Updated: 19 October 2026
Operator: Raisat Ramazanova, an individual developer based in Serbia. Contact: morphtrack.app@gmail.com.
This separate notice supplements our Privacy Policy. Health-related information can be protected even when an app is not a medical service.
We collect from you photos of skin/body areas, photo notes and dates, tracker names/goals, routine and ongoing factors, and optional profile details such as skin type, activity, sleep and smoking. These may describe physical conditions, symptoms, care or wellbeing. We also receive any health information you choose to include in a support request.
AI observations are derived from the photos and context submitted for an analysis. These inferences, and account identifiers linked to the journal, may also be consumer health data. We do not obtain your medical records from healthcare providers or buy health profiles from data brokers.
We use this information to store and display your private journal, compare selected photos, generate requested AI observations and answer your support requests. Necessary operational/security processing protects these features. We do not use it to determine eligibility for employment, insurance or credit.
We do not share consumer health data with affiliated companies. Payment/sign-in providers and Resend receive information necessary for those functions, not journal content through those functions. Website hosting/analytics is described in the general Privacy Policy.
We do not sell consumer health data or use it for advertising or model training. We do not authorise third parties to collect journal data through our service to track a person’s health-related activity over time across unaffiliated websites/apps. We do not use precise location or geofences to identify visits to healthcare facilities, or face recognition to identify people.
Collection or sharing must have the consent or other specific basis required by applicable law. An exception for processing necessary to provide a requested service, where available, does not authorise unrelated purposes or replace explicit consent required elsewhere. This policy and acceptance of Terms are not a substitute for a separate required consent. The current in-app consent setting covers optional AI sharing; it is not a general consent for all health-data processing.
AI sharing is optional. Disable future sharing in More → About → AI and your data. You can also contact us to withdraw consent or stop particular processing. Withdrawal does not undo earlier lawful processing or erase previously saved results; you can request their deletion too.
Email morphtrack.app@gmail.com, subject Privacy request, to request confirmation, access, correction, withdrawal or deletion. Where applicable, you may request a list of health-data recipients, including affiliates/third parties, and their contact details. Tell us the action you want; no new account or payment is required.
We verify identity proportionately through existing account access or verified control of its email, without requesting your password or unnecessary health details. An authorised representative may submit a request, subject to verification of authority. We do not discriminate for exercising these rights.
You can edit your profile/notes and delete content in the app. Report an inaccurate AI observation or delete it; we cannot guarantee that every generated statement can be edited in place. To remove the whole account, use More → Profile → Delete account. Deleting a photo alone does not remove associated AI results. See the deletion procedure.
We handle requests without undue delay. For applicable Washington health-data requests, the ordinary response period is 45 days from receipt. Under Nevada’s health-data rules, ordinary responses are due within 45 days after authentication, but deletion and notification to recipients are due within 30 days after authentication. A permitted extension is explained before the initial response period ends. Earlier applicable deadlines, including GDPR’s one-month response period, still apply.
We notify recipients of deletion where required. Any legally permitted delay for restricted backup copies is separate from active-data deletion; it is not permission to continue ordinary use. Under Washington’s rules this backup delay cannot exceed six months after authentication. We explain applicable exceptions rather than promising that every provider copy disappears instantly. The general Privacy Policy describes retention.
If we refuse your request, you may reply with subject Privacy appeal. We review it and explain the outcome within 45 days of receipt, or an earlier applicable deadline.
You may also complain to a competent authority. This is a right, not a required step, and our internal appeal does not limit your statutory complaint rights. The appropriate authority depends on the law that applies:
Residence is not always the only test of coverage. For example, Washington’s health-data law can also cover a person whose consumer health data is collected in Washington, even if they do not live there.
We notify you of material changes and identify their effective date. New categories or purposes are disclosed, and any required consent obtained, before the new processing begins. The revision date alone does not authorise new processing.