Privacy policy
This policy explains how [to be added: company name] handles personal data on the Clinama website and in the Clinama app. Last updated: October 25, 2026.
1. Who we are
Clinama is run by [to be added: company name], [to be added: company address]. Company or VAT number: [to be added: company or VAT number]. For anything about privacy, write to [to be added: privacy email].
2. Two kinds of data
Clinic data: the patients, appointments, treatment plans, prescriptions and payments a clinic records in Clinama belong to that clinic. The clinic decides how they are used (it is the controller); we process them only to provide the service, on the clinic's instructions, under a data processing agreement. Patients with questions about their records should contact their clinic.
Our own data: the accounts of clinic staff, the clinic's subscription and visits to our website. For these we are the controller, as described below.
3. What we collect
Staff accounts: name, email, password (stored only as a secure hash), role, language and sign-in times.
Clinic details: the clinic's name, address, contact details and settings.
Subscriptions: plan and payment status. Payments are handled by Paddle, our reseller and merchant of record; we never see card details.
Technical data: IP addresses, used briefly to protect sign-in against abuse. We keep no personal data in web addresses or logs.
4. Why we use it
To provide the service a clinic signs up for (contract); to keep it secure and prevent abuse (legitimate interest); to send service emails such as invitations, password resets and billing notices; and to meet legal duties such as tax records. We don't sell data and don't show ads.
5. Where it is stored
On servers in Europe, under European data protection rules. Each clinic's data is kept strictly separate from every other clinic's, and backups are encrypted.
6. Who we share it with
Only the service providers we need to run Clinama: our hosting provider ([to be added: hosting provider]), our email provider ([to be added: email provider]) for invitations and reminders, and Paddle for subscriptions and invoices. Each is bound by a data processing agreement.
7. How long we keep it
Clinic data stays as long as the clinic's workspace exists. Patient health records are kept as long as health-record laws require (by default 10 years after the last medical change) before they can be erased; other patient data can be erased sooner on request.
[to be added: what happens to the data after a clinic closes its workspace]
Billing records are kept as long as tax law requires.
8. Your rights
You can ask to see, correct, export or delete your personal data, or object to how we use it, by writing to [to be added: privacy email]. Patients should write to their clinic, which handles these requests in Clinama. You can also complain to your data protection authority.
9. Cookies
We only use cookies the service needs: one that keeps you signed in and one that remembers your language. No tracking or advertising cookies.
10. Changes
When this policy changes we update the date above, and we tell clinics by email about important changes.