Darmé Consumer Health Data Privacy Policy
Last updated: October 1, 2026
This Consumer Health Data Privacy Policy applies to consumers in Washington and Nevada, and to "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373) and Nevada law (NRS 603A). It supplements the Darmé Privacy Policy, which explains all other processing. Darmé is operated by BIIOUI DIGITAL - FZCO, Dubai Silicon Oasis (IFZA), Dubai, United Arab Emirates. Contact: contact@darme.app.
Darmé is a cosmetic skincare app. It is not a medical service. Some information it handles can still be consumer health data under these laws, so we describe it here.
1. Consumer health data we collect
| Category | Examples |
|---|---|
| Face photos and information derived from them | Photos you choose to analyze; skin-appearance readings and scores (including face areas); skin type; estimated skin age |
| Skin concerns and conditions you tell us about | Skin concerns, reactions or allergies you mention, and whether you use a prescribed skin treatment (questionnaire) |
| Daily skin reactions | Check-in feelings and tags such as breakout, redness, stinging, dryness or itching; the 28-day skin test and its target concerns |
| Coach conversations | Messages you send to the Coach and its answers (kept on your device only), and the context it uses with your consent |
| Products and routine | Products you use or plan to buy, their ingredient lists, product checks for products you add (a verdict and short reasons), your morning and evening routine and its completion |
| Care-seeking signals | That you used the dermatologist search (without the ZIP code or results), and your daily search count |
Darmé does not collect precise location for health purposes. The dermatologist search uses a ZIP code that is not stored with your account.
2. Why we collect and use it
Only to provide the features you request: your cosmetic skin readings and progress, your routine and product suggestions, checks of products you add, the Coach (with your separate consent), the 28-day test and check-ins, the dermatologist search, and to keep these features secure and working. We do not use consumer health data for advertising, and we do not sell it.
3. Where it comes from
From you (photos, answers, messages, check-ins, products), from analysis of the photo you authorize (Perfect Corp), from the Coach's answers (OpenAI, with your consent), and from your use of the app.
4. Who receives it
We share consumer health data only as needed to provide the service, with these processors and recipients:
| Recipient | What it receives and why | Contact |
|---|---|---|
| Supabase | Stores your account data and photos (hosting and database) | privacy@supabase.com |
| Perfect Corp | The photo you authorize, to produce your cosmetic readings | privacyteam@perfectcorp.com |
| OpenAI | With your Coach consent, your messages, product checks and the context described in the Privacy Policy; product photos you confirm, to read what is printed on the pack (brand, name, type, size, barcode and ingredients) and to check that no person is in the photo | dsar@openai.com (privacy request portal: https://privacy.openai.com/) |
| Sentry | Technical crash reports only, without photos, messages, answers or your email | compliance@sentry.io (data subject request form: https://sentry.io/contact/gdpr/) |
| Google Workspace | Support emails you send us | https://support.google.com/policies/troubleshooter/7575787/ |
We do not sell consumer health data. We do not share it with affiliates for their own purposes. We do not implement a geofence around facilities that provide in-person health care services.
5. Your consent
We collect consumer health data only with your consent where the law requires it, and only for the purposes above: the photo-analysis agreement you give before a photo is analyzed, the optional Coach consent, and the answers, check-ins and products you choose to enter. We do not share consumer health data beyond the processors listed above without a separate consent. You can withdraw consent at any time: turn the Coach off in the app, stop analyzing photos, delete individual photos in Profile > My skin photos, or delete your account. To delete individual check-ins, email contact@darme.app.
6. Your rights
You have the right to:
- Confirm and access: confirm whether we collect, share or sell your consumer health data, and access it, including a list of all third parties and affiliates with whom we shared it and their contact details. Use "Download my data" in Profile, or email us. The download includes
third-parties.json, the list of recipients with their contact details (also shown in section 4). Coach conversations are kept only on your phone and are not in the download. - Withdraw consent to collection and sharing, as described above.
- Delete your consumer health data: delete photos in Profile > My skin photos, or delete your account in Profile or at darme.app/delete. When you delete your account, we notify Perfect Corp if you used photo analysis, and OpenAI if you used the Coach, of your deletion request within 45 days. They handle it under their own terms. For this, we keep a record for up to 90 days. It holds only the deletion date, which of these processors you used, and the references of your Perfect Corp analyses from the last 31 days, with no photo, reading, name or email. Support emails you sent us are not deleted by account deletion. They are kept as described in the Privacy Policy (section 9). Email contact@darme.app to ask us to delete them.
To exercise a right, email contact@darme.app with the subject "Darmé health data request". We may verify your request with your account email. We respond within 45 days; if we need more time, we will tell you, and we may extend once by 45 more days where the law allows. We do not charge for a request and will not discriminate against you for making one.
Appeals. If we decline your request, you can appeal by emailing contact@darme.app with the subject "Darmé health data appeal". We respond to appeals within 45 days and explain our decision. If your appeal is denied, you can contact the Washington State Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).
7. Retention
Photos and the readings derived from them are kept until you delete them or your account, and are deleted automatically after 3 years without using Darmé. Other consumer health data is kept while your account exists and is deleted when you delete your account, as described in the Privacy Policy. Support emails you sent us are the exception: account deletion does not delete them. They are kept as described in the Privacy Policy (section 9), and you can email contact@darme.app to ask us to delete them. After you delete your account, we also keep the processor notice record described in section 6 (up to 90 days) and a one-way code for each deleted account and photo (35 days). If we ever restore a backup while our live database can still be read, the code lets us delete them again. If the live database itself is lost, we cannot do this, and we will tell affected users. Neither holds a photo, reading, name or email. Copies in our database host's backups expire on the host's schedule.
8. Changes
The date above identifies this version. If we change how we collect or share consumer health data, we will update this policy and ask for any new consent the law requires before the change applies to you.