Privacy Policy

Effective 6 November 2026 · covers the iPhone app and the web app at app.clarilab.app

Clarilab is an iPhone app and a web app (app.clarilab.app) that store your medical lab reports and prescriptions and helps you understand them. Your health information is sensitive, so this policy explains plainly what we collect, why, who processes it, and the control you have.

In short: we use your data only to run Clarilab for you. We don't sell it, we don't show ads, and we don't use third-party tracking or advertising SDKs. You can delete your account and everything in it from the app at any time.

What we collect

Information	Why
Account details: email address, password (stored hashed by our auth provider), and your name if you add one	To create your account and sign you in
Reports you add: PDFs, photos and camera scans, plus the values and medicines read from them	To store your reports, show results, trends and comparisons, and sync across your devices
Pregnancy details, only if you turn on pregnancy mode: your due date (or the date of your last period) and the tests you tick as done	To show your pregnancy week, the usual test timeline and pregnancy information on your doctor visit summary
AI summaries you request	To show the summary again without generating it twice
Basic usage events: sign-in, report uploaded, AI summary used, app or web version, and the time of each	To count your monthly AI allowance, keep the service secure, and understand how the app is used
Subscription status: Apple transaction IDs, product, and expiry date	To give you Clarilab Pro on every device you sign in on

We never receive your payment card details; Apple handles all payments.

What stays on your iPhone

Reading reports: text in your scans and photos is read on the device using Apple's built-in recognition.
Face ID: handled entirely by iOS. Clarilab only learns whether unlocking succeeded.
Reminders: scheduled as local notifications and stored on the device.
Camera: used only when you choose to scan.

The web app

PDFs only: the web app accepts PDF reports. Their text is read in your browser; the file is uploaded only when you choose to save the report.
Same account, same data: reports you add on the web appear in the iPhone app and the other way round. The same rules apply: only your signed-in account can see them.
Signing in: your sign-in is kept in your browser's session storage, or in local storage if you tick "Keep me signed in". You're signed out after 30 minutes without activity. We don't use cookies for tracking or advertising.
Reminders, the camera scanner and Face ID are available only in the iPhone app.

AI summaries

AI summaries are optional and are created only when you tap the button for a report. When you do, that report file is sent securely to Anthropic, which provides the AI model, to produce the summary and extract values. Anthropic processes it on our behalf as a service provider and does not use it to train its models. Summaries can contain mistakes. They are not medical advice.

Who processes your data

Supabase (hosting, database, file storage and sign-in), in a data centre in London, UK.
Anthropic (AI summaries), only for reports you choose to summarise.
Apple (App Store purchases and, if enabled on your device, push and notification services).
Cloudflare (this website, the web app and our email forwarding). Web app requests pass through Cloudflare on their way to Supabase.

Because these providers operate outside India, your data may be processed in other countries. Each is bound by its own security and data protection commitments. We share your information with no one else unless the law requires it.

Who can see your reports

Only you, when signed in to your account. Access is enforced by database rules for each account. Our admin tools show account and usage facts, such as sign-up date, plan and number of reports, but never the contents of your reports or results.

Security

Data is encrypted in transit (HTTPS) and at rest by our hosting provider. You can lock the app with Face ID. No system is perfectly secure, so please use a strong, unique password.

How long we keep data

We keep your account and reports until you delete them or your account. Deleting a report removes its file and results. Deleting your account permanently removes your account, reports, files, results and summaries. Backups held by our hosting provider expire on their normal schedule. Records of admin actions on accounts may be kept for security.

Your choices and rights

Access and correct: view and edit your reports and profile in the app.
Delete: Profile → Delete account removes everything permanently.
Withdraw consent: stop using AI summaries at any time, or delete your account.
Ask us: email privacy@clarilab.app for a copy of your data, a correction, or any privacy concern. We respond within 30 days.

Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023 or the GDPR give you rights over your data. You can contact us to use them, and you may also complain to your local data protection authority.

Children

Clarilab is not intended for children under 18. A parent or guardian should manage a child's health records.

Changes

If we change this policy, we'll update the date above and, for significant changes, tell you in the app.

Contact

Clarilab is run by Uttam Upadhyay, an individual developer in India. Email privacy@clarilab.app.