Clarity Privacy Notice

When a subscription ends, there is no choice to keep a profile. On the deletion date the whole family space is deleted, the owner’s profile included.

Clarity warns the family a week before the deletion date and again shortly before it, by push notification and, where it can, by email.

The person who added a report, the carer or a co-carer can delete that one report. The carer can remove a whole profile.

To stop Clarity processing your health information, delete your account from Profile. This notice no longer describes any other way to do that.

Clarity is operated by NorthNeuron Technologies Private Limited, Bangalore, India.

For any question about your information, to exercise your rights, or to raise a complaint, write to contact@northneuron.com. The same address reaches our Grievance Officer, who is responsible for resolving complaints about how your information is handled.

This notice covers the Clarity application and the account you use to sign in to it. It does not cover the NorthNeuron website or our other products, which have their own notices.

Clarity holds health information about you and about the people you add to your family. Please read the section on who can see a family member’s records before you add anyone.

Your account: the email address or phone number you sign in with, and your settings, including whether reminders are switched on.

Your family: the name, relationship, date of birth and sex of each person you add, and which accounts may act for them. Sex is recorded as female, male or “prefer not to say”, only as you tell us, and you can change it at any time.

Your documents: the original report, prescription or image exactly as you uploaded it.

What we read from those documents: each test name, the value printed for it, its unit, the reference range printed beside it, and any abnormality flag the report itself carries. We also keep the exact line of the document each value was read from and where that line appears on the page, so that every value we show you can be traced back to the report it came from.

What we generate: the plain-language explanation shown to you, the summary of a record, and preliminary AI observations, which are always marked as unconfirmed.

Your care planning: appointments, medication schedules and the reminders due for them.

Your subscription: the plan and term your family space has, when it renews or ends, and the identifiers the App Store or Google Play give the purchase.

Your activity: corrections you make to a record, summaries you share and when a shared link was opened, the consent you have given, and a log of significant actions on the account. All of it is held under your account and all of it is deleted with it.

To store your family’s records in one place and show them back to you organised and explained.

To show each value against the range printed on the report it came from, with the original line available so you can check it yourself.

We ask for each person’s sex because many laboratory tests print different reference ranges for women and men. Today Clarity only stores it and shows it on the profile: it is not sent to the AI analysis service, it is not included in a summary you share, and it is not used to explain reports. We will not use it for that without first issuing a new version of this notice and asking for your separate agreement.

To remind you about medications and appointments you have asked to be reminded about.

To let you share a summary with someone you choose, and to show you when that link was opened.

To keep the service secure and to investigate problems while your account exists.

We do not sell your information. We do not use your health information to advertise to you, and we do not use it to train any general-purpose AI model.

To read a document you upload, it is sent to a document text-extraction service, which returns the text it contains and where that text sits on the page. The whole document is sent, because the service has to read all of it.

To help explain a report, information is sent to an AI analysis service. What is sent depends on the kind of document. For a laboratory or pathology report, only the lines already extracted from it are sent, together with the record’s type and title — not the document, not your name or your family’s, and not the date of birth or sex recorded on anyone’s profile. For a document you add as a clinical image or scan, the file itself is sent, including anything printed on it such as a name or a hospital reference.

We instruct these services not to retain what we send them. We cannot independently verify what a third party does with data after it receives it, and we do not claim to.

Anything the AI produces is stored as a preliminary, unconfirmed observation. It never becomes a recorded clinical fact on its own, and Clarity will not present it as one.

This is the most important thing to understand before you add someone to your family.

The carer, and a co-carer if they have invited one, can see and manage the health records of every person in that family. That is deliberate: Clarity exists so that one person can look after a family’s health without having to hold it all in their head.

Someone given a place of their own sees and manages only their own profile. They cannot see anyone else in the family, and nobody else’s records are readable by them.

An account added as a member can see only the one person it is linked to. It cannot see other members, and it cannot see the family list.

It follows that adding a person to your family may make their health information readable by you and by a co-carer you invite. You must have that person’s agreement, or lawful authority to act for them, before you add them. Making someone a co-carer widens what they can read from one profile to everyone’s, so we ask you to confirm it separately and we record that you did.

We use a small number of service providers to run Clarity: cloud infrastructure and storage, a document text-extraction service, an AI analysis service, an identity provider that handles sign-in, an email service that delivers family invitations and notices about your subscription, the push notification services operated by the makers of your phone’s operating system, and the App Store and Google Play, which take payment for Clarity Family.

They receive only what their function requires. Sign-in involves no health information. An invitation email contains the invitation and the name of the person it concerns, and no medical content. A push notification never names a person, a medicine, a condition or a result — it says only that something is waiting for you in Clarity.

Warnings that the family space will be deleted go to everyone in the family who has a sign-in, a week before the date and again shortly before it. They arrive as push notifications and, where Clarity can, by email to the address you sign in with. A push notification can be read on a lock screen, and an email’s subject can appear in a preview. They say only that the subscription has ended, that the family space is read-only, and the date it will be deleted: never a person, a profile, or anything about anyone’s health.

When you buy Clarity Family, Apple or Google take the payment. Clarity gives them an opaque token that lets Clarity match the purchase to your family space. It is not your name, your email address or anything about your health, and Clarity does not give Apple or Google your identity.

We do not publish the names of our service providers here. A current list is available to you on request from contact@northneuron.com.

The clinical content of your records — the values read from your reports, the lines they were read from, the explanations, summaries and record titles, and the direct identifiers of you and your family — is encrypted, using keys held separately from the database and not available to it.

Not everything is encrypted. Operational information such as dates, statuses, counts and internal identifiers, and each person’s date of birth, relationship and recorded sex, is stored in plain form. A person who obtained that information without the keys could learn a family member’s date of birth, relationship and recorded sex, that a record exists, when it was issued and that a reminder is due — not what any result says, and not anyone’s name.

Records created before this protection was introduced are being migrated. Until that migration is finished, older copies of some values remain in the database without encryption. We will update this notice when it completes, and not before.

We do not describe our security measures in detail here. Publishing them would help someone attacking the service and would not help you.

We keep your family’s records until you delete them, you delete the account, or the family space is deleted after a subscription ends.

Anyone can delete their own account, immediately, from the Profile screen in the app. There is no pause and no waiting period: an account is either in a family or gone from it. Deleting a family removes its documents, records, results, explanations, appointments, medications, reminders and shared summaries.

Records belong to the family space, and the family space belongs to the account that created it. When the carer deletes their account, the whole space goes with it — every person in it, their records, and every other account’s access — without needing anyone else’s agreement.

What happens when anyone else leaves depends on whose profile it was, and that is something we record rather than guess.

A co-carer who deletes their account takes their account and their access, and nothing else. A co-carer may have been given access to a profile belonging to somebody the family looks after, so their departure must never destroy the records of the person they were helping to care for.

Someone with a place of their own takes their own profile and its reports with them when they delete their account. That profile is theirs — the carer confirmed as much when they invited them, and we recorded it — so leaving with their own health information is a right rather than an accident. The rest of the family is unaffected.

When the carer ends somebody’s access, that removes the access only. The profile stays with the family and keeps its records, because ending access is not the same as deleting a person.

The person who added a report, the carer or a co-carer can delete that one report. The file and everything Clarity read from it are deleted, and any shared link that includes it stops working.

The carer can remove a whole profile. Everything on it is deleted, and if someone signs in to that profile, their account is deleted too.

If someone wants to keep records after the carer leaves, the carer must hand the family to them before deleting, and it can only be handed to a co-carer. Clarity does not hold records on anyone’s behalf, and will not keep a family space alive because someone else in it would prefer that.

When a subscription ends, the family space becomes read-only and Clarity deletes nothing during that time. Everyone can still open and download the records they can see. The family space is deleted 30 days after payment stopped, or later if Clarity could not warn the family in time. Every profile in it is deleted, the owner’s included.

That includes the profile of a person who signs in to their own profile in someone else’s family space, with every record in it. That person is not separately asked. They get the same warnings as everyone else, and they can download their own records until the date.

Sign-ins are not deleted when a subscription ends: nobody loses their account because somebody else’s payment did not go through.

Nothing survives a deletion. We do not keep a shadow copy, an anonymised record, or a note that your account once existed. The record of the consent you gave is deleted along with it.

Deleted information may persist in our provider’s routine backup copies for up to seven days, after which those copies expire. It is not recoverable by you or by us in the meantime.

A carer adding someone under 18, or anyone else they act for, must confirm that they are that person’s parent or lawful guardian, or otherwise have lawful authority. We record that confirmation, who made it and when.

We do not currently verify that confirmation. It is a statement you make to us and are responsible for. If you tell us it was made wrongly, write to contact@northneuron.com and we will remove that person’s information.

Clarity is not intended to be used by a person under 18 signing up for themselves.

You can see the information Clarity holds about your family within the application, correct a report’s title or the laboratory named on it, delete a report you are allowed to delete, export your account’s data, withdraw a summary you have shared, turn reminders off, and delete your account.

To ask for anything you cannot do in the application, such as a copy of your information in another form, write to contact@northneuron.com.

To stop Clarity processing your health information, delete your account from Profile. What that removes depends on whose profile it is, and Clarity tells you before you confirm. Deleting does not undo what was lawfully done beforehand.

Write to contact@northneuron.com. That address reaches our Grievance Officer. Tell us what happened and what you would like us to do, and we will respond.

If a security incident affects your information in a way that matters to you, we will tell you and the authorities we are required to inform.

Each version of this notice carries a version marker, shown at the top of this page. When we make a material change we issue a new version and ask you to accept it. We keep a record of which version you accepted and when.