Clex Privacy Policy (archived 2026-08-11 version)

Archived version. This is the privacy policy that applied from 11 August 2026 until 18 August 2026. It is kept for reference and is no longer in force. The current policy is at clex.ai/en/legal/privacy-policy/.

Effective date: 11 August 2026

This policy covers the Clex products and services listed in section 2, including this website. Details specific to website visits (access logs, the contact form) are also described in the website privacy policy. The previous version of this policy is archived here.

1. Who We Are

This Privacy Policy is issued by Clex A/S, a Danish corporation (CVR 37750840) with registered address at Ewaldsgade 9, 1., 2200 Copenhagen N, Denmark.

Clex develops language-technology writing support for the care sector. This policy describes how we handle information when you use our products and services.

2. Scope

This policy covers all Clex products and the Clex website:

The products are designed for professional care workers who document care activities within their organization’s electronic health record (EHR/EOJ) systems.

Each product has its own, more detailed privacy policy, describing it field by field: Privacy Policy, Clex Keyboard for Android, Privacy Policy, Clex Keyboard for iOS, and Privacy Policy, Clex Web. Where this policy and a platform policy describe that platform’s behaviour differently, the platform policy is the accurate one.

3. Our Approach to Privacy

Clex products are built on a local-first, privacy-by-design architecture:

• The free text you write stays on your device or in your browser. It is not sent to Clex, and we cannot read it.
• Word prediction, sentence suggestions, sentence correction, translation, and read-aloud all run locally, using language models stored on the device or in the browser.
• What does leave the device is a licence check, a daily count of feature use, and requests for model files. Section 4 lists each of them.
• No keystrokes are logged, monitored, or transmitted at any point.

About the keyboard access warning. When you enable Clex Keyboard on Android or iOS, your operating system displays a standard warning that the keyboard may be able to collect everything you type, including passwords and credit card numbers. This warning is shown for all third-party keyboards and is not specific to Clex. We want to be clear: Clex Keyboard does not collect, store, or transmit any text you type. All text processing happens locally on your device. No keystrokes, passwords, or typed content ever leave your device through Clex.

4. What Data Is Processed

4.1 Licensing and Activation

A license token is sent to the Clex licensing service when the product is activated or periodically validated. The token is used only for authorization and does not contain personal data about end users.

4.2 Usage Measurements

To keep the products reliable and to know which features are used, each app and browser extension sends one report per day of use. A report contains: the calendar day it describes, the app version shortened to its first two numbers, the interface language (Danish, Swedish, English or German; every other language is reported as “none”), three fixed labels naming the report format, the product and the platform, a random report number used only so a repeated upload is not counted twice, and a set of counters, each recording how many times a feature was used or failed that day.

A report never contains what you typed, which app or website you were writing in, any time of day, any character count, or any identifier for you, your device, or your installation. When a report arrives, its numbers are added into a running daily total for your organisation and the report itself is not stored. Response times are reported as counts within fixed ranges, never as individual measurements.

The platform policies describe the reports field by field. On Clex Keyboard for Android, the measurements can be switched off in the app’s settings; the Android policy describes the switch.

4.3 Model and Language Downloads

The language models that make on-device processing possible are downloaded from Clex-managed servers, on first use of a language or feature and when models are updated. These requests carry no account, no licence, and no identifier. As with any download, the server that delivers the file can see your IP address.

4.4 Local Features (No User Text Transmitted)

The following features run locally on your device or in your browser. No user text is sent to Clex or any third party for these features:

• Word prediction – runs locally on all platforms.
• Sentence suggestions and sentence correction – run locally on all platforms, using language models stored on the device or in the browser.
• Translation – runs locally on all platforms. Language resources are downloaded once on first use and cached on the device.
• Read-aloud – runs locally on all platforms using offline speech engines.

No user text is included in any download or network request related to these features.

4.5 Clex Website (clex.ai)

The Clex website is designed with the same privacy-first approach as our products:

• One cookie, strictly necessary. The website sets a single first-party cookie that stores your language preference, as described in the cookie policy. No consent banner is shown because strictly necessary cookies require none, and there are no other cookies.
• No tracking or analytics. The website does not use Google Analytics, Facebook Pixel, or any other tracking or analytics service. No visitor behavior is recorded or profiled.
• No external scripts. All JavaScript is self-hosted. No third-party scripts are loaded in your browser.
• No external fonts. All fonts are self-hosted. No requests are made to Google Fonts or other external font services.
• No local storage. The website does not use browser localStorage or sessionStorage.

Contact form. The website includes a voluntary contact form. When you submit the form, the information you provide (name, email, company, and message) is delivered by email to the relevant Clex market contact and used only to respond to your inquiry. This data is not used for marketing, profiling, or any other purpose. The bot check (proof-of-work) runs in your browser and sets no cookies. Contact form data is subject to the legal basis described in section 6.

5. What We Do Not Collect

We do not collect or store:

• Text you type into EHR/EOJ systems or any other application
• The name of the app or website you are writing in
• Keystrokes, keystroke timing, or input patterns
• Personal data such as names, addresses, phone numbers, or health records of any individual
• Voice recordings, photographs, or other user-generated media
• Information from the EHR/EOJ systems where text is entered
• Device contacts, call logs, or browsing history
• Individual-level usage events or crash stack traces
• Any identifier for you, your device, or your installation

6. Legal Basis (GDPR Article 6)

Clex A/S is the data controller for the limited data described in section 4 (license validation, daily usage measurements, model and language downloads, and contact form submissions). The deploying organization (municipality, care provider, or employer) remains the data controller for any personal data that care workers enter into EHR/EOJ systems. We never receive those records: the free text stays on the device or in the browser, and the writing features run there. What we do process is our own organisation-level usage totals, which carry no identifier for any person, and for which Clex is the controller. A data processing agreement (DPA) between the organization and Clex is therefore generally not required. If the organization determines that supplementary documentation is needed, Clex can support that assessment.

Because Clex products are designed to avoid processing personal data on the server side, the scope of data processing that requires a legal basis is limited:

You may object to the processing of your contact-form data and ask us to delete it at any time by contacting us.

Clex does not carry out any automated decision-making or profiling as defined in Article 22 of the GDPR. Our products propose draft sentences and corrections, generated on the device, and the care worker reads and decides whether to use each one. No automated decisions are made about individuals, and no personal profiles are created.

7. Data Sharing and Sub-processors

We do not sell, rent, or trade personal data. The following providers are involved in delivering the service:

No other third-party services receive data from Clex products or the Clex website in normal operation. On-device components process data locally and do not transmit data to any external party.

8. Infrastructure and Data Residency

All Clex-managed server-side processing takes place on dedicated servers hosted by Hetzner Online GmbH in Germany.

Key points:

• All production data processing occurs within the EU.
• No data is transferred to servers outside the EU for processing.
• Edge traffic is routed only through European edge locations, and visitor IP addresses are anonymised at the edge before any access logs are written.
• The architecture is designed to minimize external service dependencies and to maintain EU-only data residency for all server-side operations.

9. Data Security

All communications between Clex products and Clex-managed servers are encrypted in transit. Server infrastructure is protected using industry-standard security controls.

While we apply commercially reasonable security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we design our systems to minimize the data that is exposed in the first place.

10. Data Retention

• Usage totals carry no identifier for any person and are deleted automatically 24 months after the day they describe, and sooner if the organisation asks or its contract ends. Individual reports are never retained: a report’s numbers are added into the organisation’s total on arrival, and the report itself is not stored.
• License validation records are retained for the duration of the customer contract.
• Contact form submissions are retained for as long as needed to respond to and follow up on the inquiry, after which they are deleted.
• Free text from product usage is never held on Clex servers, because it is never sent there.

11. Your Rights Under the GDPR

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access personal data we hold about you
• Rectify inaccurate personal data
• Erase personal data (“right to be forgotten”)
• Restrict processing of your personal data
• Port your personal data to another controller
• Object to processing based on legitimate interest

What we hold on the server side is aggregate usage totals that carry no identifier for any person, so there is no record we can search for you and no share of it we can separate out as yours. That is a consequence of how the systems are built, not a refusal. If you object to the usage measurements, we act on it at the level where the data exists: your organisation can ask us to erase every total belonging to it, and we do that on request. If you have questions about any data we handle, please contact us.

You also have the right to lodge a complaint with your supervisory authority:

12. Children’s Privacy

Clex products are designed for use by professional care workers in an organizational context. They are not intended for use by children. We do not knowingly collect information from children under the age of 16.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this document and post the revised version on our website. Superseded versions remain available: the version effective 4 August 2026 is archived here. We encourage you to review this policy periodically.

14. Contact

If you have any questions about this Privacy Policy or how we handle data, please contact us: