Privacy Policy

Privacy Policy

Last Updated: August 23, 2026


This Privacy Policy explains how Clera collects, uses, shares, and protects your information. Clera is operated by LAZUL PTY LTD.


1. Information We Collect


Information You Provide

  • A first name, entered during onboarding. This is stored on your device and sent to our analytics provider as a profile attribute.

  • Answers to onboarding questions, including your age range, gender, how long you have experienced skin concerns, what you have already tried, and your goals. All answers are chosen from a fixed list of options; none are free text.

  • Photos you capture with the camera or select from your photo library in order to scan a product.

  • Product names, brands, and ingredient text you type when searching or adding a product manually.

  • If you contact support: your email address (required), an optional name, and the subject and message you write.

  • If you report a product as inaccurate: the reason, any detail you add, and a snapshot of what the app displayed to you at the time.


Clera does not offer account registration. There is no username, password, or login. We do not collect your email address unless you contact support.


Information Collected Automatically

  • A randomly generated device identifier, created the first time you open the app and stored on your device. It is not derived from any Apple or hardware identifier. It is how your scan history is associated with your installation, and it is reset if you delete and reinstall the app.

  • Products scanned, ingredients analyzed, and the resulting risk scores.

  • App interactions, screens viewed, and onboarding progress.

  • Device model, operating system version, and app version.

  • Crash diagnostics, including stack traces, collected when the app terminates unexpectedly.

  • Session recordings. Our analytics provider periodically captures screenshots of the app while you use it, in order to help us diagnose problems and improve the product. Text you type into input fields, and images, are automatically obscured before the screenshot is stored. Certain screens, including onboarding survey answers, your Clera score, the paywall, settings, and the support form, are additionally obscured in full.

  • Your IP address, which is used by our analytics provider to derive an approximate region (typically country or city level). We do not collect precise or GPS location.


Photos and Images

When a scan involves a barcode we cannot identify from any product database, we store a copy of that photo on our servers alongside the barcode and your device identifier. These photos are reviewed by our team so we can add the missing product to our catalog. They are not used for any other purpose, are not linked to your name, and are not shared with advertisers.

Information We Do Not Collect

  • We do not request App Tracking Transparency permission, and we do not collect the IDFA or any other advertising identifier.

  • We do not collect biometric identifiers.

  • We do not collect precise location.

  • We do not collect contacts, calendar, microphone, or health data from Apple Health.

  • Your daily log of foods and products is stored only on your device. It is not uploaded to our servers.


2. How We Use Information


We use collected information to:

  • Identify products you scan and analyze their ingredients

  • Generate risk scores and ingredient explanations

  • Maintain your scan history across sessions

  • Expand and correct our product and ingredient catalog

  • Diagnose crashes, errors, and usability problems

  • Understand how people move through the app so we can improve it

  • Measure the performance of our advertising

  • Detect and prevent abuse, including rate-limiting excessive requests

  • Respond to your support requests

  • Comply with legal obligations


Product analysis is performed using automated systems, including artificial intelligence. Scores and ingredient assessments are generated automatically and are provided for general informational purposes only. They are not medical advice and are not a substitute for consultation with a qualified healthcare professional.


3. Third Parties Who Receive Data


We share data with the following categories of providers. We do not share your data with anyone not described here.


Product analysis

  • OpenAI, which processes the photos you scan and the product text you type in order to identify products and extract ingredient lists. Images and text you submit for scanning are transmitted to OpenAI for this purpose.

  • Third-party product databases, including Barcodelookup and Open Food Facts, which receive the barcode number you scan in order to return product information. They do not receive your photo or your device identifier.


Infrastructure

  • Supabase, which hosts our database, storage, and server functions.


Analytics and diagnostics

  • PostHog, which receives app events, screen views, session recordings, crash reports, your first name, your onboarding survey answers, and a one-way cryptographic hash of your device identifier. We deliberately send the hash rather than the identifier itself, so that our analytics provider cannot use it to access your scan history.


Subscriptions

  • RevenueCat and Apple, which process subscription purchases, trials, and renewals. We never see or store your payment details.


Advertising

  • Meta Platforms. See Section 4.


We may also disclose information if required by law, legal process, or a valid government request, or where necessary to protect our rights, safety, or the safety of others.


4. Advertising


Clera includes the Meta SDK in order to measure the effectiveness of advertising we run on Facebook and Instagram. When you open the app, and when you start a trial or purchase a subscription, Meta receives an event indicating that this occurred, along with the subscription product, amount, and currency.


We do not send Meta your name, email address, survey answers, scans, or photos.

Because we do not request App Tracking Transparency permission and do not collect the IDFA, this measurement is performed without device-level ad matching. Attribution is handled through Apple's SKAdNetwork, which is designed to report campaign performance without identifying individual users.

Even so, sharing app activity with an advertising platform may qualify as "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act, and as "targeted advertising" under other state privacy laws. You have the right to opt out. To do so, email hello@clera.health from the device you use Clera on and include the words "Opt out of advertising." We will disable advertising measurement for your installation.


We do not sell personal information, and we have never done so.


5. Data Retention


  • Scan history is retained until you delete individual items or delete your account in the app.

  • Donated barcode photos are retained until our team reviews them and adds the product to our catalog, after which the photo is deleted. Photos we cannot use are deleted during the same review.

  • Support requests and product reports are retained for up to 24 months so we can handle follow-up correspondence and track recurring issues.

  • Analytics events, session recordings, and crash reports are retained according to our analytics provider's retention settings, currently a maximum of 12 months for session recordings and 12 months for events.

  • Aggregate and de-identified data, including ingredient catalog entries derived from scans, may be retained indefinitely. This data is not linked to you.


6. Your Choices and Rights


Deleting your data in the app

Settings contains a Delete Account option. Using it will:

  • Delete your scan history from our servers

  • Clear all data stored on your device, including your name and your daily log

  • Reset your device identifier, so future activity cannot be linked to your past activity

  • Reset your analytics identity


It does not cancel your App Store subscription, which you manage through Apple, and it does not automatically remove support requests, product reports, or previously collected analytics events. To have those deleted, email us as described below.


Rights under U.S. state law

Depending on where you live, you may have the right to:

  • Know what personal information we have collected and how we use it

  • Request a copy of your personal information

  • Request correction of inaccurate personal information

  • Request deletion of your personal information

  • Opt out of targeted advertising, and of the sale or sharing of personal information

  • Not be discriminated against for exercising these rights

  • Appeal a decision we make about your request


To exercise any of these rights, email hello@clera.health.


Verifying your request

Because Clera has no accounts, we cannot identify you by name or email alone. To act on a request about data held on our servers, we need your device identifier. You can find it in Settings under About. If you have already deleted the app, we may be unable to locate your data, because we hold nothing else that identifies you.


We will respond within 45 days, and may extend once by a further 45 days where permitted. If we decline your request, you may appeal by replying to our response; we will respond to appeals within 45 days.


7. Data Security


We use encryption in transit for all communication between the app and our servers, and our infrastructure providers encrypt data at rest.

You should be aware of one design limitation. Because Clera has no accounts, your scan history is associated with a randomly generated device identifier rather than a password-protected login. This means anyone who obtained that identifier could retrieve the scan history associated with it. The identifier is stored only on your device and is never sent to our analytics provider in its original form. We consider this an acceptable trade-off for not requiring you to create an account, but we state it plainly so you can judge for yourself.


No system can guarantee complete security.


8. Children's Privacy


Clera is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided personal information, contact hello@clera.health and we will delete it.


We do not knowingly share the personal information of anyone under 16 with advertising platforms.


9. Health-Related Information


Some of the information you provide, including your answers about skin concerns, what treatments you have tried, and the products you scan and log, is health-related.

We treat this information as sensitive. We do not sell it, we do not share it with advertising platforms, and we do not use it for any purpose other than providing and improving Clera's analysis features.

Clera is not a medical device, is not a covered entity under HIPAA, and does not provide diagnosis or treatment. Its output is informational only.


10. Changes to This Policy


We may update this Privacy Policy. When we make material changes, we will update the "Last Updated" date above and, where required by law, provide notice in the app before the change takes effect.


11. Contact


For privacy inquiries, rights requests, or advertising opt-outs: hello@clera.health

LAZUL PTY LTD.