Straight answers about patient data.

It is the workspace for your practice. You keep patient records, capture or upload facial scans, read the analysis and build treatment plans. The indices are FAI®, FYI® and SQI®. The iPhone app Caarisma MED Scan takes the photos at the chair and sends them into the same record.

No. The analysis is a guide for an aesthetic conversation. It does not replace an examination, and a score on its own is not a diagnosis or a decision to treat. The same note is printed on a treatment plan.

Only people with an account in your organization, each signed in as themselves. Roles are Owner, Admin, Billing admin, Member and Read only. Give each person the smallest role that covers their work.

One organization's records are kept separate from every other organization. Someone in two practices switches between them and does not see both at once. When a colleague leaves, remove the account or take the seat back under Settings › Organization › Team. They can no longer sign in. The records stay with the practice.

Yes. A patient number is enough to create a record. Name, date of birth and contact details are optional. Ethnicity can be left empty; the analysis still runs, on the default reference model. Tags, turned on under Settings › Preferences, are a simple way to mark everyone in a study or a treatment group.

Your practice decides why the data is processed and on which legal basis, including consent where you need it. ICA Aesthetic Navigation GmbH processes the data on your instructions.

In a study, the institution is responsible, and the ethics approval and the consent forms are the institution's. We can describe the data flow so you can attach it to those documents. This page explains the product. It is not legal advice.

Each person has their own account. The access credential expires after 2 hours. The app renews it while you stay signed in, so you are not asked for a password every two hours. Sign out on a shared computer when you are finished.

From the app or the browser it is sent to our application server over an encrypted connection (HTTPS). From there it is forwarded, again over HTTPS, to the image-analysis service, which is also protected by an API key. The result comes back to our server over HTTPS and appears on the patient record, usually within a minute or two. You can keep working while that happens.

A photo taken through your patient scan link follows the same path. That link is optional: you can pause it. Demo mode, for an event, asks only for age, sex and an optional email.

The analysis service receives the images, sex, age, ethnicity if you entered it, and the scan type. It does not receive the name, the date of birth or contact details. Leave ethnicity empty if you do not want it sent.

Every connection is encrypted with TLS: from the app to our server, and from our server to the analysis service.

In the standard setup the image is passed straight through to the analysis service. We do not keep a separate image file on our server. The analysis service stores it with Microsoft Azure's standard storage encryption.

A practice can be switched to a second setup, in which we do keep a copy. That copy is encrypted with AES-256-GCM. Each organization has its own key, and each image has its own key on top of that. The key that wraps them is not stored in the database. Ask us if you want this setup for your practice or for a study. It is not the setup a new practice starts on.

The application and its database are hosted by Strato AG, in data centres in Germany. The image analysis runs on Microsoft Azure, inside the EU or the EEA. The exact Azure region is named in the subprocessor list we attach to a data-processing agreement.

For a Swiss institution, the Federal Council recognises Germany as providing adequate data protection.

Strato AG, in Germany, hosts the application and the database.

The image-analysis service, hosted on Microsoft Azure in the EU or the EEA, receives the scan and returns the result. We work with that provider under a data-processing agreement. Its legal name is in the subprocessor list we attach to that agreement.

If someone uses AI treatment suggestions, that request goes to Anthropic. It contains the treatment areas and your treatment catalogue, including method and cost. It does not contain the photo, the name or contact details.

Invitations and other system emails are delivered by an email service. That service sees the recipient's email address, not scan images.

If you pay for a licence by card, Mollie handles the payment. Mollie does not receive patient scans.

For a study, we introduce a new or replacement subprocessor only after telling the institution, and the institution can object. The same rule can be written into a practice agreement.

No. A suggestion is built from the treatment areas already on the plan and from the treatments in your catalogue. The photo and the patient's identity are not part of that request. The feature is optional. You can leave it unused, or turn treatment plans off under Settings › Preferences. A study organization that should not use it can have the feature switched off.

An organization admin sets this under Settings › Organization. There are three choices, and only one can be active.

None is the default. The photo is analysed as it was taken.

Anonymize blacks out the eye region and replaces the background with neutral grey on our server, before the image is forwarded. If that step does not succeed, the upload stops and nothing is forwarded. The reduced image then stays at the analysis service until you delete the scan. Covering the eyes does not make the photo anonymous. A face image is still personal data. This is a way to collect less, not anonymisation in the legal sense.

Delete sends the photo for analysis and then removes the analysis service's copy. We keep the analysis result. It does not also black out the eyes.

If a study needs the eyes covered and the image removed from the analysis service straight after the result, tell us before you start. The product cannot do both at once today.

For as long as your practice keeps them. A patient or a scan does not expire on its own. You delete what you no longer need.

For a study, we keep the data for the time you agree, or until the institution tells us to delete it. Backups are encrypted, taken daily, and overwritten after 30 days.

Deleting a scan removes the record, the image, the analysis and any treatment plan built on that scan. We also ask the analysis service to delete its copy. Deleting a patient removes their scans in the same way.

A deleted record can still sit in a backup until that backup is overwritten, which is within 30 days.

Yes. On the Patients page, the menu exports your patient list by email, and exports statistics or treatment plans as a spreadsheet.

Scans are processed to produce the analysis you asked for. We do not use them for marketing, and sales and marketing staff cannot open patient records.

A study agreement is stricter, and it is in writing. The institution's data may be used only for the agreed study purpose, and only on the institution's instructions. Model training, improving algorithms, product development, marketing and any other secondary use are excluded. We pass that exclusion on to the companies that process the data. Before the study starts we confirm that the analysis provider's contract says the same thing.

If your practice wants the same clause in its own agreement, ask us and we will add it.

Yes. We set up a separate organization for the study. Its records stay apart from every other practice, and only the study accounts can open them. The institution remains responsible for the data. We process it on the institution's instructions, under the institution's own data-processing agreement.

We do not have a template that an ethics committee has already pre-approved. We have worked with university hospitals, including Charité – Universitätsmedizin Berlin, and we sign the agreement the institution sends us. We attach how the data moves, the technical and organisational measures, and the list of subprocessors.

The points on this page are the ones committees ask for: the path of a scan, where it is hosted, who can sign in, how images are protected, how long data is kept, and that study data is not reused for anything else.

Two details belong in the annex rather than in a general answer, because they are fixed in each agreement: the legal name of the analysis provider, and the exact Azure region.

A face with the eyes covered is still personal data. Masking the eyes and deleting the image after analysis are alternatives, not a pair. Name the roles inside the study organization — Owner, Admin, Member and Read only — and the one or two named technical administrators at ICA Aesthetic Navigation GmbH. They sign in only to operate the service or to fix a fault, and they are bound to confidentiality. Sales, marketing and other staff have no access.

On the institution's instruction, and at the latest on the date written in the agreement, we delete the scans, the image files, the analysis results and the treatment plans built on them, and we delete the copy held by the analysis service.

You then receive a written confirmation, with an extract of the system log: the pseudonymous ids that were removed, and the analysis service's confirmation for each one. Backup copies are gone once those backups are overwritten, within 30 days of the deletion.