Privacy Policy
Last updated: 23 October 2026
This policy explains what personal information Skinvoicer collects, why, and how we protect it, in line with the Protection of Personal Information Act (POPIA).
Who we are
Skinvoicer is run by Yurav Sukeri, trading as Skinvoicer, a sole proprietorship in South Africa.
- Information Officer: Yurav Sukeri, registered with the Information Regulator (registration no. 2026-067194)
- Contact: yuravinvoicing@gmail.com
Two kinds of information
- Information about clinics and their staff who use Skinvoicer, such as your name, email and billing details. For this, Skinvoicer is the responsible party, and this policy applies.
- Information about a clinic's clients, such as record cards, health information, consent forms and photos. For this, the clinic is the responsible party and Skinvoicer is its operator. We process it only on the clinic's instructions, under our Operator Agreement with the clinic. If you are a clinic's client, please contact that clinic about your information.
What we collect and why
| What | Why |
|---|---|
| Name, email, password (stored encrypted) | To create and secure your account |
| Clinic name, address, phone, VAT and banking details | To show on the invoices you create |
| Billing and payment records | To bill you and keep records the law requires |
| Messages you send us | To give support |
| Basic technical logs (such as login times and errors) | To keep the service secure and fix problems |
We don't use advertising trackers, and we never sell personal information.
Where it's stored
Skinvoicer's data is stored with Supabase (database and file storage) and the app runs on Vercel. Their servers are in Ireland (European Union), outside South Africa. POPIA allows this where the recipient is bound to protect the information to a similar standard. Invoice emails are sent through Resend, in the United States. These three providers have data processing agreements that require this.
Every night, we make an encrypted backup of the data, which is stored with GitHub in the United States. The backup is encrypted before it leaves our systems, so GitHub cannot read it, and each backup is deleted after 30 days.
Who we share it with
Only the service providers we need to run Skinvoicer, each bound to keep it confidential and secure: Supabase (database and file storage), Vercel (app hosting), Resend (sending invoice emails, based in the United States) and GitHub (storing encrypted backups only, based in the United States). We may also share information if the law requires it, for example a court order.
How long we keep it
We keep your account information while your account is open. When you close it, we delete it within 30 days, and backup copies expire within a further 30 days. We keep billing records for as long as tax law requires.
How we protect it
- Each clinic can only see its own data, enforced in the database itself.
- Photos and signatures are stored privately and opened only through short-lived links.
- Passwords are never stored in plain text, and all connections are encrypted.
- Signed consent records can't be edited or deleted once saved.
- Backups are encrypted and kept for 30 days.
Your rights
You can ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct anything that's wrong;
- delete your information, where we don't need to keep it by law;
- stop processing it for a particular purpose.
Clinics can also download a copy of their data at any time from Settings → Download my data.
Email yuravinvoicing@gmail.com and we'll respond within 30 days.
Complaints
If you're unhappy with how we've handled your information, please contact us first. You can also complain to the Information Regulator: inforegulator.org.za.
Changes to this policy
If we make important changes, we'll tell you by email or in the app before they apply.