Privacy Policy

1. Our role: controller vs. processor

For account and website data (your name, email, role, and how you use ClinicAI), we act as the data controller. For the patient and clinical information a clinic enters into ClinicAI, the clinic is the controller and ClinicAI acts as a processor, handling that data only on the clinic’s behalf and under its instructions. Each clinic is responsible for having a lawful basis and any required patient consent for the information it stores in ClinicAI.

2. Information we collect

• Account & clinic data — name, email address, phone, role (owner, clinician, nurse, receptionist), clinic name, and profile details you provide when registering or being invited.
• Clinical & patient data (on the clinic’s behalf) — patient records, appointments, notes, prescriptions, labs, imaging references, invoices, and similar information entered by clinic staff.
• Usage & device data — log data, IP address, device and browser type, and app interactions, used to operate and secure the service.
• Billing data — where a paid subscription applies, billing contact details and payment status (card processing is handled by our payment provider; we do not store full card numbers).

3. How we use information

• Provide, operate, and maintain the ClinicAI service and your account.
• Authenticate users and keep accounts and data secure.
• Power features you request, including AI decision-support tools.
• Provide customer support and respond to your requests.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

4. AI features

When clinic staff use ClinicAI’s AI features, relevant chart context is sent to our AI model provider to generate summaries, draft notes, and surface changes. This is clinician decision support, not autonomous diagnosis, and the treating clinician remains responsible for reviewing and verifying any output before acting on it. AI processing happens to deliver the feature the clinic requested; we do not use patient data to train third-party public models.

5. How we share information

We do not sell personal information. We share it only:

• With service providers (subprocessors) who help us run ClinicAI — cloud hosting, database, email delivery, and the AI model provider — bound by confidentiality and data-protection obligations.
• With the clinic you belong to (administrators can see activity and data within their clinic).
• When required by law, legal process, or to protect rights and safety.
• In connection with a merger, acquisition, or asset sale, with continued protection of your information.

6. Data retention

We retain account and clinical data for as long as the account is active or as needed to provide the service. When a clinic or user requests deletion, we delete or anonymize the associated data, except where we must retain it to meet legal, accounting, or security obligations. See Account & data deletion for how to request removal.

7. Security

We protect data with encryption in transit and at rest, access controls, least-privilege permissions, and secure authentication. No method of transmission or storage is 100% secure, but we work to protect your information and to notify affected parties of incidents where required by law.

8. Your rights & choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can manage your profile in the app’s account settings, or contact us using the details below. Requests about patient data are routed to the clinic that controls it.

9. International processing

ClinicAI operates in the MENA region and beyond. Your information may be processed in the countries where we and our subprocessors maintain infrastructure, with appropriate safeguards applied to any cross-border transfers.

10. Children

ClinicAI is a professional tool for clinic staff and is not directed to children. Where a clinic records information about minor patients, it does so as the controller and is responsible for complying with applicable law and obtaining any required consent.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated as appropriate.

12. Contact us

Questions or requests about privacy? Email [email protected] or [email protected].