Your skin data stays yours.
Your face and skin images are clinical data, and we treat them exactly that way.
Effective 26 August 2025 · Data Protection Officer: dpo@oysterskin.com
What we collect
To give you a skin analysis and matched products, we collect a handful of things: your basic account details, the skin and face images from your scan plus the attributes we derive from them such as skin type and concerns, lifestyle inputs you choose to share, your shopping activity, how you use the app, and standard technical data like device and app version.
How we use it
We use your data to run the analysis, personalize your results and product matches, power the shop, support you, keep improving our models, understand how the app performs, send you updates where you have opted in, and meet our legal and fraud-prevention duties. We rely on your consent, our contract with you, and legitimate interest as the legal bases, depending on the purpose.
Your photos
Your scan images are treated as private, medical-grade data. They are encrypted, never sold, and kept for up to 24 months unless you delete them sooner or choose to keep them longer. Anything we retain to improve the models beyond that is fully anonymized so it can never point back to you.
Sharing
We do not sell personal data. We share it only with the vendors and technology providers that help us run Oyster, with regulators where the law requires, and in the event of a corporate change like a merger. Every third party we work with is bound by a data-protection agreement.
Your rights
You can ask to access, correct, delete, restrict, port, or object to the use of your data, and you can withdraw consent or request human review of any automated decision at any time. Email dpo@oysterskin.com and we will respond within the timelines the law sets.
Delete my data
You are always in control of your images and your account. To delete them, open the app and remove your scans from your profile, or email dpo@oysterskin.com from the address on your account with the subject line "Delete my data." We will confirm and erase your personal data, keeping only what the law requires us to hold or fully anonymized records that can no longer identify you.
POPIA, NDPA & GDPR
Oyster is built to comply with South Africa's POPIA, Nigeria's NDPA 2023 and NDPR, Rwanda's Data Protection Law No. 058/2021, and the EU GDPR, with in-region data hosting available. For anything privacy related, our Data Protection Officer is one email away at dpo@oysterskin.com.