"Personal information" means data that identifies you directly, such as your name or contact details, or indirectly when combined with other information.
In some circumstances we process your personal information on behalf of third parties. Those third parties may also act as data controllers and will have their own privacy policies, which we recommend you review.
Scope
This Policy applies to your use of the Klarity app and website at klarity.health and to services we provide through our screening programmes and related features.
Information we collect and how we collect it
2.1You provide to us
You may provide information when you:
- enter details into the Klarity app or our website
- allow us access to data held by third parties (for example, wearable or health data)
- complete forms, questionnaires or assessments
- correspond with us by phone, email or otherwise.
We will make it clear at the time what information we are requesting. If you do not provide required information, or later withdraw your consent where consent is the lawful basis, we may be unable to deliver the relevant services. You can stop using the app or our services at any time.
2.2Collected automatically when you use the app
Each time you use the Klarity app we may automatically collect:
- technical information such as device type, unique device identifier, mobile network, operating system and time zone
- data accessed from your device where you have given explicit consent, including GPS location, date and time.
- usage details about your interaction with the app and our services.
2.3Account and support information
To create and manage your account we collect:
- name, email address, telephone number, date of birth and gender
- details of support queries you raise about technical issues
- your account password, which we store only as a salted hash. We cannot see it, retrieve it or tell it to you, and no member of our team will ever ask you for it.
2.4Information we receive from others
As well as what you give us directly, we receive information about you from:
- Wearables and health platforms you choose to connect, such as activity, sleep and heart-rate data
- Our screening partners, who send us the results of tests you have arranged through Klarity so that we can provide them to you
- Your employer or the organisation funding your programme, which gives us your name, work email address and assigned work location so that we can invite you and report by site. It does not give us any health information about you.
Section 3 explains when we share information with those partners. Section 6 explains every circumstance in which we share information at all.
Screening programmes and partners
For screening services requiring clinic appointments, image analysis or sample collection, such as mammograms, skin and mole checks or blood draws, we work with trusted partners including The Mole Clinic, Community Dermatology Limited t/a Map My Mole, Scan.com, Bloodsandbeyond and The Doctors Laboratory. Your data is shared with these partners solely to deliver the services you request. We also receive test results back so we can provide them to you. Section 3 of our Data Sharing Policy holds the current list and what each partner does.
How we use your information and lawful bases
We process your personal information for the purposes below under the lawful bases indicated.
4.1Contract
- to register you for services, create and manage your account
- to deliver the app, website and services you request
- to investigate and resolve queries, questions and complaints that affect your use of our services.
4.2Legal obligation
- to make disclosures required by law or in response to reasonable requests by regulators or law enforcement.
4.3Legitimate interests
- to review and enhance service quality and performance
- to respond to general enquiries and feedback
- for internal operations, including analysis and reporting, troubleshooting, fraud detection, log analysis, testing, security, audit and statistics
- to maintain a suppression list if you opt out of communications
- to establish, exercise or defend legal claims.
Where we rely on legitimate interests, we assess and document the balance between our interests and your rights. You can request information about these assessments.
4.4Consent
- where we rely on your explicit consent to process special category data (for example, certain health data where consent is the most appropriate legal basis)
- where we use your information for specific optional features such as certain personalised insights or communications.
You can withdraw consent at any time, although this will not affect processing already carried out lawfully. Withdrawal may mean we can no longer provide parts of the services.
4.5Recommendations and personalisation
- to recommend content, products or services that may be of interest
- to identify your preferences and personalise your Klarity experience
- to generate health scores, chronic disease risk assessments and related insights where you choose to use those features.
Where the personal information used includes special category data, we rely on explicit consent or, where data comes from a third party, the lawful basis relied on by that provider together with the applicable Article 9 condition under UK GDPR, such as explicit consent or healthcare-related processing.
Profiling and automated decision-making
Our models may analyse your data to provide risk scores or recommendations. These outputs support your decision-making and do not replace professional medical advice. We do not make decisions with legal or similarly significant effects on you solely by automated means without appropriate safeguards. If we ever introduce such processing, we will notify you and explain your rights.
When we share your information
We share personal information only as follows:
We never sell your personal information, and we never share your individual health information with your employer, with your employer's adviser or broker, or with any insurer. We do not give third parties direct real-time access to your data, and we do not share tracking identifiers or cookies with advertisers or insurers.
Beyond the routes listed above, we share your information only where you specifically ask us to.
Where this Policy and our Data Sharing Policy differ in relation to a screening programme, the Data Sharing Policy applies.
International transfers
We store your personal information in the United Kingdom. Our production systems and backups are hosted in UK data centres, and access is limited to authorised personnel in the UK. Our teams outside the UK do not have access to your personal information.
There is one exception. Website analytics data, described in our Cookie Policy, is processed by Google and may be transferred to the United States. Where you consent to analytics, that transfer is made under the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Analytics data does not include your health information.
If this ever changes, we will use an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum, and we will update this Policy. You can contact us for details of the safeguards in place.
Security
We take appropriate technical and organisational measures to protect your information, including:
- access controls and role-based permissions
- encrypted communications using TLS/HTTPS
- secure storage with encryption at rest
- data lifecycle management, including secure disposal when data is no longer needed.
No system is perfectly secure, but we apply strict procedures and features to help prevent unauthorised access.
How long we keep your information
We keep personal information for as long as needed to provide services and meet legal or regulatory requirements. In most cases we retain data for 7 years after our last contact. We may keep data longer where required by law, to resolve disputes or to enforce our agreements. When we no longer need information, we securely erase or anonymise it. Where third-party providers process your data for us, they keep it only for as long as necessary to deliver their services and must securely delete or return it when our relationship ends.
Links to other sites
Our app and website may contain links to third-party sites or apps. Those sites are not under our control and have their own privacy policies. You should review those policies before providing personal information.
Your rights
You have the following rights, subject to conditions and exemptions in law:
- Right to be informed: about how your information is used
- Right of access: to your information
- Right to rectification: of inaccurate or incomplete information
- Right to erasure: in some circumstances
- Right to restriction of processing: in some circumstances
- Right to data portability: to obtain and reuse your information
- Right to object to certain processing, including processing based on legitimate interests.
- Right to withdraw consent at any time where we rely on consent
- Right to lodge a complaint with a supervisory authority.
We usually act on requests free of charge. We may charge a reasonable fee or refuse to act on requests that are unfounded, excessive or repetitive. We will respond within one month, or inform you if more time is needed for complex requests.
In the UK the supervisory authority is the Information Commissioner's Office (ICO).
Website visitors
If you visit the website without subscribing to the app or programmes, we will usually not ask you to provide health or medical data. We may collect:
- queries you submit by phone, email or otherwise
- interactions with our social media channels
- technical information and analytics about your visit.
We use this information to respond to queries, contact you where you have registered interest, improve our site and analyse usage.
Public posts on message boards or social media are your choice and may be visible to others.
Data breach notification
If a personal data breach may pose a risk to your rights and freedoms, we will notify you and the relevant authority without undue delay, and within 72 hours where feasible, in line with UK GDPR.
Age restriction
Klarity is for adults. Our services are not directed to, and must not be used by, anyone under 18. This mirrors the contraindication in our Regulatory Information. If you believe we hold information about someone under 18, contact us and we will close the account and delete the data.
Changes to this Policy
We may update this Policy from time to time. We will post changes in the app and on the website and, where appropriate, notify you. You may be required to acknowledge new terms to continue using our services.
Contact us
If you have any questions, comments or requests regarding this Privacy Policy, please get in touch. Data protection is overseen by our Privacy and Security Officer, who you can reach at info@getklarity.io. Mark your message for the attention of the Privacy and Security Officer and it will be routed to them.
We are registered with the Information Commissioner's Office under reference ZA748065.
Alum House, 5 Alum Chine Road
Westbourne, Bournemouth
BH4 8DT
United Kingdom
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Our ICO registration reference is ZA748065.
ico.org.uk/concerns/casework@ico.org.ukIf you are not satisfied with our response, you can contact the Information Commissioner's Office (ICO).