Privacy Policy

This policy explains what Clairop collects, why, who else sees it, and how to get rid of it. Clairop is operated by Pavado Technologies Inc., a company incorporated in the Province of Ontario, Canada.

Clairop handles health information, which is sensitive by definition. Symptoms, bowel movements, medications and the fact of your diagnosis are all health data, and this policy treats them that way throughout.

The short version

• Your log entries are stored against your account so they survive a new phone. No other user can read them. We do not look at them either, except where we have to in order to fix a problem you have asked us about, or where the law requires it.
• Meal photos never leave your device except at the moment you ask for one to be analysed, and they are never stored on our servers.
• When a photo or meal description is sent for food identification, nothing identifying you goes with it: no name, no email, no account ID, and none of your symptom history.
• The assistant is different, and we say so plainly: what you tell it, and a short summary of your recent logs, are sent to our AI provider so it can answer you. Still no name, email or account ID. It is off until you agree to this in the app, and you never have to use it.
• Health values never enter our analytics. We record that a movement was logged, never which type. We record that a symptom entry was saved, never the score.
• We do not sell your data, and we do not advertise.
• You can export or permanently delete everything, from inside the app.

What we collect

Information you give us

• Your account.An email address, via Sign in with Apple or Sign in with Google. If you use Apple's private relay, we only ever see the relay address. With Apple we ask for your email and nothing else. Google also passes along your name and profile picture address whether or not we ask; we do not display or use them.
• Whether you want email from us.The sign-in screen has an unticked box, “Send me tips, new features and offers from Clairop”. If you tick it, we record that you did. If you leave it alone, we do not send you marketing email. See Email from us.
• Your health profile. Your condition, year of diagnosis, surgical history, current diet approach, medications and treatment types, suspected triggers, your usual daily baseline, and the other answers you give in the setup questions, such as which symptoms bother you most, what else seems to affect your gut, and when your next appointment is. Almost all of these are optional. Your profile is stored on your device.
• Your log entries. Bowel movements including Bristol type, urgency, blood, mucus and whether you were woken at night; symptom severities; meals and their ingredients; medication doses taken and missed; and any lab results you enter.
• Meal photos,if you take them. These are stored in your device's own storage.
• What you say to the assistant, if you use it. The conversation is kept on your device so you can scroll back through it. It passes through our servers on its way to the AI provider and is not stored there. Anything the assistant logs for you becomes an ordinary log entry, stored like any other.
• Your reminder choice, if you set one. Reminders are scheduled by your phone itself. We do not send push notifications and we hold no notification token for you.

Information we generate

• Activity scores and trigger analysis, calculated from the entries above.
• Your subscription record. Which plan you have, when it renews or expires, and the transaction identifier Apple gives us, so our servers can confirm with Apple that a subscription is real. We never see how you paid.
• Usage counters, so per-day limits can be enforced.
• Product analytics:event names such as “stool_logged” with a timestamp, the app version, and sometimes one small non-health detail, such as which sign-in provider you used or whether a scan was a photo or a barcode. Never the value. Server-side this is an allowlist: an event name that is not on it is discarded rather than stored.
• Error shapes,such as “the network timed out”. Never the content of an error, which could carry your data.

What we never collect

• Payment card details. Apple processes payments; we never see a card.
• Location, contacts, browsing history, or any advertising identifier.
• Audio. When you dictate, Apple's speech recognition turns it into text, on your device where your device supports that and otherwise on Apple's servers. We receive the text you choose to send. We never receive the recording.
• Crash reports through any third-party SDK. We do not use one.

Why we are allowed to hold it

Where the UK GDPR or EU GDPR applies, health data is a special category and needs a stronger basis than ordinary data. Ours is your explicit consent under Article 9(2)(a), given when you create an account and choose to record entries, and given again, separately, before a meal photo or an assistant message is first sent to our AI provider. The underlying lawful basis for processing is performance of our contract with you under Article 6(1)(b), and our legitimate interest in keeping the service working and secure under Article 6(1)(f).

Where Canadian law applies, we rely on your express consent under PIPEDA, which is the standard PIPEDA expects for sensitive information.

You can withdraw consent at any time by deleting your account in the app. That is not a request we have to action; it happens immediately.

Who else receives it

These are every third party that receives any data, what they get, and why. This list mirrors what the app actually does. If it ever drifts from reality, the App Store privacy labels drift with it, so we keep it accurate.

We do not sell personal information, and we do not share it for behavioural advertising. Under the CCPA and similar US state laws, we have not sold or shared personal information in the preceding twelve months.

About the AI processing

Clairopuses Anthropic's Claude models for two things. They handle different information, so they are described separately, and the app asks for your agreement to each one separately, the first time you use it.

Identifying food. When you photograph a meal, describe one, or scan an ingredient label, the request contains the image or the text and nothing else. It does not contain your name, your email, your account identifier, your condition or any of your log entries, so the model has no way to associate a meal with a person. The model names the foods. It is never asked for FODMAP values; those come from our own cited reference table.

The assistant. When you talk to the assistant, the request contains the recent messages in that conversation and a short text summary the app builds on your phone: your condition, diet approach, usual baseline, the triggers and medications you listed, counts from your last seven days of logs (for example how many movements, and how many with blood), your recent meals, and the current time. If the app has found statistical patterns in your logs, those are included too. This is health information, and it is what lets the assistant answer about you rather than in general.

It never contains your name, your email address, your account identifier, your photos, or the free-text notes on your profile. Please avoid typing identifying details about yourself or anyone else into the assistant.

The assistant can create log entries when you tell it something happened. Each one is shown to you at once with an Undo, and Undo deletes it from your device and from our servers. The assistant cannot read, change or delete anything else.

Under Anthropic's commercial terms, content sent through its API is not used to train its models. Anthropic may retain requests for a limited period for safety and abuse monitoring under its own policies. We do not use your health data to train any model ourselves.

Barcode scanning does not involve an AI service at all. A barcode number goes to Open Food Facts, and nothing is attached to it.

Email from us

We email you about your account when we have to: a security notice, a change to these terms, a reply to a message you sent. We send product news, tips and offers only if you ticked the boxon the sign-in screen, which is how Canada's anti-spam law (CASL) and the GDPR both want it done. Every such email has an unsubscribe link, and you can also opt out by writing to clairop.support@gmail.com. Opting out never affects your account or your data.

This website

clairop.com uses Google Analyticsto count visits and see which pages and sign-up forms are used. It sets first-party cookies and receives your IP address, browser and device details, and the pages you view, under Google's own privacy policy. We never send it your email address or anything you enter into a free tool. You can block it with any tracker blocker or Google's opt-out add-on. We run no advertising or social-media scripts. Our hosting provider keeps standard short-lived server logs (IP address, the page requested, the time) to keep the site running and secure. If you join the waitlist, we store the email address you give us together with basic details of the visit it came from: your IP address and the approximate location our host derives from it (country, region, city), your browser, operating system and device type, your browser language, timezone and screen size, the page you signed up on, the first page of that visit, the site or campaign that referred you, and the time. We use these only to understand which pages and channels bring people to Clairop, and they are deleted together with your email.

If you use one of our free tools and enter your email, we store the email address and which tool you used, and add you to the launch list. Your answers are used to calculate your result and to write the email we send you; we do not store them. Those emails are delivered by our email provider, Resend, which processes the address and the message content only to deliver it.

How long we keep it

• Log entries and your profile: until you delete them. We do not expire your health history on a timer; it is the thing you came here to keep.
• Your subscription record: until you delete your account.
• Analytics events and usage counters: deleted automatically after 90 days by a scheduled job.
• Meal photos: on your device only, until you delete them or remove the app.
• Assistant conversations:on your device only, until you start a new conversation, reset the app's data, sign in as a different account, or remove the app. We keep no copy.
• Waitlist and free-tool emails: until you ask us to remove yours, or the launch email has been sent.

Your rights

Wherever you live, you can access, correct, export or delete your data. In the app: Profile → Delete Account erases your account and every entry, cached analysis, entitlement record and analytics row we hold. Profile → Reset all data clears this device and keeps the account.

If you are in the UK, EU, Canada or a US state with a comprehensive privacy law, you also have the right to object to or restrict processing, to data portability, and to complain to your regulator: the ICO in the UK, your national supervisory authority in the EU, or the Office of the Privacy Commissioner of Canada.

Email clairop.support@gmail.com and we will respond within 30 days.

Security

Traffic is encrypted in transit. Every backend endpoint verifies your identity before doing anything, and every database table enforces row-level security so one account cannot read another's rows. Sign-in tokens are held in the iOS Keychain.

One specific protection worth naming: if you sign in on a device where a different account was previously used, Clairopwipes the local data first. On a shared, resold or handed-down phone, that stops one person's bowel history being visible to the next.

No system is perfectly secure. If we ever suffer a breach affecting your health data, we will notify you and the relevant regulator as the law requires.

Children

Clairop is not intended for children. You must be at least 16 to create an account. We do not knowingly collect information from anyone younger; if we learn that we have, we delete it.

International transfers

Our servers and most of our processors are in the United States. If you use Clairop from the UK or the EEA, your data is transferred there under the UK Addendum and the EU Standard Contractual Clauses respectively.

Changes

If we change this policy in a way that materially affects how your health data is handled, we will tell you in the app before it takes effect rather than quietly updating the date at the top.

Contact

Pavado Technologies Inc.
Province of Ontario, Canada
clairop.support@gmail.com