Globuli App
English (United States) 🇺🇸

Privacy Policy: Globuli & Schüßler Ratgeber (United States)

2026-10-01

1. Data Controller

Clesk Digital GmbH Am Biehl 5, 57234 Wilnsdorf, Germany Managing Directors: Enzo Frenker-Hackfort, Tobias Kajetan Roesner Commercial Register: HRB 13012 (Amtsgericht Siegen) VAT ID: DE351357159

Email: info@clesk.de Phone: +49 (0) 271 33885017

2. Overview

The app "Globuli & Schüßler Ratgeber" (also published as "Globuli App" and "Globuli Ratgeber", App ID: de.clesk.globuli, hereinafter "App") is a homeopathic remedy finder for iOS and Android. The App works without registration or login. Most features are available offline. This privacy policy informs you about what data we collect, how we process it, and what rights you have under applicable US privacy laws.

3. What Data Do We Collect?

3.1 Automatically Collected Data

When you use the App, the following data is automatically collected:

Firebase Analytics (Google): We collect usage events such as screen views, searches, scanner actions, shop clicks and purchase attempts. Depending on the app version, these may include remedy identifiers or names, the length of search or symptom input, result counts, product, language and technical device information. Remedy identifiers and usage patterns may reveal health-related interests. App-instance and installation identifiers are pseudonymous. Storage for optional analytics follows your consent, which you can withdraw in Settings. Older app versions load the analytics service on startup; it may receive technical connection data and consent status before consent is given. Google derives an approximate location, such as country and city, from the IP address; the app does not use GPS for this.

Firebase Crashlytics (Google): Crash reports contain technical error and device information and installation identifiers. The app applies your saved analytics consent to collection. Changes to native collection may require an app restart. In older versions, technical data may already be processed before this setting takes effect.

Network Status: The App checks whether an internet connection is available to provide offline functionality. This information is not transmitted.

IP address and connection data: For online features, infrastructure providers receive IP addresses, timestamps and technical device or connection information for service delivery and abuse prevention. Technical logs may be retained. We do not promise exclusively temporary processing of all connection data.

3.2 Data Collected Through User Action

AI Symptom Analysis (Supporter): When you use the AI feature, your symptom description is transmitted to our server and forwarded to Mistral AI (Paris, France). Our app server runs in the EU. See Section 4 for details.

OCR Scanner (Supporter): Captured or selected images are sent for text recognition at your request. See Section 5 for processing and retention.

Error Reports: If you report an error through the App, your description is stored in our database (Google Cloud Firestore, EU) and forwarded to our team by email. This is voluntary. Legal basis: legitimate interest. The Firebase extension used to forward reports by email runs in the United States.

Disclaimer Acceptance: On first launch, you must accept a medical disclaimer. The timestamp of this acceptance is stored as an audit trail in our database. Legal basis: legitimate interest.

3.3 Data Stored Locally on Your Device

Settings and content stored locally include favorites, personal notes, onboarding status, launch counters and the offline database cache (refreshed after seven days). They remain until deletion or uninstallation; device backups follow your system settings. Home-cabinet data can be submitted with an AI search. Scanner results remain temporarily in session storage, and disclaimer acceptance is also recorded on the server as described above.

3.4 Supporter guest account

Starting with app version 1.0.22, the first request to a protected online feature creates a technical guest account with Firebase Authentication (Google), without a name, email address or password. The random user ID is linked to the RevenueCat subscription. It is a personal-data pseudonym used to securely provide purchased access and for the subscription management and reporting described in Section 7. It is not used for advertising tracking. Earlier app versions do not use this additional account link.

Firebase Authentication processes this ID, IP address and user agent in the United States. The ID and login data remain until account deletion. Google specifies a few weeks for Auth IP logs and up to 180 days to remove deleted Auth data from live systems and backups. The EU location of our database does not apply to Authentication. See Firebase privacy.

Guest account from version 1.0.22: Until account deletion; Auth IP logs for a few weeks and technical removal of deleted Auth data within up to 180 days according to Google.

From version 1.0.22, you can start deletion directly in Settings → Privacy → Delete guest account. The subscription ID is submitted to our subscription provider for deletion, then the guest account and its associated database records are deleted. The confirmation distinguishes account deletion from processing still in progress at the subscription provider. Favorites and notes on the device and separate analytics and error reports are outside this account-deletion control; use the contact procedure in Section 13 for other records. Legally required retention and technical backups may continue. An active store subscription continues until separately canceled with Apple or Google. Cancellation is not a prerequisite for deletion.

4. AI Information Search (Mistral AI)

Our AI search processes the current symptom description, any supplied conversation context and remedies from the home cabinet. This may include health data. Mistral AI SAS processes submitted text or scanner images through its API. We do not add Firebase or RevenueCat IDs to the Mistral prompt. Personal information you include in text or images is still transmitted; please avoid names and information identifying you or others.

Mistral identifies the EU as its default hosting location and describes possible transfers to subprocessors outside the EU. We therefore do not promise exclusively EU-based processing. Processing locations.

Mistral states that API inputs and outputs are generally stored to process the request and then for up to 30 days for abuse monitoring. Legal retention duties and the protection of legal claims may require longer storage. This policy does not promise immediate deletion after the response. See Mistral privacy.

Processing by Mistral is governed by its Data Processing Addendum. Its Commercial Terms also provide for use of inputs and outputs for model training depending on the product and agreed settings. The DPA alone does not establish a general training exclusion or zero-day retention.

Legal basis: consent. As symptom descriptions may qualify as health data under applicable health data laws, processing requires your explicit consent for health data.

Note: AI information do not replace medical advice, diagnosis, or treatment. For serious health concerns, please consult a doctor.

5. OCR Scanner (Mistral AI)

At your request, captured or selected images are sent to Mistral AI for text recognition.

Mistral states that API inputs and outputs are generally stored to process the request and then for up to 30 days for abuse monitoring. Legal retention duties and the protection of legal claims may require longer storage. This policy does not promise immediate deletion after the response. See Mistral privacy.

Legal basis: consent.

6. App Permissions

The App requests the following permissions, each only when the corresponding feature is used:

Camera (iOS and Android): To photograph remedy bottles for the scanner feature (Supporter). The permission is requested by the operating system and can be revoked at any time in your device settings.

Photo Library (iOS): To select an existing image for the scanner feature.

Internet Access (Android): For all online features of the App.

7. Payment Processing

Supporter subscriptions are processed by the Apple App Store or Google Play. The prices displayed by the store apply. We do not receive full payment-card or bank-account details.

RevenueCat (RevenueCat Inc., USA) processes pseudonymous app user IDs, purchase and transaction information, product, price, currency, subscription status and entitlements to verify, provide and restore purchases. Purchase history and identifiers are stored on servers and are also used for operational subscription and revenue reports. Restarting or uninstalling the app does not erase these records. Subscription delivery is based on contractual necessity; operational reporting serves our legitimate interest in running the service and checking billing. Additional usage and purchase measurement through Firebase Analytics is optional and requires consent.

RevenueCat processes data in the United States. Its Data Processing Addendum includes Standard Contractual Clauses and provisions for subprocessors and international transfers.

8. Affiliate Links

The App contains affiliate links to the following providers:

When you tap an affiliate link, you are redirected to the external shop. An affiliate tracking parameter is transmitted so we can receive a commission. The privacy policies of the respective provider apply on the destination site. Legal basis: legitimate interest.

9. Retention Periods

Subscription data: Stored by RevenueCat as needed for subscription management, restoration, billing checks or legal obligations. Deletion is available on request, not automatically at app restart. Technical default server logs: 30 days. Crashlytics: Google specifies 90 days. Mistral: API inputs and outputs generally up to 30 days for abuse monitoring, see Sections 4 and 5. Local content: Until deletion or uninstallation, and potentially in device backups. Error reports and consent records: For handling and necessary evidence, subject to valid deletion requests and legal obligations. Google Analytics: Event data is retained for 2 months and user data for 14 months. New user activity resets the user-data retention period. These periods apply to the corresponding detailed data; aggregated standard reports are not affected.

10. Security Measures

Transfers use HTTPS/TLS. Server-side validation, input limits and access checks protect online features; database access is restricted by security rules. Secret provider keys are held server-side in Secret Manager. Public SDK configuration keys are included in the app.

11. Cookies and Tracking

The app contains no ad-network advertisements and does not use purchase measurement for cross-app advertising profiles. With consent, Google Analytics may use identifiers and storage mechanisms including cookies in the webview. A promise of no cookies therefore does not apply to optional analytics. Necessary local storage supports settings and app functionality.

12. Recipients and Data Processors

Error-report emails are processed through the Firebase mail extension in us-central1 (USA). The EU database region does not cover this mail processing.

Service providers and their roles: Google (Analytics, Crashlytics, Firestore, Functions), Mistral AI (KI/AI, OCR), RevenueCat (Supporter).

Mistral states that API inputs and outputs are generally stored to process the request and then for up to 30 days for abuse monitoring. Legal retention duties and the protection of legal claims may require longer storage. This policy does not promise immediate deletion after the response. See Mistral privacy.

13. Your Rights

Under applicable US privacy laws, you have the following rights, among others: access, rectification, erasure, restriction of processing, data portability, and objection.

To exercise your rights, please contact: info@clesk.de

You also have the right to lodge a complaint with a data protection authority. The competent authority for United States is: California Attorney General (for CA residents) at oag.ca.gov; for other states, your state attorney general.

Withdrawal of Consent

You may withdraw any consent given at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

AI Information Search and Scanner: Stop using the relevant feature if you do not want to send further data. Contact info@clesk.de to withdraw consent and request deletion of data already sent. Stopping use does not automatically delete previously submitted data.

Additional Information for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Do Not Sell or Share My Personal Information

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. The App does not serve ads and does not pass user data to ad networks or data brokers.

Personal information is processed only for the purposes listed in this policy (providing the App, AI information, scanner, error reports, and: if you explicitly consent: Firebase Analytics for usage statistics). Analytics consent can be withdrawn at any time in the App settings.

Notice at Collection

At the point of collection (when you install the App or use any feature), we collect the categories of personal information described in Section 3 of this policy (device data, user input for AI features, OCR images, crash reports, pseudonymous analytics if consented to). We retain these categories only as long as needed for the purposes described.

How to Exercise Your Rights

To exercise any of the rights above, contact us at: info@clesk.de. We will verify your request by asking you to confirm the email address or device-identifier information you used in the App. We will respond within 45 days (extendable by another 45 days if necessary, with notice).

You may also designate an authorized agent to make a request on your behalf, subject to verification.

Shine the Light Law

California Civil Code § 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. As stated above, we do not disclose personal information for such purposes.

Request data or account deletion

You can request deletion of your app data without access to the app by emailing info@clesk.de. Specify the Globuli App and which data is involved. For a subscription, the store, product and purchase date help us locate it; do not send full payment details or health information. If necessary, we will agree on a proportionate way to verify the request. We normally respond within one month and explain justified extensions and legal retention requirements.

You can delete local favorites and notes in the app; use the contact above for other data. Legal retention duties and technical backups may continue. Deleting data does not cancel a store subscription; cancellation is handled separately by Apple or Google and is not a prerequisite for requesting deletion.

For guest accounts from version 1.0.22, deletion is also available in the Privacy section of the app settings; Section 3.4 explains the process and its limits.

14. Automated Decision-Making

The AI information in the App constitutes non-binding suggestions for homeopathic remedies. No automated decision-making within the meaning of applicable automated decision-making laws takes place that produces legal effects concerning you or similarly significantly affects you.

15. Use by Minors

The app is intended for adults aged 18 or over.

16. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed. The current version is always available in the App under Settings.

End of Privacy Policy

Other language / region:

Globuli & Schüßler Ratgeber — Clesk Digital GmbH