Dermvio← Back

Dermvio

Privacy Policy

Effective 2026-06-10

Draft — pending counsel review

This page is a placeholder while Dermvio finalizes its policies with healthcare counsel. The final version may differ in material respects. Do not rely on this text for legal purposes.

This Privacy Policy explains how Dermvio LLC, a Colorado limited liability company ("Dermvio," "we," or "us"), collects, uses, and discloses information when you visit our website or use the Dermvio platform (the "Service"). Dermvio provides software infrastructure to independent dermatologists; we are not a medical practice and do not provide clinical care.

For protected health information ("PHI") that Dermvio handles on behalf of a dermatologist or clinic, Dermvio acts as a Business Associate under the Health Insurance Portability and Accountability Act ("HIPAA"). Our handling of PHI is governed by the Business Associate Agreement ("BAA") between Dermvio and that dermatologist or clinic, in addition to this Privacy Policy.

Each independent dermatologist or clinic on the platform is the Covered Entity for its own patients under HIPAA and is responsible for providing those patients with its own Notice of Privacy Practices ("NPP"), which describes how the provider or clinic uses and discloses PHI. You will receive the applicable NPP from the dermatologist or clinic you select. This Privacy Policy supplements, and does not replace, each provider's or clinic's NPP.

1. Information we collect

1.1 Information you provide directly

  • Account information: name, email address, password, professional credentials, license details, NPI.
  • Practice information (providers and clinics): branded subdomain, bio, contact info, profile and hero imagery, marketing copy.
  • Payment information: processed by Stripe; Dermvio receives transaction metadata but not full card numbers.
  • Patient health information (provided to a dermatologist): chief complaint, photos of the skin condition, prior treatments, medication history, and any messages exchanged during a consultation. This is PHI subject to HIPAA.

1.2 Information collected automatically

  • Device, browser, and IP information used to operate, secure, and improve the Service.
  • Usage logs (pages visited, actions taken). We do not include PHI in operational logs.
  • Cookies used for authentication sessions. We do not use third-party advertising cookies.

2. How we use information

  • To provide, maintain, and secure the Service.
  • To route patient submissions to the dermatologist or clinic the patient selected.
  • To process payments, payouts, and platform subscriptions via Stripe.
  • To send service-related communications and notifications.
  • To comply with legal obligations and respond to lawful requests.

3. How we share information

  • With dermatologists and clinics:Patient submissions and PHI are routed only to the provider or clinic the patient selected. Other providers on the platform cannot access another provider's patients.
  • With service providers under a BAA where applicable: Cloud infrastructure (Google Cloud Platform), authentication (Firebase Identity Platform), payments (Stripe), transactional email (Resend), error monitoring (Sentry, configured to exclude PHI).
  • For legal reasons: Where required to comply with valid legal process or to protect the rights, property, or safety of Dermvio, our users, or the public.

Dermvio does not sell personal information or PHI.

4. Security

Dermvio uses administrative, technical, and physical safeguards designed to protect personal information and PHI, including TLS 1.2+ in transit, AES-256 at rest, role-based access control, and detailed audit logging of PHI access. See our Security page for more detail. No method of transmission or storage is 100% secure; we work to maintain commercially reasonable safeguards.

5. Your choices and rights

  • You can update your account information through the Service or by contacting us.
  • You can request access to or deletion of certain personal information by contacting us, subject to legal retention obligations (including HIPAA-required retention for PHI).
  • Depending on where you live, you may have additional rights under state or international privacy laws.

6. Children

The Service is not intended for use by children under 13. We do not knowingly collect personal information from children under 13. Some features require additional consent for minors; see the consent flow during patient registration for details.

7. International users

Dermvio is operated in the United States. By using the Service, you consent to processing of information in the United States.

8. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email. The "Effective" date at the top of this page reflects the most recent update.

9. Contact us

Questions about this Privacy Policy or your information: privacy@dermvio.com.