Privacy Policy

Last updated: 20 June 2026

1. Introduction

CliniqPilot ("we", "our", or "us") operates the CliniqPilot clinic management platform accessible at app.cliniqpilot.com and the marketing website at cliniqpilot.com (collectively, the "Service"). We are committed to protecting the privacy and security of all personal and clinical data entrusted to us.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using CliniqPilot, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you register for CliniqPilot, we collect:

  • Full name and professional credentials
  • Email address and phone number
  • Clinic name, address, and specialty
  • Login credentials (passwords are stored using bcrypt hashing and are never stored in plain text)

2.2 Patient Data (Entered by Clinics)

Clinics using CliniqPilot enter patient information including:

  • Patient name, age, gender, and contact details
  • Medical history, treatment records, and clinical notes
  • Prescriptions, lab test results, and case documentation
  • Appointment history and billing records
  • Clinical photographs and media uploads

Important: CliniqPilot acts as a data processor for patient data. The clinic (our customer) is the data controller and is responsible for obtaining appropriate patient consent before entering data into CliniqPilot.

2.3 Usage Data

We automatically collect:

  • Browser type, operating system, and device information
  • Pages visited, features used, and time spent in the application
  • IP address and approximate location (country/city level only)
  • Error logs and performance metrics to improve the Service

2.4 Cookies

We use essential cookies for authentication (JWT tokens) and session management. We do not use third-party advertising or tracking cookies. Analytics cookies, if any, are anonymized and used solely to improve the Service.

3. How We Use Your Information

We use the collected information to:

  • Provide the Service: Manage clinic operations, patient records, appointments, billing, and prescriptions
  • Authentication & Security: Verify identity, prevent unauthorized access, and enforce role-based permissions
  • Communication: Send transactional emails (password resets, booking confirmations), product updates, and support responses
  • AI Features: Power the CliniqPilot copilot assistant for form filling, clinical suggestions, and data queries (when enabled by the clinic)
  • Improvement: Analyze usage patterns to improve features, fix bugs, and optimize performance
  • Billing: Process subscription payments and manage plan usage quotas

4. Data Storage & Security

  • Hosting: All data is hosted on servers in India
  • Encryption: Data is encrypted in transit (TLS/HTTPS) and sensitive fields are encrypted at rest
  • Access Control: Role-based access ensures team members only see data relevant to their role (Owner, Doctor, Receptionist)
  • Password Security: Passwords are hashed using bcrypt with a cost factor of 12
  • Authentication: JWT-based authentication with short-lived tokens (15-minute expiry)
  • Backups: Automated daily backups with secure, encrypted storage

5. Data Sharing

We do not sell, rent, or trade your data to third parties. We may share data only in these limited circumstances:

  • Service Providers: Trusted third-party services essential to operations (e.g., Resend for transactional emails, payment processors for billing). These providers are bound by data processing agreements.
  • AI Providers: When the copilot feature is enabled, anonymized prompts may be sent to AI providers (Groq, Google Gemini, or local Ollama) to generate responses. No patient-identifiable data is included in AI prompts.
  • Legal Requirements: If required by law, court order, or governmental regulation
  • Business Transfer: In the event of a merger, acquisition, or asset sale, with advance notice to affected users

6. Data Retention

  • Active Accounts: Data is retained as long as your account is active
  • Deleted Accounts: Upon account deletion, all associated data is permanently deleted within 30 days, except where retention is required by law
  • Soft-Deleted Records: Some records (e.g., patients, cases) use soft deletion and can be restored by the clinic within the retention period
  • Backups: Backup copies are automatically purged within 90 days of data deletion

7. Your Rights

You have the right to:

  • Access: Request a copy of all personal data we hold about you
  • Correction: Update or correct inaccurate information through the application or by contacting support
  • Deletion: Request deletion of your account and all associated data
  • Data Export: Export your data (patients, treatment catalogs, prescriptions) via the Export Center available in all subscription plans
  • Withdraw Consent: Disable optional features like AI copilot at any time
  • Complaint: Lodge a complaint with the relevant data protection authority

8. Children's Privacy

CliniqPilot is designed for use by healthcare professionals. We do not knowingly collect personal data from individuals under 18 years of age. Patient records for minors are entered and managed by the clinic under appropriate parental/guardian consent obtained by the clinic.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any external sites you visit.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify registered users via email and update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: