Privacy policy

The Autoderm service is provided by the EU Legal Manufacturer, iDoc24 AB, Berzeliigatan 25, 41253 Gothenburg, Sweden and Autoderm Inc., a corporation incorporated in the State of Delaware, USA, with principal offices at 2991 Sacramento St, Unit #183, Berkeley, CA 94702, USA, and European office at Norrsken House Barcelona, Passeig del Mare Nostrum 15, 08039 Barcelona, Spain (these parties are from here on referred to as “Autoderm”)

Controller: Autoderm

Contact:  support@autoderm.ai

iDoc24 AB is the manufacturer of the Autoderm medical device software. Autoderm Inc. (California, USA) is our commercial entity; data protection obligations are borne by iDoc24 AB.

Note on identifiable images: Autoderm is intended for non-identifiable images. Various mitigations are in place to prevent the processing of identifiable images including an anonymity filter and labelling mitigations, however, full GDPR requirements are implemented as a precautionary measure also. 

Images submitted via the Autoderm API are processed without direct identifiers and stripped of any EXIF metadata on ingestion. No End User identifier is retained alongside stored images. We nonetheless apply full GDPR protections to all retained images as a precautionary measure. Images are only retained for training where our integrator partner has obtained consent from the End User.

When you access our website or register for API access, we collect identification and contact data such as your name, email address, and company details. We use this information to manage your account and provide the services you have contracted. The legal basis for this processing is the contractual relationship between the parties, in accordance with Article 6.1(b) GDPR. We retain this data for the duration of the contract and for up to five additional years thereafter to meet fiscal and liability obligations.

Where you submit payment details to subscribe to our services, payment processing is handled by our provider Stripe. We retain only a billing reference; card data is held by Stripe under their own privacy policy.

We also collect aggregated, non-identifiable usage statistics linked to your API key for the purpose of post-market surveillance of the Autoderm medical device, as required under EU Regulation 2017/745. The legal basis is compliance with a legal obligation under Article 6.1(c) GDPR. This data is retained for the duration of the device lifecycle.

Finally, where you or your end users have provided consent, skin images submitted via the Autoderm API may be retained by us following the inference and used to improve and retrain our AI models. Images are stripped of all metadata on ingestion and are not linked to any individual identifier. The retained images are not intended to be re-identifiable; we nonetheless apply full GDPR protections to all retained images as a precautionary measure. 

Consent may be withdrawn at any time by contacting  support@autoderm.ai. We will delete the relevant images from our training dataset to the extent technically feasible given the absence of linking metadata.

We do not collect or sell personal data. We share data only with:

• Google Cloud (EU): hosting, storage and data processing
• Hetzner Online GmbH (Germany): hosting, storage and data processing
• Stripe Inc.: payment processing, governed by Stripe’s own privacy policy

All processors are bound by data processing agreements. No transfers outside the EEA are made in connection with the processing described above. All third parties have signed with us the corresponding standard contractual clauses based on European requirements. Therefore, the use of providers outside of the EU does not give rise to a lower degree of protection of your personal data than the use of providers located in the European Union would have.

You maintain full control over your personal data in accordance with GDPR Articles 15–21 during the initial submission and analysis phases. We implement anonymization protocols on all images before they are stored or utilized for any further purposes.

To exercise any right, contact  support@autoderm.ai. We will respond within one month.

You also have the right to lodge a complaint to your relevant privacy protection authority for example the Swedish Authority for Privacy Protection (IMY): www.imy.se.

The Autoderm API performs automated AI analysis of skin images. This is provided as a clinical decision support tool; it does not produce legally binding decisions and is always subject to review by a qualified healthcare professional. It does not constitute automated decision-making within the meaning of GDPR Art. 22.

We use essential cookies required to operate this website and, where you consent, analytics cookies to understand usage. You can manage cookie preferences at any time via the cookie banner on this site.

We may update this notice. Material changes will be communicated via the website. The date at the top of this page reflects the most recent version.

• 20 June 2026
• 1 March 2025
• 7 December 2023
• 6 March 2021
• 21 June 2019