Last updated 19 September 2026. Controller: Matthias Buchhorn. Contact: the repository issue tracker at github.com/ma3u/MinimumViableHealthDataspacev2.
Klarbefund reads your paper laboratory reports and keeps the values on your phone. Nothing is sent anywhere unless you choose, per question, to have a value explained, and you are shown exactly which values would leave before anything does.
| Data | Where it is kept | Leaves the device? |
|---|---|---|
| The scanned pages of your reports, as a PDF | On the device, encrypted (AES-GCM), so a value can be checked against the original | Only inside a diagnostics archive you build and send yourself |
| Extracted values, units, reference ranges, the dates and details printed on the report, and the recognised text | On the device, each record individually encrypted (AES-GCM) | Only the values you select, only when you ask a question; or inside a diagnostics archive you build and send yourself |
| The encryption key | iOS Keychain, marked so it is unavailable while the device is locked and is never restored onto another device | Never |
The store is excluded from iCloud Backup. Health data is not written to iCloud and is not written to Apple Health.
Laboratory values are data concerning health, a special category under Art. 9 GDPR. Processing on your device happens because you chose to scan the report. Sending values for an explanation happens only on your explicit consent, given for each individual request, under Art. 9(2)(a).
You pick the values, you see them listed, and you confirm. Only those values travel, together with your question. Your name, date of birth and insurance number are never sent. They may be printed on the scanned page, which stays on the device and is never sent either.
To improve how reports are read, you can export a diagnostics archive from the app's menu. It contains your scanned pages, every value and the recognised text, unencrypted, and it goes only where you send it, through the system share sheet. Nothing is exported unless you choose to, and the app asks you to confirm in words each time. The archive is deleted from the phone once shared.
| Provider | Who pays | Where processed | How it is reached |
|---|---|---|---|
| This iPhone (default) | Nobody | On the device | No network is used at all |
| Klarbefund service (optional) | The app provider | Azure OpenAI, EU data zone | Via the provider's service, which sees the selected values |
| Your own Azure OpenAI (optional) | You | The region of your own resource | Directly from your phone. The app provider never sees the values or your key |
| Your own Anthropic key (optional) | You | United States | Directly from your phone. The app provider never sees the values or your key |
The default asks nothing of anyone: the model on the device answers, so no request leaves the phone and no account is needed. Where you choose a request that does go through the app provider's service, the provider is a processor and the model vendor a sub-processor. Neither uses your values to train models. Choosing a provider that processes in the United States is an international transfer, and the app names the destination at the moment you choose it.
Signing in is required only for the Klarbefund service, and only so that the daily limit of 20 analyses can be counted per person. The counter stores a one-way hash of your account identifier and a number. It does not store your name or email.
The default costs the app provider nothing and is not metered, so it asks for no sign-in. Neither does your own provider: there is nothing to meter when you are the one paying.
The service logs the number of values in a request and their LOINC codes, so faults can be diagnosed. It does not log the measured values, your question, or the answer.
Values are read from a photograph by optical character recognition and can be misread. They are marked preliminary until you check them against the paper. Reference ranges are shown exactly as your laboratory printed them and are never replaced with ranges from elsewhere.
Klarbefund does not diagnose, does not assess risk and does not recommend treatment. It explains what a measurement is. It is not a medical device and it is not a substitute for your doctor. Always consult a qualified healthcare professional before making any decision about your health.
Because the data lives on your device, you exercise most rights directly: delete a report in the app and it is gone. For anything held by the service, the daily counter, contact the address above. You have the rights of access, rectification, erasure, restriction, portability and objection under Arts. 15 to 21 GDPR, and the right to complain to a supervisory authority.
Reports stay until you delete them or delete the app. The daily counter holds a hash and a number per day and is not needed beyond the day it counts.
Klarbefund is not directed at children and is intended for adults managing their own laboratory results.