GDPR Compliance Statement
GDPR Information Statement
Data Protection in the European Union
Miiskin Group ApS — Effective October 23th, 2026 for patients registered before September 18th, 2026, and upon registration for patients registered after the date.
Miiskin Group ApS (“Miiskin”) is a company registered in Denmark and is the controller of the personal data described in this statement. This statement explains how Miiskin applies the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Danish Data Protection Act.
Everyone who uses the Platform here is a User. Because Miiskin offers no consultations in the European Union or the European Economic Area, there are no patients here, only Users. “User Data” means all information and images you submit to, or generate through, your own account. User Data is yours, and you may permit any person to use it. Miiskin’s documents for the United States and Mexico use the term Patient Data for the equivalent information, because a person who has a consultation there is a patient. In the European Union and the European Economic Area there are no consultations, no patients and no Patient Data; there is only User Data.
This statement is a summary. Miiskin’s Privacy Information is the full account of what Miiskin collects, why, how long it is kept, and what rights you have, and it governs where the two differ. Where a term is defined in Miiskin’s Terms of Service and Usage Guidelines, it has the same meaning here.
1 Who This Applies To
The GDPR applies to Miiskin’s processing of personal data about individuals in the European Union and the European Economic Area, and to Miiskin’s own processing as a company established in Denmark. Miiskin applies the standards in this statement to all Users wherever they are, except where a local law requires a different or more protective approach.
Miiskin does not offer medical consultations in the European Union or the European Economic Area. If you are here you are a User, not a patient. You use the Platform for self-monitoring: you keep and compare your own images, you have no dermatologist through Miiskin, and you have no medical record with Miiskin. Miiskin is not a health care provider to you and does not practice medicine. Miiskin’s HIPAA Information Statement, which concerns United States health information law, does not apply to you.
2 How Miiskin Processes Personal Data
Miiskin processes personal data lawfully, fairly and transparently, and only for specified, explicit and legitimate purposes connected with operating the Platform. Those purposes are set out in the Privacy Information.
Miiskin applies the principles of data minimisation, purpose limitation, storage limitation, accuracy, integrity and confidentiality, and accountability. Miiskin implements appropriate technical and organisational measures, including encryption in transit and at rest, access control, logging, secure storage, and contractual protections with the processors it engages.
Miiskin does not sell personal data and does not sell special category data. Miiskin uses personal data, including for information and promotional purposes and in campaigns, only with your consent, which you give separately for that use and may withdraw at any time. Withdrawal applies to future use. Otherwise, personal data is shared only where it is necessary to provide the Services, with a dermatologist you have chosen, with a processor acting on Miiskin’s instructions under a written contract, or where the law requires or permits it.
3 Special Category Data
As a skin health platform, Miiskin processes data concerning health, including images of your skin and, where you choose to take them, images that show part of your face. This is special category data under Article 9 of the GDPR.
Miiskin processes it only on the basis of your explicit consent under Article 9(2)(a), given when you create an account and when you use a particular feature. Because Miiskin provides no health care here, it does not rely on Article 9(2)(h).
Where Miiskin relies on your consent, you may withdraw it at any time, and withdrawing is as easy as giving it. Withdrawal applies to future processing and does not make earlier processing unlawful.
4 Your Rights
Under the GDPR you have the right to be informed about how your personal data is used; to obtain a copy of it; to have inaccurate data corrected; to have data erased in the circumstances the GDPR allows; to have processing restricted; to object to processing carried out on the basis of legitimate interests; to receive your data in a portable form and have it transmitted to another controller where that is technically feasible; to withdraw consent; and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
Miiskin does not make any decision about you based solely on automated processing.
Miiskin responds to a request within one month. Where a request is complex or where you have made several, Miiskin may extend that period by up to two further months and will tell you within the first month if it does.
One limit applies to erasure. Miiskin may keep data where the law requires it, or where it is needed to establish, exercise or defend a legal claim. It will tell you which applies.
5 Making a Request
To exercise any right, write to Miiskin at [email protected]. Miiskin may ask you to confirm your identity before acting on a request, and will not use the information you give for that purpose for anything else.
Miiskin does not charge for responding to a request. Where a request is manifestly unfounded or excessive, Miiskin may charge a reasonable fee or decline to act, and will explain why.
6 International Transfers
Where Miiskin transfers personal data outside the European Economic Area, it does so on the basis of an adequacy decision of the European Commission, or under the European Commission’s standard contractual clauses together with any additional measures that are necessary, or where another lawful transfer mechanism applies.
7 Complaints
If you are not satisfied with how Miiskin has handled your personal data, tell Miiskin first at [email protected] so that it has the chance to put the matter right.
You may also complain to a supervisory authority. Miiskin’s lead supervisory authority is the Danish Data Protection Agency:
• Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark. Telephone +45 33 19 32 00. Email [email protected].
You may also complain to the supervisory authority in the European Union or European Economic Area country where you live or work, or where you believe the GDPR has been breached.
8 Keeping This Statement Current
Miiskin reviews this statement at least once every twelve months and whenever its processing changes materially. Where a change is material, Miiskin will tell you before it takes effect.
9 User Data – No Data Protection Officer
Miiskin holds your User Data in its own right, under this statement and the Privacy Information, and not on behalf of any health care provider. There is no second capacity: because Miiskin provides no health care here, it never holds information about you on behalf of a dermatologist or any other provider, and you have no medical record with Miiskin.
“Platform” means the software, systems, interfaces and infrastructure Miiskin makes available. Miiskin does not practice medicine.
Miiskin has assessed its activities against Article 37 of the GDPR and has concluded that it is not required to appoint a Data Protection Officer. Its core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data within the meaning of that Article. Miiskin keeps a record of that assessment and reviews it whenever its processing changes materially, and in any event on the twelve-month review in the Section above.
10 Contact
Miiskin Group ApS, Østerfælled Torv 4, 2100 København Ø, Denmark. Email [email protected]. Privacy questions are handled by that contact.
11 Previous version
This statement replaces the GDPR Compliance Statement published at miiskin.com and last updated before the date shown at the top of this document. That statement was a short summary of Miiskin’s approach to the GDPR; this one sets out the same commitments in full, aligns the defined terms with Miiskin’s other documents, and states expressly that Miiskin offers no consultations in the European Union or the European Economic Area. It takes effect on the date shown at the top of this document.
