Clarrif

Privacy Policy

Effective Date: 3 SEP 2026

Clarrif ("Company", "we", "us", or "our") provides an AI-powered platform for diagnostic laboratories, hospitals, and healthcare organizations ("Customers"). This Privacy Policy explains how we collect, process, use, and protect personal data when our Customers use the Clarrif platform ("Service"). This Policy applies to organizational Customers and their authorized users. Clarrif does not enter into a direct service or contractual relationship with individual patients and does not market to them. Where the Customer enables it, the Service transmits reports and reminders to patients and other recipients on the Customer's behalf, acting only as a processor on the Customer's instructions (see Section 5A).

0. Roles and Responsibilities

0.1 Customer as Data Controller

Our Customers (labs, hospitals, clinics) determine what data is uploaded, configure retention settings, obtain patient consent, and control how outputs are used. Customers act as the Data Controller under applicable privacy laws.

0.2 Clarrif as Data Processor

Clarrif acts as a Data Processor and processes data only on documented instructions from the Customer, to provide the Service, and in accordance with contractual obligations. We do not determine the purpose of processing patient data. Clarrif acts as an independent controller only for limited account, security, billing, and operational data relating to Customers and their Authorized Users.

0.3 Terminology

"Controller" and "Processor" in this Policy correspond to "Data Fiduciary" and "Data Processor" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

1. Categories of Data Processed

1.1 Customer Account Data
  • Organization name
  • Authorized user name
  • Work email address
  • Phone number (if provided)
  • Billing and usage metadata
  • Integration API key metadata (a stored hash and usage records — never the key itself)
  • Technical records collected for security and to evidence acceptance of our terms, such as IP address, browser/user-agent, and timestamps

This data is used for account management, security and audit logging, service delivery, and limited service communications. Where we send marketing or promotional communications to Authorized Users, we do so only on a lawful basis and you may opt out at any time via the unsubscribe link or by contacting support@clarrif.com.

1.2 Lab Report Data (Customer Data)
  • Diagnostic test values and reference ranges
  • Patient age and gender
  • Medical observations and AI Outputs
  • Other report-related content, including any information the Customer includes in an uploaded document or sends through the Integration API

This data is processed to generate AI Outputs, provide dashboard analytics, and deliver reports and related features. We do not use Customer Data for advertising or resale.

1.3 Patient Contact and Directory Data

To deliver reports and send Customer-configured reminders, and to group a patient's reports over time, the Service maintains a per-patient directory containing information the Customer supplies or uploads:

  • Patient name, email address, and phone number
  • The Customer's own patient/medical-record identifier (MRN)
  • Age and gender
  • Communication status and preferences (for example, delivery status, bounce status, and unsubscribe/opt-out)
1.4 Longitudinal Health-Trend Data

Where a patient identifier is provided, the Service stores per-report result snapshots so it can show that patient's health trends across reports over time. These records may persist after an individual report is deleted (see Section 2).

1.5 Referrer Data

Contact and reference details of referring providers/doctors that the Customer adds or sends, used for delivery to referrers and for referral analytics.

1.6 Delivery and Engagement Metadata

Records of report deliveries and reminders — such as recipient, channel, send time, delivery/bounce/complaint outcome, and whether a report link was opened — used to operate delivery, power dashboards, and honour opt-outs.

2. Data Retention

2.1 Default Retention

Processed Lab Reports and associated AI Outputs are retained for 7 days by default. After the retention period, the report document and its AI Outputs are automatically deleted from active systems, and that deletion is irreversible unless otherwise contractually agreed. Deleting a report does not by itself delete every record derived from it — see Section 2.4.

2.2 Configurable Retention

Customers may configure shorter or longer retention periods through platform settings where available. The Customer is responsible for ensuring retention settings comply with applicable laws and medical record requirements.

2.3 Backup Deletion

Residual system backups are purged according to internal secure deletion schedules.

2.4 Operational and Derived Records

Deleting a Lab Report removes the report document and its AI Outputs. Certain records are retained on their own lifecycles so the Service can function and so history is not lost when an individual report is deleted: the patient directory (retained while the patient has any remaining report and cleared thereafter), longitudinal health-trend snapshots, delivery and audit logs, scheduled reminders and unsubscribe records, and aggregate, de-identified usage analytics. A deleted report may be recoverable for a short recovery window before permanent deletion.

3. Redaction and Data Minimization

Customers are responsible for ensuring that only necessary information is uploaded and that sensitive identifiers are removed or redacted. The platform provides manual and automated redaction tools where available. Clarrif does not guarantee complete removal of all identifiers and relies on Customer oversight.

4. Cross-Border Data Transfers

Data may be processed on secure cloud infrastructure located outside the country of origin, including outside India. By using the Service, Customers confirm that they have obtained necessary patient consent and are legally authorized to transfer data across borders. We implement contractual and security safeguards for international processing, including standard contractual protections with sub-processors that process data outside India (such as our AI and storage providers).

5. Third-Party Service Providers (Subprocessors)

Clarrif uses third-party service providers to operate the Service, in the following categories: cloud infrastructure and object storage, AI model providers, email delivery, and payment processing. These providers process data only on our instructions, are bound by confidentiality and security obligations, and do not receive data for marketing purposes. The current list of sub-processors — including provider names and processing purposes — is maintained in the Data Processing Addendum.

AI Service Providers

We use enterprise AI providers to power certain features, including large language models used for generating summaries and insights and text-to-speech services used for audio narration. These providers process data solely on our instructions. Neither Clarrif nor these providers use Customer Data to train their AI models.

Payment Processing

Billing and invoicing are handled through a third-party payment provider. Payment-card and transaction details are processed by that provider under its own terms; Clarrif does not store full payment-card numbers.

5A. Patient Communications and Opt-Out

Where the Customer enables delivery or reminder features, the Service sends reports and reminders (for example, unopened-report reminders and retest/recall reminders) to the recipients the Customer designates, using the contact details the Customer supplies. Clarrif sends these communications only as a processor on the Customer's instructions and does not decide who is contacted.

Reminder emails include an unsubscribe/opt-out option, and the Service also stops sending to an address that hard-bounces. Opt-out and bounce status are recorded so the Service honours them. A recipient who wishes to stop receiving communications, or to correct or delete their details, should contact the Customer (the Controller); Clarrif will assist the Customer as described in Section 8.

6. Security Measures

  • Encryption in transit (TLS)
  • Encryption at rest
  • Role-based access controls
  • Audit logging
  • Secure infrastructure configuration

Despite strong safeguards, no system can guarantee absolute security.

7. Lawful Basis and Consent

Clarrif does not directly collect patient consent. The Customer is responsible for informing patients about AI-based processing, cross-border transfers (if applicable), and privacy disclosures, and for obtaining a legally valid consent or other lawful basis — including any consent required to deliver reports to, and to send reminders to, patients and other recipients the Customer designates, and to store their contact details. Clarrif is not responsible for failure by the Customer to obtain a proper lawful basis.

8. Data Subject Rights

Since Customers act as Data Controllers, requests for access, correction, or deletion of patient data must be directed to the Customer. Clarrif will assist Customers in responding to such requests where required.

9. Data Breach Notification

In the event of a confirmed personal-data breach affecting Customer Data, Clarrif will notify the affected Customer without undue delay and in any event within 72 hours of confirming the breach, provide the information the Customer reasonably needs to notify the Data Protection Board of India and affected data principals, and provide reasonable assistance in investigation and mitigation. Customers remain responsible for their own regulatory reporting obligations.

10. Cookies and Analytics

We may use cookies and analytics tools on our website or dashboards to understand usage patterns, improve performance, and enhance user experience. We do not use analytics to profile patients. Where analytics data is aggregated so that it no longer identifies an individual, we treat it as non-personal; any analytics data that still identifies an individual remains subject to this Policy.

11. Children’s Data

Under India’s DPDP Act, a child is an individual under the age of 18. Clarrif has no direct relationship with patients and relies on the Customer, as Data Fiduciary, to obtain verifiable parental or guardian consent before a minor’s data is uploaded, sent, or used to deliver reports or reminders. Clarrif does not use minors’ personal data for tracking, behavioural monitoring, or targeted advertising. Reminder and health-trend features are applied to a minor’s data only on the Customer’s instruction and configuration.

12. Data Deletion Upon Termination

Upon termination of service, Customer Data will be deleted according to configured retention settings, and the operational and derived records described in Section 2.4 are deleted or de-identified on the same basis — subject to any records we are required to retain by law. Remaining data and residual backups are securely purged according to internal schedules.

13. Confidentiality

Customer Data is treated as confidential and accessed only to maintain or operate the Service by authorized personnel bound by confidentiality obligations.

14. Compliance with Laws

Clarrif is designed to support compliance with India’s Digital Personal Data Protection Act (DPDP), applicable healthcare data regulations, and general global privacy standards where applicable. Customers remain responsible for their own regulatory compliance.

15. Updates to This Policy

We may update this Privacy Policy periodically. Updated versions will be posted with a revised effective date. Continued use of the Service constitutes acceptance of updates.

15A. Third-Party Links and Limitations

Our website or dashboards may link to third-party sites or services that we do not control; their privacy practices are governed by their own policies, and we are not responsible for them. Except where prohibited by applicable law, this Policy is subject to the disclaimers and limitations of liability set out in the Terms of Service.

16. Contact and Grievance Officer

For privacy-related inquiries, contact support@clarrif.com. Grievances or questions about the processing of personal data may be directed to Clarrif's Grievance Officer, Sindhu Rai (Director), at admin@clarrif.com, who will acknowledge and respond within the timelines required by the DPDP Act.

17. Governing Language

If translated, the English version shall prevail in case of inconsistencies.

Last Updated: 3 Sep 2026