Privacy Policy

• Waitlist: your email address and, where available, how you found us (for example, a link from Instagram).
• Beta account: your email address and a password (stored only in hashed, irreversible form). You may add optional details such as your name or age range.
• Assessment answers and skin profile: your self-reported answers about how your skin feels and behaves, your skin concerns, and lifestyle factors relevant to skin health. We use these to build your skin profile and generate your routine. These answers are self-reported and descriptive; they do not constitute a skin assessment and do not produce a medical score or rating.
• Health information (only with your separate consent): some assessment questions collect health information: skin conditions you tell us about (whether or not diagnosed), prescription or other medical skin treatments, pregnancy or trying to conceive, and allergies, sensitivities, or reactions. We ask for your explicit consent immediately before these questions, separately from your acceptance of this policy (see section 4).
• Support messages: if you contact us through the in-app "Ask" feature or by email, we collect your message, reply address, and any screenshot you choose to attach.
• Technical and usage data: device type, browser, app version, session activity, feature usage, and your approximate location (country and general region, inferred from your IP address, never precise GPS). Our website analytics are cookieless and anonymous. Our app analytics describe how features are used; your assessment answers and health information are never sent to analytics.

• Product scans: if you use the product scan feature, we collect the photographs you take of the product, and the product information derived from them (product names, brands, barcodes, and ingredient lists). We use these to identify the product and review it against your skin profile. Our team may view your photograph to help identify the product. Please photograph only the product, not people. Product information we derive may be added to our shared product catalogue, which other users benefit from; your photograph is never published, used in marketing, or shared with anyone else.

A progress photo log and product logging are not active in the current beta, and we collect no data for them. If we introduce them, we will update this policy first.

• To build your skin profile and generate your ingredient, routine, and product guidance.
• To exclude ingredients that may be unsuitable for you, and to prompt you to seek professional advice where appropriate.
• To respond to your support requests and communications.
• To send you service updates, in-app notifications, and routine prompts (you can opt out at any time).
• To maintain, secure, and improve the Service.
• To comply with our legal obligations.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

We do not sell, rent, or trade your personal information. Stratum runs no advertising, has no affiliate or brand-partnership arrangements, and our guidance is not influenced by commercial relationships with product brands.

We share information only:

• With service providers who help us run Stratum: a database, authentication, and storage provider (your account, answers, profile, and routine are stored in Sydney, Australia); a product analytics service (usage events only, never your assessment answers or health information, hosted in the European Union); and an email delivery service for account emails such as password resets (processed in Australia). Each is required to protect your data and may not use it for its own purposes.
• Product lookups: to identify a scanned product, our server sends the barcode number, and nothing else, to a free open product-data project. Your name, account, IP address, device details, and photos never leave our systems. Only the barcode number does. We have no commercial or affiliate relationship with that project or with any retailer or brand.
• As aggregated, de-identified insights: we may create statistical insights from user data (for example, trends in skin concerns or ingredient responses across groups of users) and may share or license these with skincare manufacturers, researchers, and industry partners. These insights cannot reasonably be used to identify you, never include your name, contact details, or individual profile, and we apply minimum group sizes so no insight reflects a small number of users. Where insights draw on health information, this is one of the purposes you expressly consent to before providing it (section 4).
• The shared product catalogue: product details from scans (barcode, brand, name, ingredient list) go into a catalogue shared across all users, so the app gets better at recognising products for everyone. That catalogue contains facts about products, never facts about you. Which products you own, your routine, your answers, the response we write for you, and your photos are yours alone and are never part of it.
• Where required by law, or to protect the rights, property, or safety of Stratum, our users, or the public.
• In a business transfer: if Stratum is acquired or merges, your information may transfer to the new entity and we will notify you.

Because health information is sensitive information under the Privacy Act, we treat it differently:

• Immediately before the questions that collect it, we ask you to actively confirm your consent for Stratum to use it to: (a) personalise your routine; (b) exclude ingredients that may be unsuitable for you; and (c) create de-identified, aggregated statistical insights as described in section 3. We keep a record of your consent.
• Providing health information is optional. If you decline, you can still use Stratum with a more conservative routine.
• You can withdraw your consent, or ask us to correct or delete this information, at any time. Insights already created from de-identified data cannot be recalled, but your information will no longer contribute to new ones.
• We never sell or share your individual health information, and never use it for marketing.

Your data is stored in the Sydney, Australia region. We protect it with encryption in transit and at rest, hashed password storage, and access controls that limit each account's data to that user. In the event of a data breach likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Your data is stored in Australia, but some of our service providers are overseas entities: our database provider is headquartered in the United States and may access data from overseas to provide support, and our analytics data is hosted in the European Union. Where personal information is disclosed to an overseas recipient, we take reasonable steps, including contractual safeguards, to ensure it is handled consistently with the APPs, and we remain accountable under the Privacy Act.

We keep your personal information only while your account is active or as required by law. Product scan photographs are deleted once the product has been identified and the information derived, or sooner on request. Product information added to our shared catalogue is not personal information and is retained. You can delete your account and your personal information at any time by contacting us; we action this within 60 days (the additional time allows deletion to propagate through encrypted backups), except where the law requires retention. During the closed beta, profile and routine data may occasionally be reset as described in our Terms; this ends when the beta ends, without other change to this policy. Photos you submit through the scan feature are deleted 90 days after we complete our review, and you can ask us to delete them sooner at any time, through the app or by email. If you close your account, your photos and scan submissions are deleted with it, on the same timeline as the rest of your data. Product facts already in the shared catalogue (barcode, brand, name, ingredients) stay there, because they describe the product, not you. De-identified, aggregated data that cannot identify you may be retained.

Product photographs are deleted once your product review has been sent, or sooner if you ask. They are kept only for as long as we need them to identify the product.

You can: access the personal information we hold about you; request correction; withdraw consent to our collection and use of your health information; opt out of marketing and notifications; and make a complaint. Contact us at hello@stratumskin.app. We will acknowledge within 5 business days and respond within 30 days (we may need to verify your identity). If you are not satisfied, you may contact the OAIC: oaic.gov.au | 1300 363 992.

The Service is for residents of Australia aged 18 and over, and is not directed at anyone outside Australia. We do not knowingly collect personal information from anyone under 18; if we become aware that we have, we will delete it promptly.

Our website analytics are cookieless. The app uses only what is necessary for you to stay signed in. We use no advertising cookies and no cross-site tracking.

We will notify you of material changes through the Service or by email and update the effective date above. If a change materially affects how we collect or use health information, we will ask for your consent again before it applies to you.

hello@stratumskin.app · Stratum Skin Pty Ltd (ACN 700 549 346)