Privacy Policy
Applies to the Quant.Skin mobile app and web dashboards. Updated September 1, 2026.
Core principle
A patient's photos, videos, audio recordings, and messages are encrypted on the device itself before ever leaving the phone — end-to-end encryption (E2EE) using an X25519 key pair; the private key never leaves the device and is stored encrypted with the user's own password. The server receives and stores only ciphertext — no role, including the service administrator, has any technical way to decrypt medical photos or messages.
What data we collect
| Data | Form | Purpose |
|---|---|---|
| Name, email, phone (optional) | plaintext | sign-in, invitations, notifications |
| Photos, video, audio recordings of protocols, messages with the doctor | ciphertext only | maintaining treatment history — decrypted exclusively on the recipient's own device |
| Capture metadata (head position, facial landmark coordinates, body contour) | plaintext numeric coordinates | aligning "before/after" frames; this is frame geometry, not an image and not a biometric template |
| Device push token | plaintext | delivering notifications via Firebase Cloud Messaging |
| Photo access log (who, when, screenshot attempt) | plaintext | controlling access to a patient's history |
| App crash diagnostics | stack trace, no email/username | fixing bugs — no screen recording or IP address is collected |
The app shows no ads and embeds no third-party tracking SDKs — the IDFA identifier is neither requested nor used.
Face Data and TrueDepth
The face capture screen uses the TrueDepth camera (on iPhones that support it, via ARKit) and an on-device ML Kit face detector (Google, runs entirely on the device, with no network calls) as a capture assistant for the "before/after" medical protocol — not to recognize or verify who the user is.
- Collection. While the face capture screen is open, the app reads distance to the face and head pose from the TrueDepth/ARKit depth camera, and — via the on-device ML Kit detector — facial landmark coordinates (eyes, nose, mouth, ears, cheeks, face outline — up to 22 points) and head rotation angles for each preview frame.
- Use. This data is used solely to (1) show the patient a target-oval guide ("position your face inside the oval") together with prompts such as "move closer/farther" or "turn your head", and (2) geometrically align a new photo with the previous photo in the same series for "before/after" comparison. The app does not perform facial recognition or identity verification and does not build a biometric template (descriptor/embedding) that could be used for that.
- Disclosure and transfer. Raw camera frames and TrueDepth depth data never leave the device — they are processed locally by ARKit and ML Kit and are never sent to our server, to Google, or to any other third party. Only the already-computed set of landmark coordinates and head-pose angles (not an image) is sent to our server, together with the photo itself, which is separately end-to-end encrypted before it is sent.
- Retention. Landmark coordinates and head-pose angles are stored on the server in plaintext (unlike the photo itself, which is stored as ciphertext only) alongside the corresponding photo record — for as long as that photo is retained, and are deleted together with it (see also the "Capture metadata" row in the table above and the "Account deletion" section below).
Who else receives data
- Firebase (Google) — push notification delivery (title, body, internal record identifiers, no email/full name).
- Sentry — app crash diagnostics, no screen recording and no personal identifiers.
- Purelymail — transactional email delivery (invitations, password reset).
- Selectel Cloud — storage of encrypted files and the database on servers in Russia.
We do not sell or share patient data with third parties for marketing purposes.
Account deletion
You can close your account from the app's settings — signing in with it will no longer be possible, and active sessions and any doctor mandates will be revoked. Medical data (encrypted photos, protocols, message history) remains technically necessary for the treatment history of the patient and their treating doctors, and is not physically deleted along with closing sign-in access. To request full data deletion, email info@quant.skin.
Age restrictions
The app is intended for doctors and their patients — adult users. The app does not knowingly collect data from children.
Policy changes
We will notify you of changes to this page by publishing a new version with an updated date at the top.
Contact
For questions about data processing — info@quant.skin.