Consumer Health Data Privacy Policy

This policy explains specifically how Clarion Labs collects, uses, shares, retains, and protects consumer health data: biomarker values, uploaded lab reports, symptom check-ins, medication and supplement entries, and anything else that reveals information about your physical or mental health status.

We publish this as a standalone document because Washington's My Health My Data Act (MHMDA) — and similar laws in Nevada and Connecticut — require a separate health data privacy notice that is distinct from our main privacy policy. For everything else we do, see our general privacy policy.

Categories of health data we collect

Lab uploads.PDF or photo of your lab report. We use this to read your biomarker values. The file is deleted when you save your results, or automatically within 24 hours if you don't.

Biomarker values. Individual test results (ferritin, vitamin D, etc.) and their units. We use these to score your panel and generate your protocol.

Symptom and wellness reports. Daily check-ins, energy ratings, sleep, stress, training load. Used to personalize suggestions and detect patterns over time.

Supplements and medications you log. Names, doses, and context. Used to check for conflicts and to personalize your plan.

Profile facts that imply health status. Age band, sex at birth, training focus, diet pattern, self-reported conditions you enter.

How we use your health data

We only use your health data to run Clarion for you. Specifically: extracting values from uploads, scoring biomarkers, generating your personalized interpretation, suggesting supplements, tracking trends, and sending the reminders you ask for.

We do not use your health data for advertising, lead generation, or behavioral profiling. We do not sell it. We do not use it to train AI models.

How AI is used on your health data

Clarion uses OpenAI's API to (a) read the lab reports you upload, and (b) write your interpretation, AI overview, chat answers, and supplement checks. Some short wording on your supplement plan may be written by Anthropic's API (Claude) instead, from the same values.

Uploads: the image of each page of your report is sent to OpenAI as it is. That includes anything printed on it, such as your name, date of birth, address, or record number. We tell the AI not to copy those details into its answer, but we do not remove them from the image first.

Typed values and AI features: we send the biomarker values plus profile details like age, sex, and goals — not your name or email. Anything you type into the chat is sent as you wrote it.

OpenAI's API terms say it does not train its models on this data and may keep it for up to 30 days to check for abuse. Anthropic's API terms also bar training on it. We have not opted in to any training.

Who we share health data with

We share health data only with the subprocessors required to run the product:

Supabase — database and private file storage for uploads, with row-level security scoped to your account.

OpenAI — reads uploaded reports and writes AI interpretation, as described above.

Anthropic — may write short wording on your supplement plan, as described above.

Vercel— application hosting. Vercel's first-party analytics do not receive health data.

Resend — sends our emails. If you turn on daily reminder emails, they list the supplements and doses in your plan. Emails do not include your lab values or symptoms.

Twilio — if you turn on text reminders, sends the same supplement list by SMS.

We do not share health data with Stripe or Amazon Associates. Payments and affiliate links do not carry biomarker values or symptoms.

We will never share health data with advertisers, data brokers, or cross-context behavioral advertising networks. There are no third-party tracking pixels on the upload, dashboard, or analysis routes.

Your consent

Before you add lab results, Clarion asks for separate opt-in consents: (1) to process your lab results, (2) to use AI to read and interpret them, (3) that you've read this policy, and, for uploads, (4) that you understand how long the file is kept. Each checkbox is unchecked by default and recorded individually with a version number. When the wording changes materially, we ask again.

You can withdraw any consent at any time in Settings → Privacy & consent. Withdrawing stops the processing that needed it from then on — for example, withdrawing AI consent turns off the AI features. It does not delete data you already saved. To delete that, delete your account in Settings or email us.

Retention

Uploaded PDFs and imagesare kept in private storage only until you save your results, and are deleted then. If you never save, they are deleted automatically within 24 hours. The values read from an upload you didn't save stay in your account until you delete it.

Extracted biomarker values, symptom logs, and your stackare retained for as long as your account is active so you can see trends over time. You can delete any of it from the app, or delete your whole account.

Consent records are retained as a legal record even after revocation, so we can demonstrate the state of consent at the time of each action.

Backups. Deleted data may persist in encrypted database backups maintained by Supabase for up to about 30 days before they roll off.

Your rights

MHMDA and similar laws give you specific rights over your consumer health data. Clarion extends these rights to every user:

Access and confirm.You can see your health data inside the app, or download a copy from Settings (“Download my data”).

Delete.You can delete your whole account, and the health data in it, from Settings. To delete specific items, email us. Data an AI provider already received is kept under that provider's own terms (see above); deleting your account does not recall it.

Withdraw consent.Any consent can be withdrawn at any time in Settings → Privacy & consent.

Non-discrimination. Exercising any of these rights will never change your pricing or access.

Appeal. If we deny a request, you can appeal by emailing us. You may also contact your state attorney general.

To exercise a right or ask a question, email us at support@clarionlabs.tech. We respond within 45 days (or the shorter window your state law requires).

Security

Uploads are transmitted over HTTPS and held for at most 24 hours in a private bucket scoped to your user ID. Database tables holding health data are protected by row-level security. Access to production systems inside Clarion is limited to the people who need it to operate the service, and Clarion staff do not access your individual health data except when needed to provide support or operate the service.

Not a HIPAA-covered entity

Clarion Labs is a direct-to-consumer product and is not a HIPAA-covered entity. HIPAA does not apply to this relationship. The Federal Trade Commission's Health Breach Notification Rule and state health data laws (including MHMDA) do, and we comply with them.

Children

Clarion is for adults 18 and older. We do not knowingly collect health data from anyone under 18.

Changes to this policy

We'll update this page and email you when changes are material. The version string shown in the app consent gate reflects the current revision of this policy.