Privacy Policy

1. Who we are and what the app does

The data controller is DAPSIS MED SRL, company registration number (CUI) 43754997, with its registered office at Str. Biruinței nr. 3, bl. 4, sc. 2, et. 1, ap. 19, Popești-Leordeni 077160, Romania. EsteTrue, available at https://estetrue.com and in the phone apps, includes the public map of aesthetic medicine doctors, verified reviews, the “Natural or not?” game, simulations on your photo, a token wallet and the doctor area, where a clinic keeps its patients, procedures and photos.

For the clinical record a doctor keeps in the app about their patients, the clinic decides what data it keeps and why, and we process it on the clinic's behalf. For all other data in this policy, we are the controller.

We have not appointed a data protection officer. For any question about your data, write to us at app@estetrue.com.

2. What data we process

We only process the data the feature you use needs. By category:

Your account

• Name, email address and phone number. The phone number is optional, except for a patient invited by a doctor, for whom it is required.
• Your password, stored only in cryptographic form, or sign-in with your Google account, if you choose that method.
• The second authentication factor, if you use one.

Identification of a patient invited by a doctor

• Personal numeric code (CNP), date of birth and sex, filled in when accepting the invitation, so the clinical record belongs to the right person.

Health data

• Procedures, treatment history, appointments and notes, entered by the doctor in your record. These are health data within the meaning of Art. 9 GDPR.
• Before and after photos, uploaded by the doctor or by you, stored in the clinic's private space.

Messages

• Messages between you and your doctor, in the app.

Reviews

• The review text and rating. A review you choose to publish appears publicly on the doctor's profile.
• Proof of visit: a photo of the receipt, read automatically on our server, a QR code or a code received at the front desk.
• The writing assistant, when the feature is active: if you use it, the review text, without data that identifies you, is sent to Anthropic so you get suggestions.

The “Natural or not?” game

• The photos you upload, your votes and your reports.
• Device attestation, when the feature is active, through Play Integrity on Android and App Attest on iPhone, to limit automated voting.
• Selfie verification, when active: the provider Didit compares a selfie with your photo, and the images are kept neither by them nor by us.

Simulations

• The photo you choose and the simulation results. The steps and providers are described in section 15.

Token wallet

• Token balance and history: purchases, rewards, spending. Card payment happens on the website, with Stripe; card details never reach us.

Saved lists and alerts

• The doctors and procedures you save and the alerts you set.

Usage, device and location

• Pages visited, the source of the visit (the site you came from, campaign parameters) and in-app events (for example a search started or an account created), linked to your account when you are signed in.
• City and country, derived from your IP address and stored with the visit. The IP address itself is not stored in these statistics.
• Device type, operating system, browser and page performance measurements (Web Vitals).
• Error logs, stripped of personal data before they are sent to Sentry.
• The notification identifier of your phone, if you accept notifications.
• Precise location, only when you tap “Near me” on the map: your phone turns it locally into a map area, and the server only receives the rounded edges of that area. We do not store it.

We do not collect your contact list, your phone calendar or the advertising identifier, and we do not sell personal data.

3. Cookies and statistics

We use two first-party cookies for statistics: af_vid, a random visitor identifier kept for 400 days, and af_sid, which groups visits into a session and expires after 30 minutes of inactivity. The af_vid cookie is signed, so it cannot be forged. When you open a link that carries a ref parameter (the code of the person who sent it) or UTM parameters (the source, channel and place the link came from), we keep them together with the visit, so we know which link you came from. When you create an account we link the visitor to the account, and the “who brought whom” relationship is kept together with the data on the steps you take in the app.

We also use cookies and local storage that are strictly necessary for sign-in and for preferences such as language and theme. We do not use advertising cookies.

4. Purposes and legal bases

For each purpose, the legal basis under the GDPR:

• Your account and the app's features (the map, reviews, the game, the wallet, messages, the doctor area): performance of a contract, Art. 6(1)(b).
• Health data and clinical photos: your explicit consent, Art. 9(2)(a), and, for the record kept by the doctor, the clinic's legal obligations regarding medical records.
• Simulation and selfie verification: your consent, given before you upload the photo, which you can withdraw at any time.
• Usage statistics, statistics cookies and performance measurements: our legitimate interest in understanding how the app is used and improving it, Art. 6(1)(f).
• Security, fraud prevention and content moderation (rate limiting, device attestation, automated photo checks, proof of visit for reviews): legitimate interest, Art. 6(1)(f).
• Keeping medical and accounting records: legal obligation, Art. 6(1)(c).
• Account emails (invitations, confirmations, notices about a request you made): performance of a contract.

We do not make decisions based solely on automated processing that have legal effects on you. The automated check can reject a photo; you can write to us to ask for a review by a person.

5. Who processes data on our behalf

The providers below process data only on our behalf and on our instructions. We do not sell them data or give them data for their own purposes.

• Supabase: database, file storage and authentication, including sending verification codes by SMS or WhatsApp through its messaging provider.
• Vercel: hosting of the website and the app server; it receives requests and derives country and city from the IP address.
• Stripe: card payments, on the website.
• Sentry: error logs.
• Resend: sending emails.
• Upstash: limiting the number of requests, against abuse.
• Google: Firebase Cloud Messaging (notifications on Android), Play Integrity (device attestation on Android, when the feature is active), Cloud Vision (automated checks of game photos, when the feature is active) and sign-in with your Google account.
• Apple: App Attest (device attestation on iPhone, when the feature is active).
• Amazon Web Services (Amazon Rekognition): automated checks of game photos (nudity, faces, apparent age), before they are published.
• Didit: selfie verification, when the feature is active, without keeping the images.
• kie.ai (NEXUSAI SERVICES LLC), OpenAI and Amazon Web Services (Amazon Rekognition): the simulation, described step by step in section 15; kie.ai and OpenAI, when the feature is active.
• Anthropic: the review writing assistant, when the feature is active, without data that identifies you.

Map images come from OpenFreeMap: your browser downloads them directly, so the service sees your device's IP address.

Some data becomes public because you choose to publish it: a review appears on the doctor's profile, and a game photo appears in the game. Your doctor sees the data in your record and the messages you send them.

6. Transfers outside the European Economic Area

The database and the app server are hosted in the European Union, in Ireland. The automated check of simulation photos and game photos through Amazon Rekognition runs in Germany (Frankfurt). Some providers in section 5 are based or have servers outside the European Economic Area, mainly in the United States.

For these transfers we rely, as applicable, on the European Commission's adequacy decision for providers certified under the EU-US Data Privacy Framework, or on the standard contractual clauses adopted by the European Commission. You can ask us for details about the safeguards used for a specific provider.

7. How long we keep data

• Your account and its content: as long as you have an account. After a deletion request, 30 more days, then it is deleted automatically (section 8).
• The clinical record and clinical photos: 10 years, under Romanian law on keeping medical records. They stay with the clinic after your patient account is deleted, with no link to it. When a doctor deletes their account and is the clinic's only doctor, the clinic's records are deleted with their account; keeping them for the legal period is the clinic's responsibility.
• Simulations: until you delete them from the gallery or delete your account.
• Game photos that were rejected: deleted automatically; those held for review stay in a private area for at most 30 days.
• Usage statistics: raw events (pages visited, in-app events, performance measurements) for 90 days. Per-session summaries, without the IP address, are kept permanently for long-term statistics, as are the source (ref and UTM) and the “who brought whom” relationship; only the raw events are deleted after 90 days. The af_vid cookie expires after 400 days, af_sid after 30 minutes of inactivity.
• Interest in public profiles (views and contacts, without a visitor identifier): 90 days, after which only monthly totals remain.
• Error logs: 90 days.
• The token ledger and payments: the ledger stays for accounting, with no link to the person after the account is deleted; payment records stay with Stripe for as long as tax and accounting law require.
• Backups: deleted data may remain in database backups until they are automatically overwritten.

8. Deleting your account

You delete your account in the app: “Settings”, “Account & security”, then “Request account deletion” (for doctors, “Delete account permanently”). For 30 days you can cancel with “Cancel deletion”; after that, deletion happens automatically.

The full steps, what we delete and what we keep, plus how to ask by email without the app, are on the account deletion page.

9. Your rights

Under Art. 15-22 GDPR, you have the right:

• to know what data we hold about you and to receive a copy (Art. 15);
• to have inaccurate data corrected (Art. 16);
• to have your data erased (Art. 17);
• to restrict processing (Art. 18);
• to receive your data in a format you can move to another service (Art. 20);
• to object to processing based on our legitimate interest (Art. 21);
• not to be subject to a decision based solely on automated processing (Art. 22);
• to withdraw your consent at any time, without affecting processing carried out before.

10. How to exercise your rights

Write to us at app@estetrue.com. We reply within 30 days at most; for complex requests the deadline can be extended by up to 60 days, with prior notice. So that we do not give your data to someone else, we may ask you to confirm that the address or the account is yours.

11. Complaint to the supervisory authority

If you are not satisfied with how we process your data, you can contact the supervisory authority in Romania:

ANSPDCP, the National Supervisory Authority for Personal Data Processing
Website: https://www.dataprotection.ro
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania

12. Children

The app is for people aged 18 and over. We do not knowingly collect data from minors. If you find out that a minor has given us data, write to us and we will delete it.

13. Security

• Encryption in transit (HTTPS) for all communications.
• Encryption at rest, on the database infrastructure.
• Account-based access, with row-level rules in the database: everyone sees only the data they are entitled to.
• Logging of sensitive actions.
• Security reviews before launching features that touch sensitive data.

14. Changes to this policy

We update this policy when the app or the law changes. With each update we change the date in the header, and we announce significant changes in the app. The current version is always at this address.

15. Simulation: what happens to your photo

If you use the simulation feature, your photo goes through several steps, described below in the order they happen.

1. The feature contour is calculated in your browser; the photo doesn't leave your phone for this step.
2. For simulation, the photo you choose is sent to the application's server, hosted on Vercel, where a separation model we run tells the person apart from the background; the photo is processed only in memory, is not saved and does not reach another provider, and from this step we only keep the count of quality warnings, without the photo and without data that identifies you.
3. Automatic photo verification, before generation, goes through the Amazon Rekognition service, from Amazon Web Services (AWS).
4. Generation: the photo you chose is sent to kie.ai (NEXUSAI SERVICES LLC, USA), which forwards it to the chosen image model. If the model refuses or the service is unavailable, we use the fallback model, GPT Image 2, from OpenAI; the route may be moved to go directly to OpenAI.
5. Storage — the results and the original photo stay in the app's private storage, visible only to you, until you delete them from the gallery.
6. The mark — every generated image carries a visible mark and a C2PA manifest declaring it was generated with artificial intelligence.