Privacy Policy

1. Two roles

• Clinic teams and website visitors. For your account, your use of the service, and anything you send us (such as a revenue audit request), we decide how the data is used. Under India’s Digital Personal Data Protection Act, 2023 we act as the data fiduciary for this data.
• Patients and enquirers. When a clinic records an enquiry in Clinora Intelligence, the clinic decides what is collected and why. The clinic is the data fiduciary (controller); we process that data only on the clinic’s behalf and instructions, as its data processor. Questions or requests about an enquiry should go to the clinic first; we will help the clinic answer them.

2. What we handle

• Account data: name, work email, role, the clinic you belong to, and a password stored only as a one-way hash (or sign-in links sent to your email).
• Enquiry and commercial data entered by clinics: an enquirer’s name, phone number, email if given, the service they asked about, where the enquiry came from (source and campaign), messages exchanged, calls logged, tasks, appointments, visit outcomes and revenue amounts the clinic records.
• No medical records. The service is built for the commercial journey, not clinical care. Forms ask staff not to enter diagnoses, prescriptions or clinical notes. Clinics remain responsible for what their staff type in.
• Technical data: sign-in sessions, an activity and audit log of changes inside a workspace, and IP addresses used briefly to prevent abuse (rate limiting records are deleted within a day).
• Revenue audit requests: the name, clinic, contact details and notes you submit on the audit form.

3. Why we use it

• To provide the service to the clinic: capture enquiries, assign them, measure response times, book appointments and report.
• To keep it secure: authentication, permissions, abuse prevention and audit logs.
• To support customers and arrange revenue audits you ask for.
• To send service email: sign-in links, password resets, invitations and notifications.

We do not sell personal data, use it for advertising, or train AI models on clinics’ data.

4. Optional AI features

AI is off by default. If a clinic switches it on, enquiry text and summary figures may be sent to an AI model provider through our AI gateway to suggest intent and write the morning brief. Outputs are advisory, never medical advice, and rules-based features work without AI.

5. Service providers

We use these providers to run the service. Each only receives what it needs.

• Vercel (application hosting; servers run in Singapore) and Neon (database, Singapore region).
• Resend (sending service email).
• Meta (WhatsApp Business messages and Facebook lead ads), only when a clinic connects its own Meta accounts. Meta processes those messages under its own terms with the clinic.
• An AI model provider through Vercel’s AI gateway, only if a clinic switches AI on.

Some providers may process data outside India. Where they do, we rely on their contractual and security commitments.

6. How long we keep it

• Workspace data: for as long as the clinic’s subscription is active.
• After a subscription ends: the clinic can export its data for 30 days; we then delete the workspace. Encrypted backups containing it expire within a further 30 days.
• Demo workspaces (fictional data): deleted automatically after 24 hours.
• Revenue audit requests: up to 12 months, unless you ask us to delete them sooner.

7. Security

Data is encrypted in transit. Each clinic’s data is separated in the database itself, so one clinic cannot read another’s. Access inside a clinic follows roles (owner, manager, receptionist, viewer). Integration credentials are encrypted at rest. Changes are recorded in an audit log. No system is perfectly secure; if a breach affects your data we will notify the clinic and, where required, the authorities without undue delay.

8. Cookies

We use only the cookies needed to keep you signed in and remember which clinic you are working in. We do not use advertising or analytics cookies.

9. Your rights

You can ask to access, correct or delete your personal data, or withdraw consent you have given. Clinic team members can reset their password from the sign-in page and ask their clinic owner or us to correct other details. Enquirers should contact the clinic that holds their enquiry; clinics can correct or delete an enquiry directly. For anything else, write to hello@clinora.example.

Grievance officer: hello@clinora.example. If you are not satisfied with our response, you may complain to the Data Protection Board of India or your local data protection authority.

10. Children

The service is for clinic businesses and is not directed at children.

11. Changes

We will post updates here and tell clinic owners by email before material changes take effect.

12. Contact

Clinora Intelligence, hello@clinora.example