Health data privacy

Who is responsible

Clareya is operated by Clareya LLC, a Texas limited liability company. The app is for US adults 18 or older using their own health information.

Health information and purposes

Your records can include medicines, supplements, amounts and schedules, conditions, allergies, symptoms, labs, habits, goals, notes and daily check-ins; mental, sexual and reproductive history, pregnancy and cycle information; and protocols and phases, planned and actual administrations, injection sites, vials and concentrations, batch labels and lot numbers, private supplier notes, typed test results and certificate files, bloodwork plans, tracked check-ins and urgent symptoms, body measurements, body estimates and optional progress photos. Uploaded lab reports, medicine labels and lists, and certificates can contain names and other identifiers. These files are saved as you upload them, so a photo among them keeps any camera or location details stored in its file, unless the app saved a smaller JPEG copy of a medicine photo instead; the images sent to Anthropic have those details removed. Findings, comparisons, scores and estimates the app derives can themselves reveal health information, and so can the fact that you use a health feature.

This information comes from what you enter, the files you upload (lab reports, medicine lists and labels, batch certificates and progress photos), your saved activity in the app, and the calculations and AI results the app produces from those inputs. Clareya does not connect to other health apps, devices or medical-record systems, and does not obtain records about you from a clinician or insurer. If your account holds records imported earlier, they are sent to AI only when their original source allows AI use; Oura, WHOOP and Strava data is never sent to AI.

The health permission you accept (version health-ai-2026-10-26-clareya) says:

Save and use the health information you choose to add. This includes your profile, regimen, labs, symptoms, reproductive information, protocols and phases, planned and actual administrations and injection sites, vials and concentrations, batches, typed tests and batch certificates, bloodwork plans, tracked check-ins, body measurements, body estimates and optional progress photos. We use it for your records, calculations, comparisons, safety alerts, reminders and the features you request. This includes goal-relevant summaries, questions you ask, options you compare and decision notes you choose to save. Saving a note or adopting an option into your records requires your confirmation. When you run Analyze, Anthropic uses the relevant information to prepare the report. Later relevant changes can automatically send updated information to Anthropic to update affected findings, scores and fertility assessments; the original report stays unchanged. When you explicitly request your complimentary Quick Analysis, Anthropic uses a bounded selection of your saved goals, regimen and other permitted health information to produce a short starting plan. It is separate from Full Analyze, creates no health score and does not start automatic updates.

Protocol, vial and syringe tools calculate from the amounts you enter, and certificates and supplier notes are kept for your own records. Safety alerts come from rule checks on your saved records and run without AI. The app does not verify products or certificates, prescribe doses or monitor your health continuously. Comparisons do not prove cause, and body estimates and their displayed certainty are not clinical measurements.

Who receives health information

The health permission you accept (version health-ai-2026-10-26-clareya) says:

Anthropic provides Claude. Cloudflare hosts the app and stores your records and private uploads. Anthropic is the only AI service that receives your health information. It receives the relevant information for Analyze, automatic updates, Today insights you request (including history answers and appointment briefs) and reading the lab pages, medicine labels and medicine lists you upload, including identifiers printed on them. For a decision question or option comparison, you choose public evidence alone or relevant saved records. Anthropic receives the question, the options and the relevant evidence, plus selected decision notes and records when you choose to use them. The same request can look up additional relevant saved records to finish the answer. Public-evidence-only requests do not include your profile or saved records. A question you ask about a substance is sent with public evidence about it, not with your profile. A medicine or substance name you ask the app to identify is sent on its own, without your profile. With this permission, Analyze includes your saved protocols and phases, vials and injections, bloodwork plans, tracked check-ins, urgent symptoms and batch test results when the confirmation for that run names them; Today insights include them automatically; automatic updates include them only for a report whose Analyze run included them. For subscribers, Analyze and Today can also include a summary of your body measurements and latest body estimate. A body estimate, which subscribers can request, sends your height, weight, age as a 10-year range, recorded anatomy, formula results and that summary, plus up to 3 recent progress photos only if you turn on the separate photo permission. Supplier notes, batch notes, testing-lab names and certificate files are never sent to AI, and progress photos are sent only for a body estimate. Imported records are sent only when their original source allows AI use; Oura, WHOOP and Strava data is never sent to AI. Ordinary tracking and calculations, including the free formula estimate, do not use AI. A stack you choose to publish is public: anyone with its link can see the substance names, amounts, routes, forms and times it lists. Public substance research sends substance names and research queries to Anthropic and to public research and search services, not your private profile. Quick Analysis uses saved profile context, medicines, supplements and accepted lab or measurement results with their available dates, units and provenance. It excludes pending or review-required lab observations, genetic information, source-restricted imports, progress photos and source documents. Its review screen describes the included information and consequential omissions before you choose to run it. It does not request new public substance research or reread uploaded images to produce the result.

Direct support receives only the messages and technical details you choose to send. The optional AI support assistant sends the question you confirm to Anthropic; it does not read your profile. Avoid unnecessary health details in account or billing requests.

Each AI body estimate saves the estimate with its range, certainty and basis, the inputs it used (including references to any photos), the AI’s output text, the model and its usage and cost record.

Automatic AI updates of a saved Analyze report are for subscribers. They wait about 30 minutes after relevant saved changes, run at most once per UTC day for each profile and have a monthly account limit. When changes exceed one update, the app updates the most affected items it can and recommends Analyze for the rest. Saved reports remain available while an update waits.

These are the recipients of your health information:

• Cloudflare: Hosts the app, stores your saved records, uploads, progress photos, reports and support messages, and runs background jobs.
• Anthropic: Provides Claude and receives the information described above for the AI features you use. It is the only AI service that receives your health information.
• Resend: Sends the app’s emails, such as billing notices, support-ticket updates and the reminder, review and research-ready emails you turn on. These emails link to the app and contain no health details.
• Zoho: Provides the support@clareya.app mailbox and receives the emails you send there, including any health details you choose to include.
• Clareya operator: Can access the information needed to handle support, privacy, security and billing, and sees which AI features each account used and what they cost. Usage statistics reach the operator only as combined counts. This is not clinical monitoring.

Supabase handles sign-in, and Google is involved only if you choose Google sign-in; Stripe handles payments. None of them receives your health records. Public research services receive substance names and research queries, not your profile. We do not sell health information or use it for advertising, and no affiliate or other business receives it except the service providers named here. A stack you choose to publish is public, as described under Public stack sharing.

Public stack sharing

If you choose Publish this anonymized stack, the app creates a public stack card from your active regimen items that have a completed public library page. You see a preview first, and nothing is published until you choose to publish it. Anyone with the link can see the substance names, amounts, routes, forms and times, with public reference risks and illustrative curves. A published card can also be listed in the site’s sitemap and indexed by search engines, so people can find it without the link. Your profile name, notes, conditions, allergies, labs and dates are left out, but a distinctive stack can still be recognized.

A published card is stored without your account or profile ID. The app keeps only a one-way code derived from them, which it uses to avoid publishing the same preview twice, and it does not link the card to your account. A published card cannot be changed, so later edits to your regimen do not update it. There is no control to remove a published card, and it is not deleted when you delete your profile or account. Publishing needs your health permission and signed agreements, like other changes to your records.

Optional AI photo sharing

The optional photo permission (version ai-photos-2026-10-26-clareya) says:

When you ask for an AI body-fat or FFMI estimate (a subscriber feature), we send your most recent progress photos (up to 3, one per pose, all from one day in the last 30 days) with their date and pose to Anthropic, together with the other estimate inputs, under your separate Anthropic authorization. The estimate card shows which day of photos is included before you send. Saved copies are JPEGs no more than 512 pixels on the longest side, with location and camera details removed, but visible content can still identify you. Photos are used only for the body estimate you request, never for Analyze, Today, public research, emails or usage statistics. Saved photo copies stay until you delete them; deleting a photo removes the image, but its date, pose, size and file fingerprint, and any estimate that used it, stay until the profile or account is deleted. Anthropic’s commercial terms govern how long it keeps requests, and Clareya has no zero-data-retention agreement with Anthropic. Turn this off in Settings or Account to stop sending photos with future estimates; saved photos and past estimates are not deleted, and photos already sent cannot be recalled. Uploading or viewing a photo does not send it to AI.

With photo sharing off, an AI body estimate uses its other inputs and no photos.

Your permission and choices

We save health information only after you accept the health permission, and send it to Anthropic only under your signed authorization. Your health permission, the Anthropic authorization, photo sharing, usage statistics, reminder and review emails, research-ready emails and product emails are separate choices, and so is publishing a stack. You accept the health permission and sign the Anthropic authorization at sign-in; adding health information and using AI features need both. An earlier OpenAI permission does not authorize any transfer to Anthropic. Reading a notice or continuing to use the app never grants a new permission, and a new recipient, purpose or scope needs a new choice.

Withdrawing your health permission

You can withdraw in Account at any time. This stops new health entries and AI requests, including automatic updates, body estimates and the support assistant, until you accept again. It also turns off optional usage statistics and deletes that usage history, turns off research-ready emails and cancels queued research-ready and reminder emails. It does not delete saved records or photos, or recall information already sent. You can still sign in, download or delete your records and photos, manage billing and contact direct support. Your photo-sharing, reminder, review-email and product-email choices stay as they are, but no photos are sent to AI and no reminder or review email is sent while this permission is off. Turning photo sharing off stops future photo transfers without deleting saved photos or past estimates.

The Anthropic authorization

The Anthropic authorization expires one year after you sign it unless you withdraw it sooner in Account. If you withdraw it or it expires, new health entries and AI requests stop until you sign again, queued AI work is not sent, and information already sent cannot be recalled. You can still download or delete your records, manage billing and contact direct support. You can download your signed authorization in Account; signed copies are never rewritten.

Optional usage statistics

The optional usage-statistics choice (version today-analytics-2026-10-26-clareya) says:

With your permission, we record account-linked check-in completions, checklist use, weekly-summary views, return visits, switches between Everyday and Advanced, and when you record an injection, apply a protocol phase, link a lab result to a planned blood draw or open a protocol review. We use these events to see which features are used and to improve the app. Each event records the action, when it happened and, for a mode switch, the mode you chose. Events contain no answers, substance or supplier names, doses, lab values, photos or certificate contents, but they can show that you use a health feature, and they are not anonymous. Cloudflare stores them. Usage reports show only combined counts, with groups of fewer than 5 people hidden, and no advertising service receives them. This choice is optional and does not change access to app features.

Daily events and their activity-log copies are deleted after 30 days. First-use and return milestones are kept only while this permission is on. Turning this off, or withdrawing health-processing permission, deletes this usage history without deleting your health records. An earlier usage-statistics choice covers only the Today events it named; mode switches and protocol feature events are recorded only under this version. Accepting this version starts a new permission, and usage history kept under an earlier one is deleted. You can turn this on again in Account at any time while health-processing permission is on; activity from while it was off is never added.

Usage statistics are off unless you turn them on, after sign-in or in Account.

DNA and genetic reports

Clareya does not accept DNA or genetic-test results. Each lab upload asks you to confirm that it contains none, and the app declines genetic-test results it detects in uploads and entries. Genetic-test information it detects is left out of anything sent to AI. Ordinary blood counts, cholesterol, hormone results and family-history answers are not treated as genetic tests. Genetic information already saved in your records stays available to view, download or delete.

Retention and deletion

The health permission you accept (version health-ai-2026-10-26-clareya) says:

New original lab uploads and their page previews are deleted after 90 days; earlier uploads keep the expiry shown with the file. Batch certificate files are deleted 90 days after upload. They have no page previews, and you cannot delete one sooner except by deleting its profile or your account; the test values you typed stay. Progress photos are saved as reduced JPEG copies, at most 512 pixels on the longest side, with location and camera details removed; visible content can still identify you. Each copy stays until you delete it, its profile or your account. Deleting a photo removes the image, but its date, pose, size and file fingerprint, and any body estimate that used it, stay until the profile or account is deleted. Extracted results, typed test values, corrections, tracking, estimates and reports stay until you delete the profile or your account. A medicine list or label you upload for import stays until you discard the import before saving anything from it, or delete the profile or your account. Name-identification requests (the name you typed and the suggested match) stay until you delete your account. A stack card you publish stays public and is not deleted with your profile or account. Photos are downloaded separately from the records export. The Health data privacy notice explains how long request and consent records and backups are kept, and how provider copies are handled. Setup progress is saved separately from health records. The Quick Analysis, its input basis and private provider response remain until the profile or account is deleted. A minimal account-level allowance and attempt record, without the deleted health information, remains after profile deletion so recreating a profile does not grant another complimentary result; it is removed on account deletion. Model and cost records follow the existing billing-record retention rules.

Progress photos have no automatic expiry. When you delete one, the app stops showing it at once and then deletes the stored image.

Usage statistics are kept as described above. Resolved support tickets are deleted 180 days after they are resolved, and support-assistant requests 30 days after their last update. The app’s operational, security and request logs are deleted after 30 days, and the stored copy of each app email loses its recipient, subject and text after 30 days. The app keeps a private copy of each response it receives from Anthropic for your requests until the profile or account it belongs to is deleted, and each body-estimate request record until its profile is deleted. Profile display names stay until you change them or delete the profile or account. The record of which public library reviews you requested stays until you delete your account. Research-ready email settings, and the reviews they are waiting on, stay until you delete the profile or account. Consent, authorization and agreement records stay until your account is deleted. A record of each AI request’s feature, date, model and cost, without its content, is kept with the billing records, including after profile or account deletion.

Deleting a profile deletes its records, uploads, photos, estimates and reports. Deleting your account cancels future billing first, then deletes every profile and your consent, authorization and support records; billing records needed for tax and accounting, the AI request cost records and a minimal deletion marker remain. A stack card you published stays public. After you request account deletion, a status link shows the app’s progress for 30 days. Copies held by providers follow each provider’s own policy, with no period set by Clareya: Anthropic’s commercial terms govern how long it keeps requests, and it may keep some information for security or legal reasons; Resend keeps its own records of the emails it delivered; and Zoho keeps the emails you send to support until they are deleted from the mailbox. Backups, including Cloudflare’s database recovery copies and the operator’s encrypted backups of the database and stored files, can include deleted information, including deleted photos, for up to 30 days.

Provider handling

The health permission you accept (version health-ai-2026-10-26-clareya) says:

AI answers and body-composition estimates can be wrong or incomplete; a displayed certainty is not clinically validated accuracy. Anthropic’s commercial terms govern how long it keeps requests, and it may keep some information for security or legal reasons. Clareya has no zero-data-retention agreement with Anthropic. This permission works together with the separate Anthropic authorization; progress photos also need their own optional permission.

Clareya sends AI requests to Anthropic through its API at Anthropic’s standard service tier. Apart from what a request contains, such as identifiers printed on a page you upload, the app does not send your name, email or an account identifier with it. Only the app’s own fixed instructions, such as those for reading lab pages and for public substance research, can be kept in Anthropic’s prompt cache, for 5 minutes. Your records, questions, images and profile are never placed in that cache. Clareya has no zero-data-retention agreement, business associate agreement or US-only processing arrangement with Anthropic. Your authorization names Anthropic as the only recipient; it does not allow sending your information to any other AI company.

Your records and privacy requests

Download my records in Account gives you a readable file with your saved records and their correction history, including protocol, administration, vial, batch and body-tracking records, body estimates with the AI output text and usage record, saved reports and insights, consent, authorization and agreement history, support messages, billing history, profile display names and name-identification requests. It does not include original uploaded files or the app’s private copies of Anthropic responses; download lab originals and batch certificates before they expire. The list of public library reviews you requested and your research-ready email settings are not in this file; ask for a copy with a Privacy or deletion ticket. Progress photos have their own download, Download my photos, with the saved reduced copies rather than your original photos. Downloads and deletion stay available while new health entries are paused.

You can ask to access, correct, copy or delete your information, withdraw a permission, get a list of the third parties that received your health information, or have a denied request reviewed. Use the controls in Account or send a Privacy or deletion ticket; if you cannot sign in, email support@clareya.app. We may ask you to confirm that the account is yours, or that you are authorized to act for its owner. Do not send passwords or your health history to confirm your identity. We answer within the time applicable privacy law requires, which is separate from our ordinary support reply target.

If you disagree with how we handled a privacy request, ask for an appeal through the same contact. We will explain our decision and how to complain to a regulator. You may contact your state attorney general. Clareya is software, not a licensed medical practice, and has no supervising medical licensing board.

What this version adds

This version adds an optional first-use guide and one complimentary Quick Analysis for each eligible account, including subscribers. You choose whether to begin or leave setup, and skipping never uses the complimentary result. Quick Analysis starts only when you explicitly request it and after current health permission and Anthropic authorization. It produces a short starting plan from the saved information described on the review screen, with its input basis and limitations. It is separate from Full Analyze, does not create a score, and never starts automatic report updates. Setup progress does not grant optional email, usage-statistics or photo permission. Ordinary saved-result reads do not send a new AI request.

Changes to these notices

We announce important privacy changes in your account when they take effect. The announcement explains what changed. You can find current and earlier announcements under Privacy updates in Account and in the notice history below. We will also send an account email when a change requires direct notice by email.

If a new use or disclosure needs your permission, we will ask before it starts. Reading a notice or continuing to use the app does not give that permission. Updated app agreements are shown at sign-in for review before normal app use. Your account, privacy controls, saved-record exports, billing management and direct support remain available.

Open Privacy updates in Account