DermVault Privacy Policy

Last updated: 8 November 2026

DermVault is a clinical photo record for dermatologists and their clinic staff. It is developed by Dr Sanjai Maria Jeyen M ("the developer"). This policy explains what the app stores, where, and who can see it.

In short: everything you enter stays on your phone. The developer runs no servers and never receives your patients' data. Backups, if you turn them on, are encrypted on your phone and saved where you choose: your own Google Drive or your own phone.

Who this app is for

DermVault is for registered medical practitioners and the staff they authorise. It is not intended for patients or for children. It is a record-keeping tool. It does not diagnose, and it does not recommend treatment.

What the app stores

What you enter in the app:

Patient details: name, age, sex, an optional phone number, diagnosis tags.
Visit details: clinical photos, diagnosis, notes, treatment markers, severity scores, and the patient's consent choices with the date and doctor's name.
Follow-up reminder dates.
Profiles for the doctor and staff: name and role. Each profile's PIN is stored only as a one-way hash.
An activity log of actions taken in the app (for example "added visit", "exported PDF") with the profile name and time.

Where it is stored

All of the above is stored only on your phone, in storage private to DermVault that other apps cannot read. Android's own automatic cloud backup is switched off for DermVault so that patient data is not copied anywhere you did not choose.

The developer does not operate any server. The app contains no advertising, analytics, tracking, crash-reporting or third-party data collection tools. The developer cannot see, access or recover your data.

Backups (optional, chosen by you)

You can back up DermVault's data in three ways:

Google Drive: saved in DermVault's private app folder in your own Google Drive.
This phone: saved in the Download/DermVault folder on your phone.
A backup file that you share or save wherever you like.

Every backup is encrypted on your phone with AES-256 using a passphrase you choose, before it is saved or uploaded. Without that passphrase nobody can open it, including Google and the developer. A forgotten passphrase cannot be recovered.

Google user data

If you choose Google Drive backup, DermVault asks your permission to use Google Drive's app data folder (scope drive.appdata). DermVault uses this access only to save, list, download and delete its own encrypted backup files in that folder, at your request or on the schedule you set. It cannot see any other files in your Drive. Your Google account email is shown in the app so you know which account is used; it is stored only on your phone.

DermVault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is not transferred to the developer or to anyone else, not used for advertising, and not read by humans.

Other network use

Google Drive, only if you turn on Drive backup.
Google Fonts: the first time a PDF is made in Tamil, the app downloads a Tamil font from Google's servers. No patient data is sent.

Sharing and exports

PDFs, GIFs and backup files leave the app only when you share them yourself, using your phone's share options. You are responsible for where you send them.

Permissions

Camera: to take clinical photos. Photos only; no audio or video.
Photos / storage: to import photos you pick from your gallery.
Notifications: for follow-up reminders.
Fingerprint / face unlock (optional): to unlock doctor profiles. Biometric data never leaves your phone's secure hardware; the app only receives "yes" or "no".
Internet and network state: for Google Drive backup and the Tamil font.

Your responsibilities as a doctor

You decide what patient information to record and you are responsible for it under the laws that apply to you, including India's Digital Personal Data Protection Act, 2023 and the National Medical Commission's rules on patient confidentiality. Obtain your patients' consent before photographing them; the app records the consent you enter with each visit.

Keeping and deleting data

Data stays on your phone until you delete it:

Deleting a patient deletes their visits and photos from the phone.
Uninstalling DermVault deletes everything it stored on the phone.
Google Drive backups: open Google Drive → Settings → Manage apps → DermVault → Delete hidden app data.
Backups on the phone: delete the files in Download/DermVault.

Older copies inside existing backups remain until those backups are replaced or deleted.

Security

Each profile has its own PIN (stored hashed). The app locks itself after 5 minutes in the background, waits after repeated wrong PINs, blocks screenshots and screen recording unless a doctor allows them for a limited time, and hides its contents in the recent-apps screen. No method of storage is perfectly secure; keep your phone locked and up to date.

Changes

If this policy changes, the new version will be published at the same address and in the app, with a new "Last updated" date.

Contact

Dr Sanjai Maria Jeyen M
Email: dermvault.app@gmail.com