Consumer Health Data Privacy Policy

Effective date: October 31, 2026 Last updated: October 31, 2026

This policy explains how Clemapp, Inc. (“Clem,” “we,” “us”) collects, uses, and shares consumer health data, as that term is used in the Washington My Health My Data Act, Nevada Senate Bill 370, Connecticut’s consumer health data law, and similar state laws. It supplements our Privacy Policy, which covers everything else Clem collects. If the two differ on consumer health data, this policy controls.

1. When Clem handles consumer health data

Most people who use Clem share no health data with us. Clem scores grocery products; it does not ask about your health.

The exception is our sugar and carbs pilot, an invite-only program for people managing diabetes or watching their blood sugar. Joining the pilot tells us something about your health, so we treat the facts below as consumer health data.

Clem never collects your blood sugar readings, glucose monitor data, diagnoses, medications, insulin doses, or Apple Health (HealthKit) data.

2. What we collect

If you join the pilot, we collect:

That you are a pilot member: your invite code, when you joined, how you joined (an invite link or a typed code), and your member number (for example, “#4 of 200”).
How you use the sugar and carbs check: for example, when the check is shown on a scan and whether you opened the pilot’s tour or contact options. The check itself is calculated from the product’s nutrition label, not from anything about you.
Your survey answers: your multiple-choice answers to the pilot’s short in-app survey, and, if you choose to type one, a feedback note. The survey asks you to leave out anything about your health.
If we invited you by direct message: a private list, kept by our team, matching your invite code to the social media username and first name we wrote to, so we know who accepted.
If you contact us: the emails you send our team and the calls you book with us, including anything you choose to tell us.

3. Where it comes from

Directly from you when you open an invite link, enter a code, use the app, answer the survey, or contact us; and from our own records of the invitations we sent.

4. Why we use it

Only to:

give you the pilot’s features (the sugar and carbs check, the pilot card on your Home screen, and your member number);
understand whether the check is useful and improve it, using survey answers and usage counts;
reply to you and hold the calls you book.

We do not use consumer health data for advertising, we do not sell it, and we do not use it to make decisions about you outside the app.

Only with service providers that process it for us under contract:

Supabase (our database): your pilot membership, survey notes, and account.
PostHog (product analytics): your invite code, stored as a property of your analytics profile, and the pilot events and survey answers described in Section 2.
Google Workspace (our team’s email, calendar, and spreadsheets): the invitation list, emails you send us, and calls you book.

We do not share consumer health data with advertisers, data brokers, or the AI that analyzes your food. We will disclose it to others only if the law requires it, and never sell it.

We collect consumer health data only with your consent. You give it when you continue past the pilot’s welcome screen, which tells you that joining stores your pilot membership and links to this policy. You can withdraw consent at any time, as described below. Withdrawing ends your pilot membership; the rest of Clem keeps working.

7. Your rights

You can:

See the consumer health data we hold about you and the list of companies we share it with;
Delete it, by deleting your account in Settings → Delete Account (this removes your pilot membership and survey notes) or by asking us to remove only your pilot data;
Withdraw your consent, which ends your pilot membership and stops further collection.

To exercise any of these, email privacy@clemapp.com from the email address on your Clem account, with “Health data request” in the subject line. We will respond within 45 days. If we decline your request, you can appeal by replying with “Health data appeal” in the subject line; we will answer the appeal in writing within 45 days. If the appeal is denied, you may contact your state attorney general (in Washington, at atg.wa.gov).

Deleting your account deletes your pilot data from our live database immediately, and from backups within 30 days. To also remove your analytics profile and its pilot events from PostHog, email us as above and we will delete it within 45 days.

8. Security

Consumer health data gets the same protections as the rest of your data: encryption in transit and at rest, and database rules that let only you read your own records. Access by our team is limited to people running the pilot.

9. Changes and contact

If we change this policy, we will update the date above and tell pilot members in the app before any new collection or sharing begins.

Questions: privacy@clemapp.com, Clemapp, Inc., 3227 McKinney Ave, Dallas, TX 75204, United States.