eDermatology, Inc. (“eDermatology”, “we”, “us”) · Effective date: November 6, 2026 · Version 1.0
This policy explains what information we collect when you use edermatology.com, the eDermatology™ platform at app.edermatology.com (the patient, clinic and clinician portals and the apps), our shop, and our e-mails and messages (together, the “Services”); how we use and share it; and the choices you have.
Two kinds of information, two documents. Your medical information — what you tell our clinicians, your photographs, your results, your messages with the care team, your prescriptions and your care billing — is protected health information under HIPAA. It belongs to the independent, licensed medical practice that treats you (the “Practice” — identified to you at registration and in its own notice), and its use is governed by the Practice’s Notice of Privacy Practices, not by this policy. eDermatology operates the platform for the Practice as its business associate and may use that information only as the Practice’s written agreement with us and HIPAA allow. This policy governs everything else: the information you give us on the website, your account and device information, how you use the Services, the shop, and our marketing. Where the two documents could both apply, the one that protects you more governs.
Information you give us. - Website and contact forms: your name, e-mail address, organization, phone number and the message you send (for example, a demo or partnership request). The form is delivered to us by an e-mail service provider. - Account registration on the platform: your name, date of birth, e-mail address, mobile number, address, the language you prefer, your emergency contact, and the credentials you choose. We never ask for your Social Security number. Sign-in uses a passkey or a one-time code, not a password you must remember. - Membership and shop purchases: your billing name and address and the plan or products you choose. Your card number goes directly to our payment processor; we never see or store it — we keep only the processor’s reference, the last four digits, the amount and the date. - Support and correspondence: what you write to us by e-mail or through the portal’s support channels.
Information collected automatically. - Device and connection data: IP address, browser and device type, operating system, language, the pages and screens you open, the time of each request, and error reports. Our systems keep security logs of sign-ins, sign-in attempts and other security-relevant events, which record your account and device, never the content of your care. - Cookies and similar technologies: the platform uses only the storage its sign-in and session require (strictly necessary); the website sets no cookies of its own. We do not use advertising cookies or cross-site tracking, and we do not sell your information to data brokers.
Information from others. If a clinic refers you, the clinic gives the Practice the information needed to register you and to evaluate you; your health plan, if we bill it, may send eligibility and payment information. These are medical records and fall under the Notice of Privacy Practices.
Artificial intelligence. The platform uses AI tools to help clinicians work — for example to draft notes and summaries from what you and your referring clinic provided, to translate care summaries into your preferred language, and, with your consent at the start of a video visit, to transcribe the visit’s audio so the clinician can document it. Every clinical communication you receive is reviewed and signed by a licensed clinician before you see it. These tools run inside our cloud environment under the same HIPAA protections as the rest of the platform; we do not send your identifiable information to any AI service that would use it for its own purposes.
We share information only as described here:
We do not sell your personal information, and we do not share it with third parties for their own marketing.
De-identified patient information (California Civil Code §1798.148). Information derived from patient records may be de-identified under HIPAA’s methods and used by us for research, for developing and improving the clinical tools on the platform, and in de-identified data sets that may be licensed or sold to third parties for health research and product development. De-identified information cannot reasonably be used to identify you. When we disclose or sell de-identified patient information, we disclose that fact here, as California law requires, and state the method: expert determination under 45 CFR §164.514(b)(1), with each recipient bound by contract not to attempt re-identification and not to further disclose the data except as permitted. Your clinic’s agreement with us may exclude its patients’ information from these data sets, and you may tell us at support@edermatology.com (attention: Privacy Officer) that you do not want your information used in identifiable form for improving our tools; the Practice’s Notice of Privacy Practices describes your rights over your medical records themselves.
We design the Services for health information: encryption in transit and at rest; passkey sign-in and short, automatically expiring sessions; role-based access so that each person sees only what their role requires; audit logs of access to records; network isolation and a managed web application firewall; de-identified storage of photographs separated from your identity; and a security program with a designated Security Officer, risk analysis, workforce training and incident response. No method of transmission or storage is perfectly secure; if a breach affects you, we and the Practice will notify you as the law requires.
The Services are for adults; a parent or legal guardian may register and manage care for a patient under 18 and is the account holder for that purpose. We do not knowingly collect information from children under 13 through the website; if you believe a child has given us information, write to us and we will delete it.
Our Services are hosted in the United States. If you use them from outside the United States, you understand that your information is processed and stored there.
When we change this policy we will post the new version with its effective date on edermatology.com and on the platform; a material change will be presented to you at your next sign-in. Continued use after the effective date means you accept the new policy.
eDermatology, Inc. · 24881 Alicia Pkwy, Suite E-199, Laguna Hills, CA 92653 · support@edermatology.com · (877) 656-DERM (3376) Security Officer: support@edermatology.com (attention: Security Officer). For matters about your medical records: the Practice’s Privacy Officer, through the contacts given in the Notice of Privacy Practices.