Privacy Policy

1. Controller

The data controller responsible for the processing of your personal data is:

Yasu Labs Zingg
DUNS 481041120
Handelsregister Eintrag: CHE-287.810.568
Switzerland
info@yasulabs.com

2. What Data We Collect

• Facial images (face data): Portrait photos captured in the Yasu mobile app with the device camera for professional skin imaging. See Section 2.1 below.
• Patient identifiers: Name or pseudonym you assign to a scan session.
• Account data: Email address and clinic/workspace name used to create your account.
• Usage data: Timestamps of scan creation and access for audit purposes.

2.1 Face Data (Facial Images)

This section describes how Yasu Labs handles face data— photographs of a person's face collected through the Yasu app. Yasu is a business-to-business tool for clinic staff; clinic users capture or upload images of their patients under their own professional and legal responsibilities.

What face data we collect

• Portrait photographs of the face (typically cheek/profile angles) taken with the device camera in the Yasu iOS app.
• Derived analysis images produced from those photos (e.g. clean portraits, duotone skin analysis maps).
• We do not use face data for facial recognition, identity verification, advertising, or sale to data brokers.

How we use face data

• To generate skin analysis visualisations (e.g. redness, pigmentation, wrinkles, acne scars, acne modes) for consultation.
• To store scan results so authorised users in the same clinic workspace can review them.
• To support severity scores from a machine learning process and comparison between follow-up scans for the same patient.
• We do not use face data for marketing unless the clinic obtains separate patient consent for that purpose.

Sharing and storage

• Face data is not sold and is not shared with advertisers.
• Face data is processed by our subprocessors listed in Section 8 (hosting and GPU image processing) solely to provide the service.
• Stored in Supabase (database and private file storage) with encryption in transit; access is limited to the clinic account that created the scan.
• GPU processing (RunPod) receives images temporarily to generate analysis outputs; images are not retained by the GPU provider after processing completes.

Retention

Face data is retained for as long as the clinic account that created the scan remains active. Clinics may delete individual scans at any time. When a clinic account is terminated, associated face data is permanently deleted within 30 days, as described in Section 6.

3. How We Use Your Data

• To perform skin analysis through a machine learning process and generate visual output images.
• To store scan results securely and make them accessible to authorised clinic staff.
• To display optional skincare products configured by the clinic for consultation reference (not automated medical treatment advice).
• We do not sell, share, or use your data for advertising purposes.
• Yasu is a professional skin analysis tool, not a medical diagnostic device. Results are intended to support trained practitioners, not replace medical advice. See our Disclaimer & Sources page for citations and limitations.

4. Data Processing & Storage

• Images are processed on secure GPU infrastructure (RunPod, USA) solely to generate analysis outputs. Images are not retained by the GPU provider after processing completes.
• Scan data and result images are stored in Supabase (EU region) with encryption at rest and in transit.
• Access to scan data is restricted to the clinic workspace that created the scan.

5. Legal Basis (GDPR / nDSG)

We process your data on the basis of:

• Contract performance (Art. 6(1)(b) GDPR / Art. 31 nDSG) — to deliver the scan analysis service you have requested.
• Legitimate interests (Art. 6(1)(f) GDPR) — for security logging and audit trails.
• Explicit consent — where required for sensitive (biometric) data processing.

6. Data Retention

Scan data is retained for as long as your clinic account is active. You may request deletion of any scan at any time. Upon account termination, all associated scan data is permanently deleted within 30 days.

7. Your Rights

Under GDPR and the Swiss nDSG you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Object to or restrict processing
• Data portability

To exercise any of these rights, contact us at info@yasulabs.com.

8. Third-Party Processors

9. Contact & Complaints

For privacy questions contact info@yasulabs.com. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.