Skip to main content
Skinpendium

Privacy Policy

Effective date: April 17, 2026

Skinpendium LLC (“Skinpendium”, “we”, “us”) develops clinical decision support software for dermatology. This policy explains what information we collect through this marketing website and the associated clinician–administrator portal, what we do with it, and the protections we apply. It does not describe information handling by the Skinpendium clinical application itself, which is governed by a separate Business Associate Agreement (BAA) and end-user license executed with each deploying institution.

Regulatory status

Skinpendium Clinical Decision Support System is an investigational medical device. It is not yet cleared by the U.S. Food and Drug Administration (FDA) for commercial distribution. Nothing on this site is medical advice, a diagnosis, or a substitute for clinical judgment by a licensed physician.

Information we collect on this website

This website provides marketing pages and a clinician–admin portal. It does not accept, store, or display protected health information (PHI). We collect only:

  • Contact form submissions. When you submit the contact form, we receive the name, email address, organization (optional), and message you provide. Please do not include patient-identifying information in the message field.
  • Clinician portal account information. When an organization creates a portal account we collect the administrator's name, work email, practice or organization name, a hashed password, and session metadata (sign-in timestamp, IP address, and a non-identifying session token). The portal is used only to manage organizational metadata — enrolled devices, team members, subscription tier, and aggregate usage counts — and never displays patient records, images, case data, or diagnoses.
  • Server logs. Our web server records request metadata (IP address, user agent, timestamp, response status) for operational and security purposes. Logs do not record form field contents or portal passwords.
  • Strictly necessary cookies only. The portal uses a short-lived, HTTP-only session cookie to keep you signed in. We do not use third-party analytics, advertising, or social-media tracking pixels, and we do not sell or share your information with data brokers.

How we use your information

We use contact-form submissions only to respond to your inquiry, evaluate partnership or pilot opportunities, and maintain a record of business correspondence. We do not add submitters to marketing lists without explicit opt-in.

How we protect information

  • In transit: All traffic between your browser and our servers is protected by TLS 1.2 or higher.
  • At rest: Clinical datasets used to train and evaluate the Skinpendium AI model are de-identified in accordance with the HIPAA Safe Harbor method (18 identifiers removed) before they enter our environment. Case images within the clinical application are encrypted using AES-256.
  • Access controls: Production systems require multi-factor authentication and per-service credentials. Access is audited.

Data retention

We retain contact-form submissions for the period reasonably necessary to respond to your inquiry and maintain a record of the correspondence, subject to any longer retention required by law. Server logs are retained for a limited operational window.

Data sharing

We do not sell your personal information. We do not share it for third-party advertising. We disclose information only to vendors acting on our behalf under written contract (for example, our email delivery provider), and only as necessary to comply with applicable law or protect our rights and the safety of our users.

HIPAA and clinical data

Neither this website nor the clinician–admin portal is intended for the transmission or display of protected health information. The portal surface is designed to expose only organizational metadata (devices, team members, usage counts, subscription). The Skinpendium clinical application, when deployed into a healthcare setting, operates under a Business Associate Agreement with the covered entity. The BAA governs how we handle PHI on behalf of that entity and takes precedence over this policy with respect to any PHI processed through the clinical application.

Your choices

You can ask us to access, correct, or delete personal information you submitted through this website by emailing [email protected]. Residents of jurisdictions with specific privacy rights (including California, Virginia, Colorado, and the EEA/UK where applicable) may have additional rights; we honor verified requests in accordance with applicable law.

Children

This website is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes

We may update this policy to reflect operational, legal, or regulatory changes. The effective date above indicates when this version took effect. Material changes will be announced on this page.

Contact

Questions about this policy? Reach us at [email protected] or via the contact form.