Privacy Policy

This policy explains what DermLiving collects when you use dermliving.com and the DermLiving API at api.dermliving.com, including its MCP endpoint, and what we do with it. DermLiving is a portfolio company of Do Industries, Inc., a Delaware corporation. In this policy, "DermLiving", "we" and "us" mean both Do Industries, Inc. and DermLiving.

What we collect

When you browse dermliving.com

Cloudflare serves the website for us. Like any web server, it receives your IP address, the page you ask for, your browser's user agent and similar request details. Cloudflare keeps request logs for us for a short period, and we use them only to run and debug the site.

The site sets no cookies. It loads no analytics, tracking pixels or advertising scripts, and its fonts are served from dermliving.com itself.

What your browser keeps

The site remembers a few preferences in your browser's local storage: the code language you picked in examples, and the playground's theme, layout and target. The playground also keeps your recent requests there (the route and the values you entered) so you can replay them. An API key you paste into the playground is never saved.

This data stays on your device and is never sent to us. You can clear it at any time in your browser's settings.

When you call the API or the MCP endpoint

To answer a request, the API reads it. Here is what happens after that:

• Our access log records the route pattern (for example /v1/evidence/{id}), the method, the response status and time, a request id and the caller's tier. For an identified caller, it also records a key id or a one-way digest of their identity id. It never records your question or search text, request bodies, credentials or your IP address.
• Rate limits: for callers who send no key, the API counts requests by IP address. That count is held in memory only and is never written to storage or logs.
• Cloudflare's request logs for the API can include the requested URL. For routes that take a query string, such as /v1/terminology/map?text=eczema, that URL contains what you searched for. We use these logs only to run and debug the service.

When you send an id.org.ai identity

If you send a bearer token that is not a DermLiving key, the API passes it to id.org.ai, the identity service we use, to verify it, and gets an identity id back. We log only a one-way digest of that id. id.org.ai's own terms and policies cover the identity you created with it.

The sign-up forms

The practitioner network and careers forms are not open yet. If you submit one, the site checks the fields and tells you that sign-ups are not open. It does not store or forward what you entered. To limit repeated submissions, it uses your IP address briefly in memory.

Before these forms open, we will update this policy to say what we keep, why, for how long and how to have it removed.

Patient information

DermLiving is reference knowledge for software. It is not a medical service. Do not send patient information, or anything else that identifies a person's health. The Service is not set up to receive protected health information, and the sandbox holds synthetic data only.

When a question appears to contain patient identifiers, the API declines to answer, with reason patient_data, and nothing from the request is stored.

How we use information

We use the information above to:

• deliver the website and the API;
• keep them secure and apply rate limits;
• find and fix problems;
• understand overall usage, such as request counts and error rates by route.

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We do not use your requests to train models.

Who we share it with

• Cloudflare, Inc. hosts the website and the API and processes request data to deliver them, under its own privacy policy.
• id.org.ai verifies identity tokens that you choose to send.
• Authorities, when the law requires it, or to protect the Service, our users or the public from harm or abuse.
• A successor: if DermLiving or Do Industries, Inc. is reorganized, merged or sold, the information can pass to the successor, which remains bound by this policy.

How long we keep it

• Request logs: kept by Cloudflare for our account for a short period (days, not months), then deleted automatically.
• Rate-limit counts: held in memory and discarded when the server instance that holds them is recycled.
• Your browser's storage: stays on your device until you clear it.

Your choices and rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you;
• have it corrected or deleted, or receive a copy;
• object to or restrict how we use it.

We keep very little, so most requests are simple to answer. We will not treat you differently for making one. See Contact below.

Children

The Service is for software developers and professionals. It is not directed to children, and we do not knowingly collect information from anyone under 16.

Security

The website and the API are served over HTTPS. Credentials are never logged, and API keys are stored only as hashes. No system is perfectly secure, so please don't send anything the Service does not need.

Where data is processed

Cloudflare serves the Service from data centers around the world, so request data can be processed outside your country, including in the United States.

Changes to this policy

When we change this policy, we update the date at the top. If a change is material, we say so on this page before it takes effect.

Contact

We are setting up email for dermliving.com. When it is live, this section will give the address for privacy and legal requests. Until then, the site's forms are closed and the Service collects no account or contact details.