Privacy Policy: Globuli & Schüßler Ratgeber (India)

2026-10-01

1. Data Controller

Clesk Digital GmbH Am Biehl 5, 57234 Wilnsdorf, Germany Managing Directors: Enzo Frenker-Hackfort, Tobias Kajetan Roesner Commercial Register: HRB 13012 (Amtsgericht Siegen) VAT ID: DE351357159

Email: info@clesk.de Phone: +49 (0) 271 33885017

2. Overview

The app "Globuli & Schüßler Ratgeber" (also published as "Globuli App" and "Globuli Ratgeber", App ID: de.clesk.globuli, hereinafter "App") is a homeopathic remedy finder for iOS and Android. The App works without registration or login. Most features are available offline. This privacy policy informs you about what data we collect, how we process it, and your privacy rights. India’s Digital Personal Data Protection Act 2023 is being brought into force in stages. The provisions on processing, consent and data-subject rights are scheduled to take effect eighteen months after the notification of 13 November 2025; this policy does not describe them as already effective. Official commencement notification.

3. What Data Do We Collect?

3.1 Automatically Collected Data

When you use the App, the following data is automatically collected:

Firebase Analytics (Google): We collect usage events such as screen views, searches, scanner actions, shop clicks and purchase attempts. Depending on the app version, these may include remedy identifiers or names, the length of search or symptom input, result counts, product, language and technical device information. Remedy identifiers and usage patterns may reveal health-related interests. App-instance and installation identifiers are pseudonymous. Storage for optional analytics follows your consent, which you can withdraw in Settings. Older app versions load the analytics service on startup; it may receive technical connection data and consent status before consent is given. Google derives an approximate location, such as country and city, from the IP address; the app does not use GPS for this.

Firebase Crashlytics (Google): Crash reports contain technical error and device information and installation identifiers. The app applies your saved analytics consent to collection. Changes to native collection may require an app restart. In older versions, technical data may already be processed before this setting takes effect.

Network Status: The App checks whether an internet connection is available to provide offline functionality. This information is not transmitted.

IP address and connection data: For online features, infrastructure providers receive IP addresses, timestamps and technical device or connection information for service delivery and abuse prevention. Technical logs may be retained. We do not promise exclusively temporary processing of all connection data.

3.2 Data Collected Through User Action

AI Symptom Analysis (Supporter): When you use the AI feature, your symptom description is transmitted to our server and forwarded to Mistral AI (Paris, France). Our app server runs in the EU. See Section 4 for details.

OCR Scanner (Supporter): Captured or selected images are sent for text recognition at your request. See Section 5 for processing and retention.

Error Reports: If you report an error through the App, your description is stored in our database (Google Cloud Firestore, EU) and forwarded to our team by email. This is voluntary. The Firebase extension used to forward reports by email runs in the United States.

Disclaimer Acceptance: On first launch, you must accept a medical disclaimer. The timestamp of this acceptance is stored as an audit trail in our database.

3.3 Data Stored Locally on Your Device

Settings and content stored locally include favorites, personal notes, onboarding status, launch counters and the offline database cache (refreshed after seven days). They remain until deletion or uninstallation; device backups follow your system settings. Home-cabinet data can be submitted with an AI search. Scanner results remain temporarily in session storage, and disclaimer acceptance is also recorded on the server as described above.

3.4 Supporter guest account

Starting with app version 1.0.22, the first request to a protected online feature creates a technical guest account with Firebase Authentication (Google), without a name, email address or password. The random user ID is linked to the RevenueCat subscription. It is a personal-data pseudonym used to securely provide purchased access and for the subscription management and reporting described in Section 7. It is not used for advertising tracking. Earlier app versions do not use this additional account link.

Firebase Authentication processes this ID, IP address and user agent in the United States. The ID and login data remain until account deletion. Google specifies a few weeks for Auth IP logs and up to 180 days to remove deleted Auth data from live systems and backups. The EU location of our database does not apply to Authentication. See Firebase privacy.

Guest account from version 1.0.22: Until account deletion; Auth IP logs for a few weeks and technical removal of deleted Auth data within up to 180 days according to Google.

From version 1.0.22, you can start deletion directly in Settings → Privacy → Delete guest account. The subscription ID is submitted to our subscription provider for deletion, then the guest account and its associated database records are deleted. The confirmation distinguishes account deletion from processing still in progress at the subscription provider. Favorites and notes on the device and separate analytics and error reports are outside this account-deletion control; use the contact procedure in Section 13 for other records. Legally required retention and technical backups may continue. An active store subscription continues until separately canceled with Apple or Google. Cancellation is not a prerequisite for deletion.

4. AI Information Search (Mistral AI)

Our AI search processes the current symptom description, any supplied conversation context and remedies from the home cabinet. This may include health data. Mistral AI SAS processes submitted text or scanner images through its API. We do not add Firebase or RevenueCat IDs to the Mistral prompt. Personal information you include in text or images is still transmitted; please avoid names and information identifying you or others.

Mistral identifies the EU as its default hosting location and describes possible transfers to subprocessors outside the EU. We therefore do not promise exclusively EU-based processing. Processing locations.

Mistral states that API inputs and outputs are generally stored to process the request and then for up to 30 days for abuse monitoring. Legal retention duties and the protection of legal claims may require longer storage. This policy does not promise immediate deletion after the response. See Mistral privacy.

Processing by Mistral is governed by its Data Processing Addendum. Its Commercial Terms also provide for use of inputs and outputs for model training depending on the product and agreed settings. The DPA alone does not establish a general training exclusion or zero-day retention.

Consent: Symptom descriptions can contain health data. The feature asks for your explicit consent before transmission.

Note: AI information do not replace medical advice, diagnosis, or treatment. For serious health concerns, please consult a doctor.

5. OCR Scanner (Mistral AI)

At your request, captured or selected images are sent to Mistral AI for text recognition.

Consent: The feature asks for your consent before transmission.

6. App Permissions

The App requests the following permissions, each only when the corresponding feature is used:

Camera (iOS and Android): To photograph remedy bottles for the scanner feature (Supporter). The permission is requested by the operating system and can be revoked at any time in your device settings.

Photo Library (iOS): To select an existing image for the scanner feature.

Internet Access (Android): For all online features of the App.

7. Payment Processing

Supporter subscriptions are processed by the Apple App Store or Google Play. The prices displayed by the store apply. We do not receive full payment-card or bank-account details.

RevenueCat (RevenueCat Inc., USA) processes pseudonymous app user IDs, purchase and transaction information, product, price, currency, subscription status and entitlements to verify, provide and restore purchases. Purchase history and identifiers are stored on servers and are also used for operational subscription and revenue reports. Restarting or uninstalling the app does not erase these records. Subscription delivery is based on contractual necessity; operational reporting serves our legitimate interest in running the service and checking billing. Additional usage and purchase measurement through Firebase Analytics is optional and requires consent.

RevenueCat processes data in the United States. Its Data Processing Addendum includes Standard Contractual Clauses and provisions for subprocessors and international transfers.

8. Affiliate Links

The App contains affiliate links to the following providers:

Amazon (Amazon EU S.à r.l., Luxembourg) via Amazon PartnerNet (affiliate tag: clesk-21)
Shop-Apotheke and DocMorris via AWIN AG (Berlin, Germany)

When you tap an affiliate link, you are redirected to the external shop. An affiliate tracking parameter is transmitted so we can receive a commission. The privacy policies of the respective provider apply on the destination site.

9. Retention Periods

Subscription data: Stored by RevenueCat as needed for subscription management, restoration, billing checks or legal obligations. Deletion is available on request, not automatically at app restart. Technical default server logs: 30 days. Crashlytics: Google specifies 90 days. Mistral: API inputs and outputs generally up to 30 days for abuse monitoring, see Sections 4 and 5. Local content: Until deletion or uninstallation, and potentially in device backups. Error reports and consent records: For handling and necessary evidence, subject to valid deletion requests and legal obligations. Google Analytics: Event data is retained for 2 months and user data for 14 months. New user activity resets the user-data retention period. These periods apply to the corresponding detailed data; aggregated standard reports are not affected.

10. Security Measures

Transfers use HTTPS/TLS. Server-side validation, input limits and access checks protect online features; database access is restricted by security rules. Secret provider keys are held server-side in Secret Manager. Public SDK configuration keys are included in the app.

11. Cookies and Tracking

The app contains no ad-network advertisements and does not use purchase measurement for cross-app advertising profiles. With consent, Google Analytics may use identifiers and storage mechanisms including cookies in the webview. A promise of no cookies therefore does not apply to optional analytics. Necessary local storage supports settings and app functionality.

12. Recipients and Data Processors

Error-report emails are processed through the Firebase mail extension in us-central1 (USA). The EU database region does not cover this mail processing.

Service providers and their roles: Google (Analytics, Crashlytics, Firestore, Functions), Mistral AI (KI/AI, OCR), RevenueCat (Supporter).

13. Your Rights

You may contact us to exercise your rights under applicable data-protection law, including requests for access, correction and deletion of your personal data. Additional rights under the DPDP Act apply as the relevant provisions enter into force.

To exercise your rights, please contact: info@clesk.de

You also have the right to lodge a complaint with a data protection authority. The competent authority for India is: Data Protection Board of India, within its applicable statutory powers.

Withdrawal of Consent

You may withdraw any consent given at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

AI Information Search and Scanner: Stop using the relevant feature if you do not want to send further data. Contact info@clesk.de to withdraw consent and request deletion of data already sent. Stopping use does not automatically delete previously submitted data.

Request data or account deletion

You can request deletion of your app data without access to the app by emailing info@clesk.de. Specify the Globuli App and which data is involved. For a subscription, the store, product and purchase date help us locate it; do not send full payment details or health information. If necessary, we will agree on a proportionate way to verify the request. We normally respond within one month and explain justified extensions and legal retention requirements.

You can delete local favorites and notes in the app; use the contact above for other data. Legal retention duties and technical backups may continue. Deleting data does not cancel a store subscription; cancellation is handled separately by Apple or Google and is not a prerequisite for requesting deletion.

For guest accounts from version 1.0.22, deletion is also available in the Privacy section of the app settings; Section 3.4 explains the process and its limits.

14. Automated Decision-Making

The AI information in the App constitutes non-binding suggestions for homeopathic remedies. The App does not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

15. Use by Minors

The app is intended for adults aged 18 or over.

16. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed. The current version is always available in the App under Settings.

End of Privacy Policy

Other language / region: