Privacy Policy
Effective date: 28 August 2026 · Version 1.0
Governing law: Republic of South Africa (POPIA, CPA, ECTA, SAHPRA guidance) · Contact: legal@skinlabs.co.za
Foundational criteria. SkinLabs operates on two non-negotiable foundations: (1) privacy by default under the Protection of Personal Information Act 4 of 2013 (POPIA), including strict handling of special personal information; and (2) a strictly non-diagnostic methodology aligned with SAHPRA cosmetic boundaries. SKYNN AI and all related features provide cosmetic-oriented skin assessment and educational information only. They do not constitute medical diagnosis, treatment or advice, and are not medical devices under SAHPRA frameworks for diagnostic purposes. Always consult an HPCSA-registered healthcare practitioner for medical concerns.
1. Introduction and scope
SkinLabs® (“SkinLabs”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information in accordance with POPIA, the Consumer Protection Act 68 of 2008 (CPA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), applicable SAHPRA guidance on cosmetic products and claims, and the Health Professions Council of South Africa (HPCSA) ethical framework where relevant to third-party practitioner services.
This Privacy Policy describes how we collect, use, store, share and protect personal information when you visit skinlabs.co.za, use SKYNN AI, create an account, subscribe, purchase credit packs, interact with our content, or use any related services (collectively, the “Platform”). It also explains your rights as a data subject and how you can exercise them.
2. Responsible party and Information Officer
The responsible party (as defined in POPIA) for the processing described in this Policy is the legal entity operating the SkinLabs Platform. Communications may be directed to the Information Officer (or Deputy) at legal@skinlabs.co.za. We will update this section with full registered-company particulars as they become publicly available on the Platform.
3. Personal information we collect
We collect only personal information that is adequate, relevant and not excessive for the purposes set out in this Policy (privacy by default / data minimisation).
3.1 Ordinary personal information
- Identity and contact data: name, email address, phone number (where provided), account credentials
- Transaction and billing data: subscription tier, payment tokens (we do not store full card numbers), transaction history, invoices
- Usage and technical data: IP address, device type, browser, pages visited, feature usage, referring URLs, approximate location derived from IP (city/region level)
- Communications: messages you send to support, feedback, survey responses
3.2 Special personal information (health-adjacent / biometric-related)
Under POPIA, information concerning a data subject’s health, and biometric information, is “special personal information”. The following may constitute special personal information:
- Photographs or images of your face or skin that you upload or capture for SKYNN AI analysis
- AI-derived skin metrics, scores, concerns, skin-type classifications and routine recommendations generated from those images
- Self-reported skin concerns, lifestyle factors or product history that you voluntarily provide
We process special personal information only with your explicit, informed consent (or another lawful ground under section 27 of POPIA where applicable) and only for the limited purposes described below. We do not use images for facial recognition, identity verification, or any purpose other than the cosmetic skin assessment and personalisation services you request.
4. Photographic data and SKYNN AI — specific rules
4.1 Purpose limitation (SAHPRA-aligned). Images are collected solely to perform AI-powered cosmetic skin assessment (visible characteristics such as texture, tone uniformity, hydration indicators, pigmentation patterns, etc.) and to generate personalised routine suggestions and educational content. The processing is not intended to diagnose, treat or prevent any medical condition and is not a medical-device service under SAHPRA frameworks.
4.2 Consent. Before any image is captured or uploaded for analysis, you will be presented with a clear consent mechanism that explains the purpose, the special nature of the data, retention, and your rights. Consent is specific, voluntary and can be withdrawn.
4.3 Anonymisation and minimisation. Where technically feasible we apply privacy-enhancing techniques (including segmentation or transformation of non-skin regions) so that the analytical pipeline focuses on skin attributes rather than identifiable facial features. We do not attempt to re-identify individuals from analysis outputs.
4.4 Retention of images. Raw or near-raw images are retained only for the short period necessary to complete the requested analysis and deliver results to you (typically measured in hours, not days, unless you explicitly save results to your account). Thereafter images are securely deleted or irreversibly anonymised. Derived, non-identifying metrics and scores may be retained longer in your account for progress tracking, subject to your rights of deletion.
4.5 Security. Images and related special personal information are transmitted over encrypted channels (TLS) and stored with appropriate technical and organisational measures (access controls, encryption at rest where applicable, logging, and least-privilege principles).
4.6 Processors. If we engage a third-party AI or computer-vision provider to assist with analysis, that provider acts as an operator (processor) under a written agreement that imposes POPIA-equivalent obligations, purpose limitation, security and deletion duties. Images are not used by the processor for their own training or commercial purposes without separate lawful basis and transparency.
5. Lawful bases for processing (POPIA)
- Consent — for special personal information (skin images and derived health-adjacent data) and for non-essential cookies/marketing
- Contract — to perform our agreement with you (account creation, subscription fulfilment, delivery of paid features)
- Legitimate interests — for ordinary analytics, security, fraud prevention and Platform improvement, balanced against your rights
- Legal obligation — where required by South African law
6. How we use personal information
- Provide, operate and improve the Platform and SKYNN AI features
- Generate and deliver personalised skin-assessment results and routine suggestions
- Manage accounts, subscriptions, credit packs and payments
- Communicate with you about your account, service updates and (with consent) marketing
- Ensure security, prevent abuse and comply with law
- Conduct aggregated or anonymised research and analytics to improve our models and content (never re-identifying individuals)
7. Sharing and disclosure
We do not sell personal information. We share personal information only in the following circumstances:
7.1 With your consent — for example when you request a feature that requires sharing, or when you opt in to a partner offering.
7.2 Service providers / operators — trusted processors who assist with hosting, analytics, payment processing, email delivery or AI analysis, bound by written contracts and POPIA obligations.
7.3 Independent practitioners — if you book a virtual dermatologist consultation through the Platform, limited necessary information is shared with the HPCSA-registered practitioner solely to enable the consultation. Those practitioners are independent responsible parties for their clinical records.
7.4 Legal and safety — when required by law, court order, or to protect the rights, safety or property of SkinLabs, our users or the public.
7.5 Business transfers / acquisition or sale of the Platform or IP. In the event of a merger, acquisition, corporate reorganisation, or sale of all or substantially all of the assets or intellectual property of SkinLabs (including proprietary databases of aggregated or user-derived skin-profile data), personal information may be transferred to the successor entity. We will ensure that any such transfer is subject to appropriate safeguards so that the receiving party continues to protect the information in a manner consistent with this Policy and POPIA. Where practicable we will provide notice to affected data subjects and, for special personal information, ensure a continuing lawful basis. You retain your data-subject rights against the new responsible party.
8. Cross-border transfers
Personal information is primarily processed in South Africa. If we transfer personal information outside the Republic (for example to a cloud or AI provider), we will do so only in accordance with section 72 of POPIA — either to a jurisdiction with adequate protection, or under a binding agreement that provides an adequate level of protection, or with your consent, or another permitted ground.
9. Retention and deletion policy
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
- Account data: retained while your account is active and for a reasonable period thereafter (or longer if required for legal claims or accounting)
- Raw skin images: short retention — deleted or anonymised after analysis completion unless you explicitly save results
- Derived metrics and routine history: retained in your account until you delete them or close the account
- Transaction records: retained for tax and consumer-law periods (typically 5–7 years)
You may request deletion of your personal information (right to erasure) at any time by contacting legal@skinlabs.co.za or using in-account tools where available. We will comply unless we have a lawful basis to retain certain data.
10. Security framework
We implement appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction and unlawful access or processing. These measures include encryption in transit, access controls, least-privilege principles, secure development practices, logging and monitoring, staff awareness, and contractual safeguards with operators. No method of transmission or storage is completely secure; we continuously review and improve our controls in line with POPIA’s security condition.
11. Your rights as a data subject
Under POPIA you have the right to:
- Be notified that personal information is being collected
- Access the personal information we hold about you
- Request correction, destruction or deletion of inaccurate, irrelevant or excessive information
- Object to processing on reasonable grounds
- Object to processing for direct marketing
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (subject to the limited exceptions in section 71)
- Lodge a complaint with the Information Regulator
To exercise any of these rights, email legal@skinlabs.co.za with sufficient detail to identify you and the request. We may need to verify your identity. We will respond within the timeframes required by POPIA.
12. Children
The Platform is not directed at children under 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete it.
13. Automated decision-making and profiling
SKYNN AI generates skin-assessment scores and routine suggestions using automated processing. These outputs are advisory and educational only; they do not produce legal effects or similarly significant effects on you within the meaning of section 71 of POPIA. You remain free to disregard any recommendation and to seek professional medical advice. You may contact us if you wish to obtain human review of a particular automated output that concerns you.
14. Changes to this Privacy Policy
We may update this Policy periodically. Material changes will be notified by updating the Effective Date, posting a notice on the Platform, and/or emailing registered users. Continued use after the effective date constitutes acceptance of the revised Policy, subject always to your ongoing rights under POPIA.
15. Contact and complaints
For any privacy-related enquiry, request or complaint:
Email: legal@skinlabs.co.za
Subject: Privacy / Data Subject Request
You also have the right to lodge a complaint with the Information Regulator (South Africa):
Website: https://inforegulator.org.za