Klaro Health Privacy Policy

Last updated: 12 July 2026

Klaro Health by Klaro Ventures Philippines Inc. (“Klaro Health,” “we,” “our,” or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of personal data entrusted to us. This Privacy Policy explains how we collect, use, share, and safeguard information when you use Klaro Health’s website, forthcoming mobile application, and related online and offline services (the “Platform”). By using the Platform, you acknowledge that you have read and understood this Policy.

1) Scope and Definitions

Scope. This Policy applies to all personal data we process in connection with the Platform, including information handled by our Registered Medical Technologists (RMTs) and field collectors, operations staff, and contracted service providers.

Personal Data. Information that identifies you or can reasonably identify you (e.g., name, contact details, and health information linked to you).

Sensitive Personal Information (SPI). For purposes of this Policy and under the Data Privacy Act, SPI (including health information such as laboratory results and related medical data) is treated as sensitive when it is linked to an identified or identifiable person. Health-related data that has been de-identified such that an individual cannot reasonably be identified is treated as Non-Personal Data.

Non-Personal (De-identified) Data. Information that does not identify you and cannot reasonably be used to identify you (e.g., de-identified usage metrics or statistics).

This Policy is intended to comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its IRR, and applicable issuances of the National Privacy Commission (NPC), and is aligned with Klaro Health’s Privacy Management Manual.

2) Information We Collect

a) Personal Information

• Name, gender, date of birth, address, phone number, email, or other contact details

• Billing and payment information

• Details of the person placing the order (if different from the patient). If you order for another person (e.g., family member), you confirm you are authorized and have obtained their consent to share their information and receive results on their behalf.

b) Health and Medical Information

• Laboratory test orders or prescriptions uploaded through the Platform

• Health/screening information shared for service readiness and safety checks

• Test results and laboratory identifiers received from partner laboratories

• Other medical records you voluntarily provide to support continuity of care

c) Device, Usage, and Location Information

We may collect device type, operating system, browser, IP address, and general usage patterns. Location data (e.g., city-level or visit location recorded by RMTs) may be collected only where enabled on your device or captured operationally to support logistics and service accuracy.

d) Communications and Support

Records of communications with Klaro Health through calls, SMS, Viber, Messenger, Instagram, email, in-app/chat, or other digital channels, whether inbound or outbound.

3) How We Use Your Information

We process information to:

• Provide services you request (bookings, scheduling, pre-collection safety checks, home collection, delivery of specimens to partner labs, and secure release of results)

• Deliver results by email (and in-app once available) and support longitudinal health tracking

• Provide customer support and communicate service updates and important notices

• Improve quality and safety (operations, training, SOP adherence, logistics optimization)

• Personalize in-product content and recommendations. Where you have consented to Klaro-only marketing, personalization may inform the offers or updates you see. We will never share your personal health information with third parties for their marketing.

• Comply with legal, regulatory, and record-retention obligations

Marketing & Communications (Klaro-only, with consent). We send essential service messages (e.g., booking/results). We may also send Klaro-only promotional offers, newsletters, and product updates with your specific consent. You can withdraw consent or change channel preferences at any time via unsubscribe links, in-product settings, or by emailing privacy@klaro.ph. We do not share your personal health information with third parties for their marketing.

4) Lawful Bases for Processing

• Contract – to deliver the services you request (booking, collection, results, support)

• Legal Obligations – to comply with laws and regulatory requirements (e.g., DOH, bookkeeping, and NPC rules)

• Legitimate Interests – to keep services secure, prevent fraud, improve quality and user experience, and develop features (balanced against your rights)

• Consent – for Klaro-only promotional communications and for optional features that require sharing with a partner. You may withdraw consent at any time; withdrawal does not affect essential service messages.

• Legitimate Interests (advertising measurement) — for sharing limited, non-health interaction and transaction data with advertising platforms as described in Section 9A. You may object at any time by emailing privacy@klaro.ph, and we will exclude your data, without affecting your services.

5) Responsible Use of AI Technologies

Klaro Health may use AI tools to assist in generating general wellness insights or product features.

• We do not share your personal health information with external AI vendors for model training or for any purpose unrelated to delivering the requested functionality.

• Where AI is used, processing occurs on Klaro-managed systems or contracted providers’ controlled environments under appropriate safeguards. When feasible, we remove personal identifiers or apply equivalent protections.

• AI-generated outputs are educational and wellness-oriented and do not replace professional medical advice, diagnosis, or treatment.

6) Data Sharing

We share personal data only when necessary to deliver your requested services or as required by law, including with:

• DOH-licensed partner laboratories that perform testing and issue official reports

• Registered Medical Technologists and field collectors for safe, accurate collection and logistics

• Payment processors and technology providers supporting secure operations

• Government authorities when legally required

• Advertising and analytics platforms (currently Google LLC and Meta Platforms, Inc.) — limited, non-health measurement data only, as described in Section 9A

We do not sell personal data. Partner laboratories act as independent data controllers for the laboratory records they generate. Their name appears on your test report.

Non-Personal (De-identified) Data. We may use and share de-identified data to maintain service quality, improve operations and features, develop analytics and health insights, and support research, provided such data cannot reasonably be used to identify you.

7) Minors & Guardians

If you book for a minor, you confirm you are the parent/legal guardian (or otherwise authorized) and consent to the processing of the minor’s information and receipt of results on their behalf. We may request proof of authority where appropriate.

8) Your Responsibilities

Please provide accurate, complete information and keep it up to date. Inaccurate or incomplete information may affect our ability to deliver services safely and on time.

9) Analytics and Product Improvement

We analyze personal data and de-identified data to maintain service quality and reliability; improve logistics, workflows, and user experience; enhance safety and training; and develop new features and health insights. Personal data used for these purposes remains protected under this Policy. Where feasible, we use de-identified data.

9A) Advertising Measurement and Analytics Partners

To understand whether our advertising works and to manage our marketing spend responsibly, we use measurement tools from advertising platforms, currently Google (Google LLC) and Meta (Meta Platforms, Inc.).

What we share. When you interact with our website or complete a booking, we may share the following with these platforms: the type of interaction (for example, a page visit, a booking started, or a completed purchase); the transaction value and currency; technical identifiers (such as cookies, device and browser information, and advertising click identifiers); and, where applicable, your hashed email address or hashed phone number. Hashing is a one-way process that converts these details into an irreversible code before they leave our systems; the platforms use them solely to match the transaction to records they already hold and cannot read them as your actual contact details.

What we never share. We do not share the names of tests or packages you purchase, your laboratory results, any uploaded lab request or prescription, or any other health information with advertising platforms. Advertising measurement data is limited to the fact and value of a transaction — never its medical content. This is consistent with our commitment in Section 3 never to share your personal health information with third parties for their marketing.

Purposes. Measuring advertising effectiveness, attributing bookings to campaigns, and preventing fraud.

Lawful basis. We rely on our legitimate interests in measuring and managing our advertising. Because this data contains no health information, it is not sensitive personal information. You may object to this processing at any time (see “Your choice” below).

Transfers. These platforms process data under their own terms and may do so on servers outside the Philippines. We apply safeguards consistent with the Data Privacy Act and Section 16 of this Policy for such transfers.

Your choice. You may opt out of advertising measurement at any time by emailing privacy@klaro.ph, and we will exclude your data from it. Adjusting your browser’s cookie settings limits browser-based tracking but does not by itself prevent measurement of bookings you complete. Opting out has no effect on our services or on the care you receive — only on how we measure advertising.

10) Data Retention

We retain personal data only as long as reasonably necessary to:

• provide services and support your longitudinal health tracking, or

• meet legal, regulatory, and record-retention requirements.

Partner laboratories may retain data under their own policies and applicable medical regulations. You may request deletion of your Klaro Health account (subject to legal limits and laboratory obligations). Requests to delete lab-held data must be directed to the laboratory of record.

11) Your Rights

Subject to the Data Privacy Act and applicable rules, you have the right to:

• Be informed about processing of your personal data

• Access your personal data

• Rectify inaccuracies

• Object to processing or request erasure/blocking (within legal limitations)

• Data portability where applicable

• Damages for violations of your rights under the DPA

• File a complaint with the National Privacy Commission

To exercise your rights, email privacy@klaro.ph. We aim to respond within five (5) business days. You may opt out of Klaro-only promotional communications at any time via unsubscribe links, in-product settings, or by emailing us. Essential service messages will continue. You may also opt out of advertising measurement at any time by emailing privacy@klaro.ph, and we will exclude your data from it.

12) Security

We implement organizational, physical, and technical safeguards appropriate to the nature of data processed and the risks involved. While we take reasonable precautions, no system is completely secure and online use carries inherent risk. We continually review and enhance our safeguards as the Company grows and technologies evolve.

13) Partner Laboratories

All testing is performed by licensed laboratories that comply with medical and data-protection rules and may retain data subject to their own policies and applicable regulations. Klaro Health processes the diagnostic reports it receives from partner laboratories for secure delivery to you and for your longitudinal health tracking. Klaro does not alter laboratory data.

14) Enterprise Technology Platforms

Klaro Health uses reputable enterprise-grade platforms (e.g., Google Workspace, Shopify, and similar providers). These providers generally do not enter into customized bilateral agreements with individual customers. Accordingly, Klaro Health relies on:

1. Standard contractual terms and data-protection commitments published by these providers;
   
   

2. Internationally recognized security practices (e.g., ISO/IEC 27001, SOC 2, GDPR-aligned commitments, or equivalent);
   
   

3. Built-in technical and security controls available in these services; and
   
   

4. Publicly available documentation and compliance statements evidencing adherence to global standards.
   
   

Use of these platforms is permissible under the Data Privacy Act provided that Klaro Health: (i) reviews the providers’ publicly available privacy/security documentation; (ii) ensures processing aligns with declared purposes; (iii) implements internal access controls; and (iv) evaluates provider compliance posture as part of privacy risk management.

15) Cookies and Similar Technologies

We use cookies and similar technologies in three categories: (a) essential cookies required to operate the Platform (cart, checkout, security), which are always active; (b) analytics cookies that help us understand usage and improve the Platform; and (c) advertising measurement identifiers described in Section 9A. Categories (b) and (c) never carry health information. You can opt out of advertising measurement at any time by emailing privacy@klaro.ph, and we will exclude your data from it. Adjusting your browser’s cookie settings limits browser-based tracking (including analytics) but does not by itself prevent measurement of bookings you complete. This does not affect your ability to use the Platform or the services you receive.

16) International Processing and Transfers

Your information may be stored or processed on secure systems inside or outside the Philippines. When we transfer personal data across borders, we apply safeguards consistent with Philippine data-privacy requirements and this Policy.

17) Policy Updates

We may update this Policy to reflect legal, technical, or operational changes. Continued use of the Platform after an update constitutes acceptance of the revised Policy. The “Last updated” date above reflects the most recent version.

18) Contact Us

Daniel Vaverka - Data Protection Officer

Klaro Ventures Philippines Inc. (Klaro Health)

121, 3rd Floor, Corinthian Plaza, Paseo de Roxas, Legazpi Village, Makati City 1223

Email: privacy@klaro.ph

If you believe your privacy has been violated, please contact us. You may also file a complaint with the National Privacy Commission in accordance with applicable procedures.