What this is, and what it is not

Last updated 29 August 2026. Written in plain language on purpose — if you cannot understand what a health app does with your data, the consent you gave it is not worth much.

SkinScan is not a medical device

Under EU Regulation 2017/745 (the Medical Device Regulation), software becomes a medical device when it is intended to diagnose, prevent, monitor, predict or treat a disease. Software intended for diagnosis or triage of a condition typically falls under Rule 11 and would need a notified body, a CE mark, and a clinical evaluation before it could legally be sold in the EU.

SkinScan is deliberately built to sit outside that. Its stated purpose is to record photographs of your skin over time and describe what is visible in them. It does not tell you what a lesion is. It does not give a probability of any disease. It does not tell you that anything is safe, benign, or ruled out. Every output is either a description of what a photograph shows, or a prompt to go and be examined by a person.

That is a real constraint on the product, not a form of words. The AI models are instructed never to name a condition, and the decision about what you are told to do is made by a fixed, published rule set based on the Glasgow 7-point checklist used by the NHS for referrals — not by a model.

The dermatologist review is a different thing

When you pay for a review, a dermatologist licensed in an EU member state reads your case and writes an opinion. That is a genuine clinical opinion from a genuine clinician, and it is theirs, not the platform’s. SkinScan operates as the software and payment layer between you and them. It is a remote, asynchronous opinion based on photographs, which is inherently more limited than an in-person examination — a dermatologist can and will tell you when they cannot answer from a photo and you need to be seen.

What it cannot do

• A phone photo is not dermoscopy. A dermatologist looking through a dermatoscope sees pigment structures under the surface that no ordinary camera captures.
• Amelanotic (colourless) and nodular melanomas often look unremarkable in photos and are exactly the ones these tools miss.
• Skin cancer is rare in the general population, so even an accurate tool produces far more false alarms than real finds. Treat a warning as a reason to get checked, not as a result.
• Most published skin-AI performance comes from datasets that under-represent brown and black skin. Accuracy is lower on darker skin and you should weight the tool's opinion accordingly.
• Nothing here can rule anything out. A reassuring result never means a lesion is safe.

If a spot is bleeding heavily, growing quickly, or you feel unwell with it, do not wait for this app. Contact a doctor, or in Greece call 166 (EKAB) for emergencies.

Why a warning is usually a false alarm

This is worth understanding before you use any skin app, including this one. Melanoma is uncommon in the general population. Suppose a tool correctly flags 90 out of 100 real melanomas, and wrongly flags 10 out of every 100 harmless moles. In a group of 10,000 people where 10 genuinely have a melanoma, it flags 9 of the real ones — and about 1,000 harmless ones. So fewer than 1 in 100 warnings is a real find.

That arithmetic is not a flaw in a particular product, it is what happens to any screening test applied to a low-prevalence population. It is why SkinScan words its highest outcome as “see a doctor promptly” rather than anything that sounds like a finding, and why you should treat a flag as a reason to book an appointment, never as a result.

Your photos

Photographs of your skin are “data concerning health” under Article 9 GDPR — special-category data that needs your explicit, specific consent. You give that consent once, at sign-up, and it is recorded with a timestamp and version so you can see exactly what you agreed to.

• Photos are stored in a private encrypted bucket hosted in the EU (Frankfurt). They are never publicly readable — the app mints a short-lived signed link each time you view one.
• GPS coordinates are stripped from every photo in your browser, before upload. They never reach the server.
• Your photos are never used to train any model, by us or by anyone else, and are never sold or shared for advertising.
• To produce a description, a photo is sent to the AI providers listed below over an encrypted connection, under their zero-retention API terms. It is not attached to your name or email.
• A dermatologist can only see your photos through a case you have paid for and submitted. Every such access is written to an access log that you can read.
• You can export everything or delete everything from Settings. Deletion removes the image files themselves, not just the database rows.

Who processes your data

Supabase (database, authentication and encrypted file storage, EU/Frankfurt); Vercel (application hosting); Stripe (payments — Stripe never receives your photos or health data); and for image description, Google (Gemini), OpenAI, Anthropic and OpenRouter. Nothing is sent to an AI provider until you press the button that asks for a description.

Terms, briefly

You must be 18 or older. Use SkinScan for your own skin, or for a child you are responsible for. Do not rely on it in place of medical care, and do not use it to decide against seeing a doctor. The free logging features are provided as-is with no warranty. Paid reviews are delivered by the reviewing clinician under their own professional responsibility and indemnity. You can close your account at any time; a paid case that has not yet been answered is refunded in full.

Contact

Questions, data requests, or a complaint about a review: hello@6x7.gr. If you are in Greece and unhappy with how your data was handled, you can complain to the Hellenic Data Protection Authority (dpa.gr).