Privacy

Effective date: September 8, 2026

Dermis Health Inc (“Ester,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Ester iOS app, our website, and related consumer skin-wellness services that link to this Privacy Policy (collectively, the “Services”).

Important medical notice

Ester provides consumer skin-wellness information. The Services and their skin measurements, observations, summaries, and other results are cosmetic and informational only. They are not intended to diagnose, treat, cure, mitigate, or prevent any disease or medical condition and are not a substitute for advice, diagnosis, or treatment from a qualified healthcare professional.

Ester is not a healthcare provider, health plan, or healthcare clearinghouse. Information you provide through the consumer Services generally is not protected health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Who can use the Services

The Services are only for people who are at least 18 years old and have reached the age of majority where they live. We do not knowingly collect personal information through the Services from anyone who does not meet these requirements. If you believe a person under 18 has provided us personal information, contact us at hello@ester.health.

Information we collect

Account and profile information

We collect:

• Your account email address.
• Information used to sign in with Apple or Google, such as the identifier and authentication information those providers give us.
• Your preferred name.
• Your date of birth and biological sex, which we use as context for skin analysis.

Face scans and skin information

When you choose to take a scan, we collect:

• Photographs of your face and skin.
• Skin measurements and other results derived from those photographs, including measurements of visible characteristics such as pores, redness, lines, and uniformity.
• Capture context needed to produce and interpret results, such as timestamps and information about lighting, positioning, camera performance, and app version.

Face photographs and data derived from them may be considered biometric information or sensitive personal information under some laws. We use them to provide your requested scan, display your results and history, and support the Services. We do not use facial recognition to identify you as a unique person.

Ask Ester, shelf, and routine information

We collect:

• Messages you send to Ask Ester and the responses generated for you.
• Skincare products you add to your shelf.
• Routine information, including the products and steps you record.

Analytics and diagnostics

We use:

• PostHog for product analytics. PostHog receives app and feature-usage events linked to a user UUID so we can understand how the Services work and improve the experience. We do not use PostHog session replay.
• Sentry for crash reports, error monitoring, and performance diagnostics. This information can include device and operating-system details, app version, technical logs, error context, timestamps, and related diagnostic information.

Our website and Services also receive basic technical information needed to connect and operate, such as IP address, device type, operating system, and request timestamps.

Communications

We collect information you send when you contact us for support, submit feedback, or otherwise communicate with us.

How we use information

We use personal information to:

• Create, authenticate, and manage your account.
• Provide face scans, skin measurements, trends, product-shelf features, routines, Ask Ester, and other requested features.
• Personalize the Services using the profile and context you provide.
• Store and display your scan history, results, messages, products, and routines.
• Operate, maintain, secure, troubleshoot, and improve the Services.
• Measure product usage and performance.
• Respond to support requests and send administrative communications.
• Detect misuse, protect accounts, and enforce our Terms of Service.
• Comply with law and establish, exercise, or defend legal claims.
• Carry out another purpose that we clearly describe when asking for your consent.

Consent for scans and Ask Ester

Before the app sends face-scan photographs or Ask Ester messages to the service providers described below, we ask for your explicit consent in the app. You can decline that consent and continue using portions of the app that do not require those transfers.

You can withdraw your consent in Settings. Withdrawal blocks future transfers of scans and Ask Ester messages that rely on that consent. It does not undo processing that occurred before withdrawal. You can also delete your account as described below.

How we disclose information

We disclose personal information only as described here.

Service providers

• HautAI OÜ receives face-scan photographs, analyzes them in the European Economic Area (“EEA”), and returns derived skin measurements to Ester.
• Anthropic, PBC, through OpenRouter, Inc. receives the information needed to power Ask Ester, including messages you submit and relevant context supplied by the app, and returns generated responses.
• Amazon Web Services, Inc. (“AWS”) provides hosting and encrypted storage in the United States for account information, images, results, chat data, product-shelf information, and routine information.
• PostHog provides UUID-linked product analytics without session replay.
• Sentry provides crash, error, and performance monitoring.

These providers process information for Ester under contracts and instructions that limit their use of the information. They are contractually prohibited from using Ester users’ personal information to train their models or for their own advertising purposes.

Other disclosures

We can also disclose personal information:

• To lawyers, auditors, insurers, accountants, and other professional advisers who need it to provide services to us.
• In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law.
• When reasonably necessary to comply with law, legal process, or a valid government request; enforce our Terms; protect rights, privacy, safety, or property; or detect, prevent, or address fraud, security, or technical issues.
• At your direction or with your consent.

No sale or advertising use

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use face scans, skin measurements, chat messages, shelf data, or routine data to target ads. Our service providers are contractually prohibited from using this information for their own advertising.

Automated analysis and AI limitations

Ester uses computer vision and artificial intelligence to produce skin measurements and respond to Ask Ester messages. Results can be incomplete or inaccurate and can be affected by lighting, camera quality, positioning, cosmetics, facial hair, device performance, connectivity, and other factors. The Services might not detect every visible characteristic or change.

Automated analysis does not make decisions that produce legal or similarly significant effects about you. Results are cosmetic and informational and are not a medical diagnosis.

Data retention and deletion

While your account is active

We retain your profile, face-scan photographs, derived skin measurements and results, Ask Ester chat history, product shelf, and routine information while your account is active so you can use the Services and view your history. Because face photographs can be considered biometric data under some laws, the same active-account and deletion rules apply to them and to any biometric-related data derived from them.

Analytics, diagnostics, support communications, security records, and legal records are retained only for as long as reasonably necessary for the purposes described in this Policy and to meet applicable legal, security, accounting, or compliance requirements.

Account deletion and 30-day grace period

You can delete your account in the app under Settings. Your access ends and active sessions are signed out when you start deletion. We keep the account and its data for a 30-day grace period to protect against accidental deletion. Signing in during that period restores the account.

At the end of the 30-day grace period, Ester permanently deletes the profile and Ester-held face scans, captured images, derived measurements and results, Ask Ester chat history, product-shelf data, and routine data associated with the account. After permanent deletion, signing in with the same email address or Apple or Google identity creates a new account with no access to the deleted data.

HautAI processor deletion

After Ester permanently deletes an account, HautAI subjects and images associated with that account are deleted through a documented monthly operator process. That deletion occurs no later than 31 days after Ester’s permanent account deletion. You can request expedited processor deletion by emailing hello@ester.health.

Deletion does not reverse de-identification or aggregation completed before the request when the resulting information can no longer reasonably be linked to you.

De-identified and aggregated information

We can create de-identified or aggregated information that cannot reasonably be linked to you. We use this information for analytics, research, product development, security, and business operations and do not attempt to re-identify it except to test our de-identification processes or as permitted by law.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encrypted storage for account and scan data. No transmission or storage system is completely secure, so we cannot guarantee absolute security.

Your privacy rights and choices

Depending on where you live, you can have the right to:

• Access or obtain a copy of personal information we hold about you.
• Correct inaccurate personal information.
• Request deletion of personal information.
• Restrict or object to certain processing.
• Withdraw consent when processing is based on consent.
• Opt out of marketing communications.
• Appeal a decision about a privacy request where required by law.

You can withdraw scan and Ask Ester consent or begin account deletion in Settings. For other privacy requests, email hello@ester.health. We can ask you to verify your identity before completing a request. Where the law permits, you can use an authorized agent. We will not discriminate against you for exercising a privacy right.

California privacy notice

California law requires additional information about categories of personal information. During the 12 months before this Policy’s effective date, we collected the following categories for the purposes described above:

We collect these categories from you, your device, Apple or Google when you use their sign-in services, and the service providers described above. We use and disclose them for the business purposes described in “How we use information” and “How we disclose information.” We do not sell personal information or share it for cross-context behavioral advertising. We use sensitive personal information only to provide and operate the Services, maintain security, comply with law, and carry out purposes you authorize.

California residents can request access, correction, deletion, or a copy of covered personal information by contacting hello@ester.health. They can also use the in-app controls described above.

International data transfers

Ester is based in the United States, and AWS stores account and Service data in the United States. HautAI analyzes scan photographs in the EEA. Anthropic and OpenRouter process Ask Ester information to provide generated responses. When personal information is transferred across borders, we use safeguards required by applicable law, including contractual protections where applicable.

Third-party links and sign-in services

The Services can link to third-party websites or services and allow sign-in through Apple or Google. Those companies’ handling of information for their own purposes is governed by their privacy policies. We are not responsible for third-party services that are not acting as Ester’s service providers.

Changes to this Privacy Policy

We can revise this Privacy Policy as the Services or legal requirements change. The effective date at the top identifies the current version. If a change materially affects your rights or how we use personal information, we will provide notice as required by law, such as through the app, by email, or on our website.

Contact us

For questions, privacy requests, or an expedited processor-deletion request, contact:

Dermis Health Inc
1232 El Vago Street
La Cañada, CA 91011
United States

Email: hello@ester.health