DermoscoPal privacy policy

DermoscoPal by Santiago Olaechea, MD · effective November 8, 2026

About DermoscoPal

DermoscoPal is made and published by Santiago Olaechea, MD. Questions about this policy or the app: dermoscopalsupport@gmail.com.

In short

DermoscoPal keeps patient details and images only in the app on your iPhone. The app never sends them to the developer or to any server on its own: it has no accounts, analytics, advertising or tracking, and the developer never receives your library and can’t view, change or recover it. Data leaves your iPhone only when you share or export it, and then it goes where you send it.

What the app stores

What you enter and capture: patient names, dates of birth and record numbers (each optional), lesions and their sites on a 3D body, and images of skin with their capture details. The identifying details are optional, but images and linked records can still identify someone. An activity log of opening, locking and unlocking the app, patient and image changes, shares and exports; it records each patient only by a unique code the app generates, never the name, record number or date of birth. The log screen looks up names in your library to display them; they aren’t stored in the log. The log was designed with the audit controls standard of the HIPAA Security Rule (45 CFR 164.312(b)) in mind. Having it doesn’t by itself satisfy that standard; compliance depends on how a practice uses it. Your settings, a record that you accepted the first-use agreement, a timing log of how long steps take (no images or patient details), and caches of small images that are rebuilt when needed.

Where it is kept and how it is protected

In the app’s private storage on your iPhone, with iOS complete file protection: it can be read only while the iPhone is unlocked. It isn’t visible in the Files app and isn’t included in iCloud or computer backups. App lock, on unless you turn it off, asks for Face ID or the iPhone passcode; the check is done by iOS, and DermoscoPal stores no passcode or biometric data. The app switcher shows a blank screen instead of patients or images.

Privacy and security have limits

No software can be guaranteed to be completely secure or free of bugs. Errors or newly discovered vulnerabilities in the app, iOS or the iPhone could lead to unauthorized access, disclosure, alteration or loss of data. Protect your iPhone with a strong passcode, and keep the app and iOS updated.

Keep your own backup

The encrypted library export is the only backup. Keep regular exports somewhere secure and separate from your iPhone. Loss of or damage to the iPhone, erasing it, deleting the app or a data error can make your library unavailable, and the developer can’t restore it. The export password isn’t stored anywhere, and the developer can’t recover or reset it.

When data leaves your iPhone

Only when you choose: when you share images (you choose the images, format and recipient; the GPS position is never included, and image details or a patient information file are included only when you turn them on), when you make an encrypted library export (protected by a password that isn’t stored anywhere) and when you share the activity log. A shared copy is outside DermoscoPal’s protection: the person or service you send it to, such as email or a cloud drive, handles it under their own terms.

Permissions

The camera, to take images. Face ID, only for App lock. DermoscoPal doesn’t ask for your GPS position, Photos library, contacts or microphone, and it doesn’t offer saving images to the Photos app.

How long data is kept

Your library stays until you delete it. DermoscoPal never deletes records on its own, because how long clinical records must be kept depends on local law and practice. The activity log keeps up to 10 MB and removes its oldest months first. Files prepared for sharing or export are removed from the app’s temporary storage after use and at the next launch. Image caches are rebuilt as needed and kept to a fixed size within the app’s encrypted storage.

Deleting data

You can delete images, a lesion or a patient. Deleting removes the records, images and cached copies from the app. It can’t recall copies you already shared, and it doesn’t change an encrypted export you made earlier; importing such an export brings back what it contains. iOS frees the storage as for any deleted file; this isn’t a forensic erase. The activity log keeps the deleted patient’s unique app-generated code (never the name, record number or date of birth) as a record that the deletion happened.

Your patients’ information

Any input of identifying patient information is optional. If you document or share identifying patient information or images, you decide what is recorded and why, and you are responsible for following the laws that apply to you (for example HIPAA in the United States or the GDPR in the European Union), including recordkeeping, informing patients, obtaining any consent you need and any rules for children and sensitive images. The developer has no access to your library and can’t view, correct, export or delete it for you; patients’ requests go to the clinician who recorded them. DermoscoPal helps with those requests: Edit patient corrects details, sharing gives a copy of chosen images, and Delete patient erases them. A library export can hold several patients, so it shouldn’t be given to one patient as their record copy.

Contacting support

If you write to dermoscopalsupport@gmail.com, we receive your email address, your message and any attachments through Gmail. We use them to answer you, to look into technical or safety problems and to keep necessary support records, not for advertising. Please don’t send patient images, identifying details or library exports. If any arrive by mistake, access is restricted and they are deleted or returned as appropriate. Support information is kept only as long as reasonably needed for these purposes and for legal obligations. Copies in the email provider’s backups follow that provider’s retention.

Apple purchases and diagnostics

Apple handles App Store purchases under its own terms and privacy notices. If you turn on Share With App Developers in iOS (Settings → Privacy & Security → Analytics & Improvements), Apple may give the developer crash or usage information, which is used only to investigate reliability and errors. DermoscoPal has no crash-reporting service of its own.

Changes

A new version of this policy comes with an app update and shows its date here, and important changes are explained with that update. The current version is also at dermoscopal.com/privacy.

This website

The sections above describe the iPhone app. This website is hosted by Cloudflare. Serving it involves processing connection information such as IP addresses, browser details and security logs, which Cloudflare handles under its own privacy policy.

The site’s own code sets no cookies and adds no analytics or advertising, and it has no forms. It has no connection to the app or your library.