Privacy Policy

1. Introduction

Welcome to Mole Detective. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, and store your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We believe that you should be in full control of your own data. We only collect and process the minimum amount of data necessary to provide you with our service, and we give you the tools to manage, export, and delete your data at any time.

Please note that Mole Detective is an image analysis tool only. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional regarding any concerns about your skin or moles.

2. Who We Are

Mole Detective is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

3. What Data We Collect

We only collect data that is strictly necessary to provide our service. This includes:

• Account information: Your email address and a hashed version of your password, used to create and manage your account.
• Skin and mole images (special category data): Images of your skin that you choose to upload for analysis. These images may reveal information about your health and are therefore treated as special category data under UK GDPR Article 9. We process these images solely to provide you with the analysis results you have requested, and only with your explicit consent.
• Analysis results: The results generated from analysing your uploaded images, including detected mole data such as size, shape, and confidence scores.
• Payment information: If you subscribe to a paid plan, we collect billing-related information such as your name and billing address. Card details are processed directly and securely by our third-party payment processor and are never stored on our systems.
• Subscription status: We store a record of your current subscription tier in order to grant access to the appropriate features.
• Data usage consent preference: We store a record of whether you have consented to allow your anonymised data to be used for service improvement and machine learning model training purposes.

We do not collect:

• Tracking or analytics data beyond what is necessary to operate the service.
• Data from third-party sources.
• Any data not directly provided by you or generated as a result of your actions within the service.

4. Special Category Data — Skin and Mole Images

Images of your skin may constitute health-related data and are classified as special category data under UK GDPR Article 9. We take additional care when handling this type of data.

We process your skin images on the following bases:

• Explicit consent for analysis (Article 9(2)(a)): By uploading an image, you are giving your explicit consent for us to process it for the purpose of mole analysis. You may withdraw this consent at any time by deleting the image or your account.
• Explicit consent for service improvement and machine learning model training (Article 9(2)(a)): Where you have consented to allow your data to be used for service improvement purposes (via the Allow Data Usage option), your anonymised images and analysis results may be used to train and improve our proprietary machine learning models, enhance analysis accuracy, and develop new features. This data is anonymised before use and is never shared with any third party for training, research, or any other purpose. Our machine learning models are proprietary and are developed, trained, and maintained exclusively by Mole Detective.

Early Access Accounts

During our early access period, consent to allow anonymised data usage for machine learning model training and service improvement is a mandatory condition of registration. This is because early access is provided at a reduced cost or free of charge in exchange for contributing to the development and improvement of the platform. This requirement will be clearly communicated at the point of registration.

In future, once the service moves beyond early access, data usage consent will become fully optional. Existing users will be given the opportunity to review and update their consent preferences at that time.

5. How We Use Your Data

Your data is used solely for the following purposes:

• Authentication: To verify your identity and allow you to access your account securely.
• Image analysis: To process the images you upload and provide you with mole analysis results.
• Payment processing: To handle subscription payments for advanced features via our third-party payment processor.
• Subscription management: To determine which features you are entitled to access based on your subscription tier.
• Service operation: To maintain and improve the core functionality of the service.
• Machine learning model training and service improvement (where consented): Where you have given consent, your anonymised images and analysis results may be used to train our proprietary machine learning models, improve analysis accuracy, and develop new features. This processing only occurs where you have explicitly opted in, or where you have registered under the early access programme in which this consent is a mandatory condition. Our machine learning models and any associated training data are never shared with third parties.

We do not use your data for marketing, profiling, automated decision-making with legal effects, or any purpose beyond what is described in this policy.

6. Payments and Subscriptions

Some features of Mole Detective require a paid subscription. Payments are processed securely by a third-party payment processor. We do not store your full card number, CVV, or any other sensitive payment card details on our systems.

Our payment processor acts as a data processor on our behalf and is bound by a data processing agreement. They are compliant with the Payment Card Industry Data Security Standard (PCI DSS).

We retain a record of your subscription status, billing history, and any transaction identifiers provided by our payment processor for the purposes of account management and legal compliance. This data is retained for as long as required by applicable financial and tax regulations, even after account deletion.

7. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract (Article 6(1)(b)): Processing your account information, uploaded images, and payment details is necessary to provide the service you have signed up for.
• Explicit consent (Article 6(1)(a) and Article 9(2)(a)): We rely on your explicit consent to process your skin images as special category health data, and where applicable, to use your anonymised data for machine learning model training and service improvement purposes. You may withdraw consent for analysis at any time by deleting your images or your account. For early access users, consent to data usage for machine learning model training is a mandatory condition of the programme and cannot be withdrawn whilst remaining on the early access plan.
• Legal obligation (Article 6(1)(c)): We may be required to retain certain financial records (such as payment history) to comply with tax and accounting obligations.
• Legitimate interests (Article 6(1)(f)): We may process minimal technical data (such as error logs) to ensure the security and stability of the service.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can view all data associated with your account at any time from within the application.
• Right to rectification: You can update your account information directly within the application.
• Right to erasure ("right to be forgotten"): You can permanently delete all of your data, including your account, uploaded images, and analysis results, by deleting your account from the account settings page. This action is irreversible. Please note that certain financial records may be retained for the period required by law even after account deletion. Anonymised data that has already been incorporated into machine learning model training may not be retrievable or removable, as it no longer exists as a discrete identifiable record.
• Right to data portability: You can export your data from within the application at any time.
• Right to restrict processing: You can contact us to request that we restrict the processing of your data in certain circumstances.
• Right to object: You can object to processing based on legitimate interests by contacting us.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time from your account settings. For early access users, withdrawal of data usage consent will require moving to a standard paid plan. Withdrawal of consent does not affect the lawfulness of prior processing.

To exercise any of these rights, you can use the self-service tools available in your account, or contact us directly at [email protected].

9. Data Retention

We retain your personal data only for as long as your account is active. When you delete your account, all associated data — including your email address, uploaded images, and analysis results — is permanently and irreversibly deleted from our systems.

We do not retain backups of deleted account data beyond our standard backup rotation period, after which all traces of your data will be fully removed.

An exception applies to financial and billing records, which may be retained for up to 7 years in accordance with UK tax and accounting legislation, even after your account has been deleted. These records will contain only the minimum information required to satisfy our legal obligations.

Anonymised data that has been used in machine learning model training is incorporated into model weights and parameters in a form that is no longer attributable to any individual. As such, it cannot be individually identified or removed following model training.

10. Data Security

We take the security of your data seriously, particularly given the sensitive nature of skin images. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These measures include:

• Encrypted storage of passwords using industry-standard hashing algorithms.
• Secure, encrypted transmission of data using HTTPS/TLS.
• Access controls to limit who can access personal data within our systems.
• Secure storage of uploaded images with access restricted to the account owner.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with our obligations under UK GDPR.

11. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for their own purposes. Your data may be shared with the following categories of third party only where strictly necessary:

• Cloud hosting providers: To store and serve the application and your data securely.
• Payment processors: To handle subscription payments on our behalf. They receive only the information necessary to process your payment and are bound by appropriate data processing agreements and PCI DSS compliance requirements.

Our machine learning models are proprietary and developed exclusively by Mole Detective. Neither our machine learning models nor any data used to train them is shared with, licensed to, or accessible by any third party under any circumstances.

All third-party processors are bound by appropriate data processing agreements.

12. International Data Transfers

We aim to store and process your data within the UK or the European Economic Area (EEA). If any data is transferred outside of these regions, we will ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.

13. Cookies

We use only the cookies that are strictly necessary for the operation of the service, such as authentication session tokens. We do not use tracking, advertising, or analytics cookies.

14. Children's Privacy

Our service is not intended for use by children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Given the sensitive nature of the health-related data we process, we strongly recommend that users under the age of 18 obtain parental or guardian consent before using the service.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or an in-app notification. We encourage you to review this policy periodically.

16. Right to Lodge a Complaint

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK's supervisory authority: