Security

Data Security & Controls

Health data requires strong protection. Here are the controls we use to safeguard it.

GDPR / DSGVO Framework

As a German company (drylabs GmbH), GDPR is our primary data protection framework. Our controls are designed to support applicable GDPR obligations.

Data Protection Principles

Purpose limitation — data collected only for specified, legitimate purposes
Data minimisation — only data necessary for the service is collected
Storage limitation — data retained only as long as necessary
Integrity and confidentiality — appropriate security measures at all times

Your Rights

Under GDPR, you have the right to access, rectify, erase, port, and restrict processing of your data. You can exercise these rights directly in the app or by contacting us.

Technical Security

Encryption at rest and in transit
Certificate pinning in the iOS app is an additional control intended to reduce man-in-the-middle risk
Row-level security authorizes authenticated app access by account role and active provider-patient relationships. Time-limited passport links use a separate bearer-access flow
EXIF metadata stripped from all photos before upload
Supported iOS and Android devices use operating-system authentication; Aesthetic Pass receives only the result
Encrypted daily backups with automated drift detection

Data Hosting & Delivery

Core application data is stored in Supabase's West EU (Ireland) region. Cloudflare provides global web delivery, protection, and image infrastructure; our Privacy Policy describes the safeguards used for international processing.

Not a Medical Device

Aesthetic Pass is not a medical device under EU Medical Device Regulation (MDR 2017/745). It is a record-keeping and information platform for aesthetic treatments. It is categorised as Health & Fitness on the App Store, not Medical.

International Privacy Approach

GDPR is our primary privacy framework. We use it as a baseline for platform controls while assessing additional obligations according to the user's location and the processing context.

سياسة الخصوصية شروط الخدمة Impressum الرئيسية