Patient mail stays on your desk.
Klar filters spam inside Apple Mail, on your own Mac. The extension that reads your inbox has no network permission, so classification sends no patient correspondence to a vendor.
The address alone can be the diagnosis.
Patient correspondence can contain special category data. The GDPR defines data concerning health as data revealing someone's health status (art. 4(15)), art. 9(1) prohibits processing it except on specific grounds, and art. 9(3) turns one of those grounds on the person handling it being bound by professional secrecy. Not every message in a practice inbox is health data: the invoices and the rota are not. But the patient subset is, and it is the subset a filter cannot tell apart before it reads it.
Headers are not a safe middle ground either. The GDPR treats data revealing health status as health data, and a sender and recipient pair between a named person and an oncology practice reveals it whether or not anyone opened the body. That is why where the filter runs matters more here than almost anywhere else.
GDPR art. 9: special categories of personal dataNobody outside the practice reads it.
Klar is a Mail extension. It scores each message on your Mac as it arrives without uploading it. There is no filtering provider to bind to secrecy, and no copy of a patient's message waiting on a filtering server.
The part of Klar that reads your mail is an Apple-sandboxed Mail extension shipped without the network entitlement. It is not that we promise not to send your mail anywhere. It is that macOS refuses the connection, because the permission was never requested. Classification happens on your Mac, instantly.
What that means in practice
- No network access
- The free App Store app and its Mail extension ship without the network entitlement. macOS refuses any connection they try to open. This is a permission the app does not hold, not a policy it promises to follow.
- The model ships with the app
- The classifier is a multilingual transformer inside the app bundle. Nothing is fetched when a message arrives, so it works the same on a train as it does in the office.
- No account
- There is nothing to sign up for and no licence server the free app calls. Unless you contact us or choose to send an Email report, we do not know who you are.
- The engine is open source
- The scoring engine is AGPLv3. Your IT people do not have to take our word for any of this. They can read it, build it, and watch what it does.
Questions your compliance officer will ask
Do you need HDS certification?
No, and the reason is worth being precise about rather than just asserting. France's HDS scheme certifies hosting health data on someone else's behalf, and French law puts the duty on you to check that a provider you entrust with patient data holds the certificate (art. R1111-8-8 CSP). The free app cannot send a message anywhere, so there is nothing of yours on our servers to certify and nothing for you to check. A cloud filter that stores or quarantines mail is a different question, because that does keep your patients' correspondence on a vendor's servers.
Our records system is already hosted. Does this still change anything?
Yes, though it is a narrower claim than it may sound. Klar only decides where spam filtering happens. If your records live in a hosted system, that is its own arrangement with its own contracts, and a spam filter does not touch it. What changes is that your inbox stops being a second, quieter copy of patient correspondence sitting on a filtering vendor's servers.
Does filtering send anything off the machine?
No. The free App Store app and its Mail extension have no network permission. If you choose Email report, Klar opens an editable draft in your own mail app; nothing leaves until you send it. Do not include confidential correspondence unless you are authorised to share it. Klar Plus, the paid companion you install yourself, separately uses the network for its licence, model and version checks. None carries your mail. The full list is on the local-first page.
Do we need a data processing agreement with you?
That is a question for your own counsel, and it depends on which part of Klar you run. Routine filtering sends us nothing. A user who sends an Email report may share selected messages, diagnostics and a removable monthly usage summary; our privacy policy explains what we then hold. Decide whether staff may use that report action with confidential correspondence.
What we are not claiming.
We are not offering legal advice, and a spam filter does not make anyone compliant. Your obligations are yours, and your bar, your regulator or your DPO is the right place to test them. What we can tell you is exactly where the software runs and what it is permitted to do, which is the part most vendors leave you to infer.
We are also not claiming perfect filtering. No filter is, and any vendor quoting you a single accuracy number is quoting a number from their corpus, not your inbox. What we will say is that being wrong about a message on your Mac and being wrong about it on someone else's server are not the same kind of wrong.
Read the whole local-first argumentTry it on the inbox you cannot risk.
macOS 14 or later, Apple Silicon. No account, no cloud classification, no setup. It filters inside Apple Mail on your Mac.
