Privacy policy.

This policy explains how Clare Health (“Clare”, “we”, “us”) handles personal information across clare.health, app.clare.health and the Clare app, including the membership, the testing, and any membership an employer buys on your behalf.

Clare is established in the United Arab Emirates and follows the UAE's data protection law (Federal Decree-Law No. 45 of 2021) and its law on the use of information and communication technology in health fields (Federal Law No. 2 of 2019). Where the two say different things about health information, the stricter one applies.

By using the service you accept this policy. It is part of our Terms of Service.

Only what the service needs, and we say which is which.

• Account details: your name, email address and phone number, your date of birth and sex, the home address a collection visit comes to, how you sign in (a code sent to your email, Apple or Google), and the identification a laboratory requires to take and label your sample.
• Health information: your results and the ranges they are read against, your history, medications, symptoms and answers to our questions, your plan, and your messages with the care team.
• What you send Clare AI: your messages, and any photo, document or voice recording you choose to send it.
• Data you bring in: results and documents from other laboratories and clinics you upload, and readings from Apple Health, Health Connect and the wearables you choose to connect.
• Payment details, taken and held by Stripe, our payment provider. We keep a record of what was paid and when, never your card number.
• Device and usage data: the device and browser you use, your IP address, the notification token your phone issues so we can send you notifications, and how you use the app, which we need to keep it working and secure.

We do not collect information about you from data brokers, and we do not buy lists.

Health information is the most sensitive thing we hold, and it is treated differently from everything else. It is visible to you and to the clinicians and care team involved in your care, and to no one else without your consent or a legal requirement.

It is stored in the UAE, in Microsoft Azure's UAE North region. The one time any of it is processed outside the country is when you have allowed Clare AI to read it, as the Clare AI section below explains. Laboratories receive what they need to run your panel and return the results. They do not receive your history or your plan.

Nothing is read from a health app or a wearable until you connect it, and you can disconnect it at any time from Connected devices in the app. Clare only reads. It never writes, changes or deletes anything in Apple Health, Health Connect or a connected service.

Apple Health. On iPhone, with the permission you give in Apple's own permission screen, Clare reads:

• Resting heart rate and heart rate variability
• Blood oxygen and respiratory rate
• Blood pressure
• Body temperature
• Weight, height and body mass index
• Steps, active energy and exercise
• Sleep, including its stages

You can change what Clare may read at any time in the Health app, under Sharing, then Apps. Data read from Apple Health is not stored in iCloud and is never used for advertising or marketing.

Health Connect. On Android, with the permission you give in Health Connect's own permission screen, Clare reads resting heart rate, heart rate variability, blood pressure, body temperature, blood oxygen, respiratory rate, weight, height, steps, active calories burned, exercise and sleep. You can withdraw any of these in Health Connect's settings at any time.

Other services, such as Oura, Withings or WHOOP, are connected through that provider's own sign-in and send comparable readings.

How we use these readings: they become part of your health record in Clare, shown beside your results so your history shows measured trends rather than recalled ones, and used for your activity, sleep and recovery scores. If you have allowed Clare AI, it reads them too, to answer your questions. They are visible to you and to the clinicians involved in your care.

They are never sold, never shared with data brokers or advertisers, never used for advertising, and never used to develop or train artificial intelligence or machine learning models, by us or by anyone we work with. They are encrypted in transit and at rest and stored in the UAE North region. Disconnecting a source stops all further reading. Readings already in your record are kept or deleted as the How long we keep it section describes.

Clare's use of information received from Google APIs, including Health Connect, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To deliver the membership: book draws, run panels, have a clinician read them, build your scores and your plan, and let the care team answer you.
• To keep you informed about results, appointments, reminders, renewals and changes to the service.
• To keep the service safe: preventing fraud, securing accounts and investigating problems.
• To improve the service, using aggregated information that no longer identifies anyone.
• To meet our legal obligations, including the records a licensed health provider must keep.

We do not use your information for advertising, and we do not profile you for anyone else's purposes.

Clare AI answers your questions about your own health, and writes your program and the summaries of your results and readings. It runs on OpenAI, a third-party provider based in the United States, so the information it reads is processed outside the UAE.

It reads nothing until you allow it. We ask when you create your account, separately from the terms, and again in Clare AI if you have not answered. You can withdraw your permission at any time in Settings, and Clare AI stops reading your information from that moment.

• What it reads: your results, records, medications, plan, wearable and health app readings, your messages to it and anything you attach, and your name, so it can write it in Arabic or English.
• What it never receives: your email address, phone number, home address or payment details.
• What OpenAI may do with it: only provide the answer. Under its terms for businesses it does not use your information to train its models, and it keeps it for no more than 30 days, for abuse monitoring, before deleting it.

Your conversations with Clare AI are part of your record in Clare, visible to you and to your care team, so that anything clinical it hands to a person arrives with its context.

We never sell personal information. We share it only as follows.

• Partner laboratories: your identity and the panel to run, so they can take, label and process your sample.
• The clinicians and care team involved in your care.
• Service providers who work for us under contract, listed below, who may use the information only to provide their service to us.
• Authorities, where UAE law requires it, and only to the extent it requires.
• A successor, if Clare is sold or merged, on the same terms as this policy.

The service providers are:

• Microsoft Azure, which hosts the service, its database, its files and its email, in the UAE North region.
• OpenAI, which runs Clare AI, only once you have allowed it, as described above.
• Stripe, which takes and holds card payments.
• Apple and Google, if you choose to sign in with them, and to deliver notifications to your phone.
• Twilio, to send the code that confirms your phone number, where we ask for one.
• Google Analytics and Microsoft Clarity, to measure how clare.health is used, as described under Cookies and analytics.

Your own doctor, or anyone else you choose, receives your results only when you share them yourself.

When an employer buys a membership for you, the employer pays and sees how many people have enrolled and booked. It never sees who booked, your results, your plan, your conversations or anything else in your account: not on request, and not at renewal.

For teams of thirty or more, we produce an anonymised, aggregated report of what the programme found and what moved by the retest. Nothing in it can identify a person, and we do not produce one for a team too small to anonymise. When you leave the employer, your account and everything in it stay yours.

clare.health sets no advertising cookies. To understand how the site is used, it runs Google Analytics, Microsoft Clarity and our own measurement: which pages are visited, where visitors came from, how they move through a page, and whether something is broken. Clarity records how a page is scrolled and clicked, with anything typed into a form hidden. None of this identifies you, and you can turn it off at any time under Cookie preferences at the foot of every page. The app uses cookies only to keep you signed in and to remember your settings, and measures how it is used with tools on our own infrastructure. You can clear or block cookies in your browser. If you block the sign-in cookie, the app cannot keep you signed in.

UAE law requires a licensed health provider to keep health records for at least 25 years from the last procedure, and we keep yours for that long. Everything else is kept for as long as your account is open, and for as long afterwards as we need it to settle payments, resolve disputes or meet a legal obligation, then deleted.

If you ask us to delete your information, we delete everything the law allows us to and tell you what we are required to keep, and for how long. Backups are removed on their own cycle, within 90 days. How to delete your account is set out at clare.health/delete-account.

Your information is encrypted in transit and at rest. Access inside Clare is limited to the people who need it for your care or to run the service, every access to a health record is logged, and the logs cannot be altered. We test our security regularly and fix what we find.

No system is perfectly secure. If a breach affects your information, we tell you and the authorities within the time the law sets, and we tell you what we are doing about it.

• To see the information we hold about you.
• To correct anything that is wrong.
• To export your results, including the ranges they were read against, in a form you can give to another doctor.
• To delete your information, apart from the records the law requires us to keep.
• To withdraw a consent you have given, such as Clare AI, a connected wearable or health app, or marketing messages.
• To object to a use of your information, and to complain to the UAE Data Office if you are not satisfied with our answer.

Write to privacy@clare.health from the email address on your account. We confirm your identity, answer within 30 days, and do not charge for it.

Marketing messages stop as soon as you ask. Messages about your results, your appointments and your account continue for as long as you have one.

The service is for adults. We do not knowingly open accounts for anyone under 18, and if we learn that we have, we close the account and delete the information.

When we change this policy we update the date at the top, and if the change affects you materially we tell you by email or in the app before it takes effect.

Questions about your information, and requests under this policy, go to privacy@clare.health. Questions about the terms go to legal@clare.health.