Privacy policy
This policy explains what information Clinicly collects, why, and how it is protected. Clinicly is software that clinics use to manage appointments, patient records and WhatsApp messages.
Who this policy covers
Clinics that sign up for Clinicly (owners, doctors and staff), patients who book or are booked through a clinic using Clinicly, and visitors to clinicly.site.
Clinics are in charge of their patients' data
When a clinic adds a patient or a patient books through a clinic's page, that clinic decides what is recorded and why. Clinicly stores and processes that data on the clinic's behalf, only to provide the service. We do not sell patient data, use it for advertising, or contact a clinic's patients for our own purposes.
What we collect
- Clinic account details: clinic name, address, timings, staff names, email addresses, phone numbers and an encrypted password.
- Patient details entered by the clinic or the patient: name, mobile number, and optionally email, gender, date of birth, visit notes, medical notes, follow-up dates and appointment history.
- Messages: a log of WhatsApp messages sent through Clinicly (type, time and delivery status) and one-time login codes, which are stored only as a secure hash and expire after 5 minutes.
- Website enquiries: details you type into the audit form are sent to us on WhatsApp; the website itself does not store them.
- Basic technical data: sign-in sessions, failed sign-in attempts (to block password guessing) and standard server logs.
How we use it
To run the service: show appointments and records, send booking confirmations, reminders and review requests the clinic has turned on, let patients sign in with a WhatsApp code, keep accounts secure, provide support, and bill clinics on paid plans.
Messages are sent through the official WhatsApp Business Platform operated by Meta. Message content and the patient's number pass through Meta to be delivered. Patients can ask the clinic to stop WhatsApp updates at any time, and clinics can switch reminders and review requests off.
Where data is stored
Data is stored with our hosting providers: the database on Supabase and the application on Netlify, with servers in the United States, and the website on Cloudflare. These providers process data under their own security and confidentiality commitments. Connections are encrypted, and database access is restricted to the application.
Security
Passwords are stored as one-way hashes. Each clinic can only see its own data. Staff sign-ins lock after repeated failed attempts. No system is perfectly secure, so clinics should keep their passwords private and deactivate staff who leave.
How long we keep data
While a clinic's account is active. When a clinic closes its account, we delete its data within 30 days, unless the law requires us to keep something longer. Clinics can ask for an export of their patient list before leaving. Login codes and failed-login records are deleted automatically within days.
Your rights
Patients who want to see, correct or delete their information should contact their clinic first, since the clinic controls the record; we will help the clinic do it. Clinics and visitors can write to us at contact@clinicly.site to access, correct or delete their own information, or to withdraw consent.
Grievance officer
For any concern about how your information is handled, contact our Grievance Officer at contact@clinicly.site or +91-7678310831. We will acknowledge within 2 working days and aim to resolve within 30 days.
Changes
If we change this policy in a way that matters, we will tell clinics by email or in the app before it takes effect.