Enterprise Privacy Notice
How DermaGenome processes data for enterprise customers, including sub-processors, data location, and data-subject rights.
Who This Applies To
This notice describes how DermaGenome, acting as a processor or sub-processor for enterprise customers, handles data submitted through the platform and APIs. The enterprise customer remains the controller of end-user data and is responsible for its own privacy notice and lawful basis for processing.
Data We Process
On behalf of customers, DermaGenome may process: account and configuration data, API request data, uploaded images and analysis inputs, derived skin-intelligence outputs, and operational logs needed to provide and secure the service. We do not use customer end-user data to train models for unrelated customers.
Processing Purposes
Data is processed only to deliver the contracted service — skin analysis, product intelligence, recommendation generation, white-label delivery, security, and reliability. We do not sell personal data and do not use customer data for advertising.
Sub-processors
DermaGenome uses vetted sub-processors for cloud infrastructure, storage, and AI compute. A current list of material sub-processors and their functions is available to enterprise customers under NDA. Customers receive advance notice of material sub-processor changes where contractually required.
Data Location & Transfer
Data is processed in configured cloud regions. Where data transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent transfer mechanism. Region-specific data residency is available per the executed agreement.
Security Measures
Technical and organizational measures include encryption in transit and at rest, access controls, least-privilege administration, audit logging, and incident response. Details are documented in the Security Center and elaborated in the executed agreement.
Retention & Deletion
Customer data is retained for the agreement term and deleted or returned on a documented schedule after termination, as specified in the agreement and the Data Processing Addendum. Operational logs are retained per the retention schedule and then deleted.
Data-Subject Rights
Data-subject requests (access, correction, deletion, portability) are handled by the enterprise customer as controller. DermaGenome assists customers in fulfilling such requests where the data is within our control, within timelines defined in the agreement.
Contact
For privacy questions, sub-processor requests, or data-subject assistance, enterprise customers contact privacy@kdermai.com or their assigned account team.