Privacy Policy

1. Introduction

Derascript LLC ("Dermascript Pro," "we," "us," or "our") operates the Dermascript Pro electronic medical record (EMR) and practice management platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By accessing or using the Service, you agree to the practices described in this policy.

2. Information We Collect

We collect information that you provide directly to us, including your name, email address, phone number, clinic name, and billing information when you register, request access, or subscribe to a plan. We also collect patient records, clinical notes, treatment data, before-and-after photographs, appointment details, and consent forms that you and your authorized team enter into the Service in the course of providing care.

We automatically collect certain technical data, such as device identifiers, IP addresses, browser type, and usage logs, to operate, secure, and improve the Service.

3. How We Use Your Information

• To provide, maintain, and improve the Service and its features.
• To authenticate users and enforce role-based, team-level access controls.
• To process subscription payments and issue billing receipts.
• To send service-related communications, including scheduling reminders and account notices.
• To monitor for fraud, abuse, and security threats.
• To comply with legal obligations and respond to lawful requests.

4. Patient Data & Security

Dermascript Pro is designed with security best practices for aesthetic and medical practices. When you enter patient information into the Service, you are the custodian of that data. We process patient data only as necessary to provide, maintain, and secure the Service on your behalf. We do not sell patient data and we do not use it for marketing. We employ encryption in transit and at rest, role-based access controls, and audit logging to help safeguard sensitive records.

5. Data Storage & Security

Data is stored on secure, encrypted cloud infrastructure. We use transport-layer encryption (TLS) for data in transit and encryption at rest for stored records and uploaded media. Access to production systems is restricted to authorized personnel under least-privilege controls and is logged. We implement reasonable administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of your data.

6. Data Retention

We retain your account data and the records you create for as long as your account is active or as needed to provide the Service. Upon account cancellation, you may export your data before termination. We may retain certain information after account closure where required by law or to fulfill legitimate business or legal obligations.

7. Sharing & Disclosure

We do not sell your personal information or PHI. We may share information with trusted service providers who process data on our behalf (such as hosting, payment processing, and email delivery) under contractual confidentiality obligations. We may disclose information where required by law, court order, or government regulation, or to protect the rights, safety, or property of our users and the public.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your personal information, and to receive a copy of your data. To exercise these rights, contact us using the details below. Account administrators may also manage team members and access permissions within the Service.

9. Children's Privacy

The Service is intended for use by licensed practitioners and authorized clinic staff. We do not knowingly collect personal information from children under 16. If you believe a minor has provided information to us, please contact us and we will take steps to delete it.

10. International Users

The Service is primarily directed to practices operating in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide a prominent notice within the Service. Continued use after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or your data, you may contact us at:

Derascript LLC
legal@dermascriptpro.com
dermascriptpro.com/contact