contains no account, IP address, device identifier, photo or case text, so it cannot be tied back to you. The tally also lets us set a daily limit so the service stays available.

Who else handles data

Anthropic

Runs the AI analysis and literature search. Receives the photos and case details of every analysis. Retention · Training · Privacy policy

Vercel

Hosts the site and the small server function that forwards your analysis request to Anthropic. Also provides the cookie-free page-view counts.

Supabase

Accounts and saved cases for people who sign in. Not used if you stay signed out.

PubMed, DOI, journals

Reference links open the publisher’s own site. Their policies apply once you leave DermCase.

These providers may process data outside your country, including in the United States. We do not sell personal data and we do not share it for advertising.

Patient information

During the pilot, use de-identified cases only: no names, record numbers or birth dates, and crop out identifying features such as faces and tattoos. DermCase does not yet have the agreements that rules such as HIPAA require for identifiable patient data, and it should not be given any.

Keeping and deleting your data

• Cases on this device. In the app, delete one case or clear them all from the history list. Clearing the browser’s site data, or the Android app’s storage, removes everything stored locally.
• Cases in your account. Sign in, open Library and press Delete next to a case.
• Your whole account. Sign in at dermcase.jai-kim.com/login, open Library and press “Delete account and all cases.” The account and every saved case are removed immediately and cannot be recovered. If you cannot sign in, ask for deletion using the contact below and we will delete it within 30 days.
• Copies at Anthropic. They delete on their own schedule, within 30 days as they state. We cannot delete them sooner.

Your rights

You can ask for a copy of the data tied to your account, ask us to correct it, or ask us to delete it. Where laws such as the EU GDPR, the Korean Personal Information Protection Act or the California CCPA apply to you, you also have the rights they give. DermCase is for licensed healthcare professionals aged 18 or over and is not directed to children.

Medical disclaimer

DermCase is a literature reference for clinicians. It is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Its output can be wrong or incomplete and does not replace physician judgment. Consult a qualified healthcare professional and current guidelines before making clinical decisions. It is not for emergencies.

Contact and changes

Privacy contact: Jai Kim, DermCase by Darae. Until a dedicated address is published here, open an issue at github.com/Jai-Kim/derm-case/issues and do not include any patient information.

If this policy changes in a way that matters, the date at the top changes and the app will say so.