This Privacy Policy applies to CareClinic Software Inc. and all its subsidiaries, affiliates, platforms, websites, and mobile applications (collectively “CareClinic,” “we,” “our,” or “us”). It explains how we collect, use, disclose, and protect personal information obtained through our products and services. By using any CareClinic platform, you agree to this policy and consent to the processing of your information as described.
Scope
This policy covers all CareClinic-operated digital products, websites, and services. It does not apply to third-party sites, platforms, or services that may link to or integrate with CareClinic, which are governed by their own privacy policies.
What is Personal Information
Personal information is data that can identify an individual directly or indirectly, such as name, email address, home address, IP address, or health-related data linked to an identifiable person. Aggregated or de-identified data that cannot be used to identify an individual is not personal information.
How We Collect Information
We collect personal information in several ways:
- When you create or manage an account
- When you input data into our applications
- When you communicate with our support or clinical partners
- When you make a purchase or manage a subscription
- When you consent to optional analytics or feedback tools
We also collect limited technical data automatically, such as device type, IP address, and browser version, to maintain service integrity and security.
Legal Basis for Processing
CareClinic processes data under lawful grounds that may include:
- Consent provided by the user
- Contractual necessity to deliver services
- Legitimate interests such as analytics, product improvement, and research for public health or wellness
- Compliance with applicable laws and regulatory requirements
- Public interest or research activities permitted under privacy legislation
For users in the European Economic Area and the United Kingdom, we process personal information under Article 6(1)(a) (consent), Article 6(1)(b) (performance of a contract), and, for health data, Article 9(2)(a) (explicit consent). You may withdraw consent at any time by disabling consent prompts in the app, using Delete All Data in Settings, or contacting privacy@careclinic.io.
Children’s Privacy
The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. Parents or guardians with questions may contact privacy@careclinic.io.
Security and Encryption
We use administrative, physical, and technical safeguards to protect personal information. Data in transit is encrypted using TLS 1.2 or higher and data at rest is encrypted using AES-256. Keys are managed and rotated securely. Access is restricted to authorized personnel using multifactor authentication and audit logging. Systems are hosted on secure cloud infrastructure with continuous monitoring and periodic penetration testing.
Quality and Performance Assurance
CareClinic platforms undergo verification and validation to confirm accuracy, reliability, and performance across supported devices. We maintain continuous uptime monitoring with a target greater than 99 percent and perform regression and functionality testing before each release. Issues are tracked in a formal ticketing system and addressed through a documented bug fix cycle.
Vendor and Third-Party Processors
We work with trusted vendors for hosting, analytics, communications, and technical support. These partners act as processors under our instruction and are contractually bound to maintain confidentiality and comply with relevant laws. They may not use personal information for independent purposes.
Cookies, Analytics, and Tracking
CareClinic uses cookies and analytics tools to support essential site functions, improve usability, and measure engagement. These tools may collect anonymous usage information such as IP address and device type. You can manage cookies in your browser settings. Disabling cookies may affect functionality. CareClinic does not use personal data for behavioral advertising or AI model training. For details on how AI-assisted features handle user data, see the AI-Assisted Features section above. Automated decision-making is not performed using identifiable health data.
AI-Assisted Features
CareClinic may offer optional features that use artificial intelligence to help users organize, structure, or extract information from their health entries, such as scanning insurance cards, medication labels, or nutritional labels.
Where AI processing is performed on-device, such as optical character recognition using Apple’s native Vision framework for insurance card scanning, no data leaves the user’s device.
Where AI processing requires server-side support, CareClinic transmits only the minimum data necessary to perform the requested action. This data is sent over encrypted connections (TLS 1.2 or higher) to CareClinic’s secure servers. Server-side AI processing is performed using open-source AI models deployed within CareClinic’s own cloud infrastructure. No user data is sent to a third-party AI provider for these features.
For certain image recognition features, CareClinic currently uses Google Cloud Vision API to process user-captured images of medication or nutritional labels. Google acts as a data processor and is contractually prohibited from retaining, training on, selling, or repurposing any user data. Google receives only the image data necessary to complete the specific task. This integration is being migrated to CareClinic’s own infrastructure, after which no AI feature will involve a third-party provider.
Before any AI-powered feature that transmits data externally is used, CareClinic informs the user within the app and requests consent. Users may decline and continue using CareClinic without AI-assisted features.
CareClinic does not use personal health data to train AI models, and no AI service provider engaged by CareClinic is permitted to do so.
Optional Connected AI Services (MCP)
CareClinic’s built-in AI-assisted features described above are separate from an optional connection you may choose to make to an approved third-party AI service through the Model Context Protocol (MCP). CareClinic does not activate this connection automatically. You review the requested permissions and choose whether to connect.
For an action you request, CareClinic shares only the information covered by the permissions you approve. Depending on those permissions and the action, this may include account and Premium status, symptom or mood entries, medication or supplement names, doses, schedules, completion status, and selected health or wellness summaries. Normal MCP reads exclude notes and unnecessary internal record identifiers. Any supported write is shown for review and requires a separate confirmation before CareClinic saves it.
The connected AI service is independent from CareClinic and may process or retain information it receives under its own privacy policy. CareClinic does not sell health information or use it for advertising or AI model training. Review the connected service’s privacy policy before approving a connection.
You may deny the connection, disconnect it, or revoke its OAuth access later. Revoking a connection stops future MCP access but does not delete information that a connected AI service may already retain under its own policy. CareClinic remains the system of record for your CareClinic account and health information.
To operate and protect this connection, CareClinic stores bounded MCP operational usage records in Cloudflare D1. CareClinic associates a numeric CareClinic account ID with the records where a user is authenticated; some connection events are not account-linked. Only authorized administrators can access these records. We use them to measure adoption and provider or client usage, measure failures and rate limits, measure Premium checks, locks, and insights, and investigate abuse.
The operational fields include a timestamp; an account ID where authenticated; provider or client kind; fixed event or tool name; operation class; success or failure; HTTP response class; rate-limited flag; server-derived Premium state and action; mode; and Worker version.
The D1 usage record does not store prompts, tool arguments or tool results, health values or notes, symptom names or medication names, email addresses, IP addresses, OAuth tokens, session cookies, or payment details.
Usage-event rows have no time-based automatic expiry. Identity-linked rows are deleted after CareClinic account deletion through a signed lifecycle callback and scheduled reconciliation. A hashed deletion-suppression tombstone expires after 90 days. The 90-day expiry applies only to that tombstone and does not apply to usage events.
Datadog receives only identifier-free operational issue events and is not the usage record.
Aggregated and De-Identified Data
CareClinic may combine or transform collected information into aggregated or de-identified formats that do not identify individual users. This information may be used to monitor platform performance, enhance product safety and usability, generate statistical summaries, or support health-related analytics and reporting. Such insights are created and used in compliance with applicable privacy and data protection laws and cannot be traced back to any person.
Platform and Integrations
CareClinic services may integrate with third-party platforms such as Apple Health, Google Fit, or similar APIs to enable secure data synchronization, backup, and functionality improvements. Any data exchanged through these integrations occurs only after user authorization and follows the privacy controls of the respective platform.
Transactional data such as purchase confirmations or entitlement verification may be shared with Apple or Google solely to complete billing, refund, or subscription management processes. Health or identifiable personal data is not shared for these purposes.
When permissions are granted, CareClinic may access limited data through connected APIs to display insights or generate reports for user benefit. This access is read-only unless otherwise stated at the time of authorization and data is processed in accordance with this policy and the relevant platform terms.
CareClinic complies with the Apple App Store, Google Play, and Google API Services User Data Policy, including restrictions on advertising, AI model training, and data resale. Users can revoke integration access at any time from their device settings or platform account.
CareClinic Tracker for Chrome
CareClinic Tracker for Chrome is an optional browser extension for signed-in CareClinic users. It displays scheduled medications, supports medication and symptom check-ins, provides optional desktop reminders, and calculates a descriptive seven-day summary. Before the extension reads health information, it explains the data flow and requires the user to select Log In and grant Chrome access limited to https://start.careclinic.io/*. Sign-in happens on the CareClinic website. The extension does not ask for, read, or store passwords or cookie values.
Chrome extension data
The extension may process CareClinic session and Premium status; symptom names, identifiers, severity, and notes; medication and supplement names, doses, reminder times, and completion status; recent CareClinic logs; reminder preferences; bounded local error scope, name, and code; and whether Chrome returned to active use after being idle.
Health information is read from or written to CareClinic only to provide the features the user requests. Health updates are sent only when the user selects Save check-in or Mark taken. Protected medication-schedule reads may run while CareClinic access is enabled so local reminders remain current.
Sharing
The Share CareClinic action sends only the public Chrome Web Store URL and placement-specific campaign parameters through the browser’s native share interface or copies that URL to the clipboard. It does not add health data, CareClinic account identifiers, medication or symptom names, or notes to the shared URL.
Extension storage and permissions
- CareClinic site access: Optional and limited to start.careclinic.io. It is requested after the first-run disclosure.
- Session storage: The health dashboard snapshot remains in Chrome session storage and is cleared when Chrome restarts, the extension reloads, or the user disconnects.
- Sync storage: Reminder preferences may sync through the user’s Chrome profile.
- Local storage: Per-install consent and a bounded error record containing time, scope, name, and code remain local. Error messages, health values, symptom or medication names, notes, browsing history, and CareClinic account identifiers are not stored in that error record.
- Alarms and notifications: Alarms support schedule refresh and optional reminders. A snooze or bounded restart-recovery alarm may temporarily contain an encoded occurrence identifier and expected due timestamp. It does not contain a medication name, dose, note, or account identifier. Notification permission is requested only when the user enables desktop reminders. Medication names are hidden by default.
- Idle state: The extension detects a return to active use to refresh stale reminder schedules. It does not read page content, browsing history, keystrokes, clicks, mouse movement, or scrolling.
Analytics and reliability
The extension does not send analytics or reliability events to a third party. A bounded technical error record remains on the device and contains only time, scope, error name, and error code. It excludes error messages, health values, symptom or medication names, notes, browsing history, and CareClinic account identifiers.
Chrome Web Store Limited Use
The use and transfer of information received from Google APIs by CareClinic Tracker for Chrome adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Information is used only to provide or improve the extension’s disclosed CareClinic features and related security and support operations. It is not sold or transferred for advertising, unrelated profiling, or lending decisions.
Extension choices
Users may deny CareClinic site access, leave reminders disabled, hide medication names, sign out of CareClinic, or select Disconnect and remove access. Disconnect clears the health snapshot, medication, snooze, recovery, and sync alarms, login-tab state, consent, badge, and optional site and notification permissions. Reminder preferences and bounded local error metadata remain until the extension is uninstalled. CareClinic account deletion and privacy requests remain available through the controls and contact methods described in this policy.
Clinical Health Records (Apple Health)
CareClinic allows users to optionally import clinical records from Apple Health using the Clinical Health Records APIs. This may include laboratory results, medications, allergies, immunizations, diagnoses, procedures, and encounter information supplied by participating healthcare institutions. Access to these records occurs only when a user explicitly initiates import and grants permission.
Imported clinical health records are used solely for the user’s personal health tracking, care coordination, and self-management within the CareClinic app. To enable cross-device synchronization and backup, imported clinical records are securely transmitted to CareClinic’s servers using TLS 1.2+ encryption and stored with AES-256 encryption at rest. They may be used to update the user’s profile, populate trackers, generate insights, or prepare summaries for real-world medical appointments. CareClinic does not use clinical health records data for advertising, marketing or intervention.
Users may revoke access to Apple Health at any time from their device settings. Individual imported records (medications, conditions, allergies, immunizations, lab results, procedures, and genetic tests) can be deleted directly within the app. Users may also request full account deletion, which removes all clinical data from active systems and backups. All clinical health records data is encrypted in transit and at rest and stored with the same technical and organizational safeguards applied to sensitive health information throughout the platform.
Global Privacy Rights
CareClinic upholds global data rights (including those under GDPR, HIPAA, and PIPEDA). Users may:
- Access their data and obtain a copy
- Request correction or deletion
- Withdraw consent at any time
- Request portability of their data
- Object to processing under legitimate interest
Requests can be submitted to support@careclinic.io. All requests are verified, logged, and fulfilled within 30 days unless extended by law.
Data Processing and Account Deletion
You may delete your account at any time through User Settings or by contacting support@careclinic.io. Once deleted, your data is removed from active systems and securely deleted from backups after a short retention period for disaster recovery verification.
Data Retention
We retain data only as long as needed to provide services, meet regulatory or contractual obligations, or ensure system integrity. Aggregated data used for statistical or research purposes may be stored without identifying information. When retention is no longer required, data is securely erased or anonymized. Upon account deletion, clinical data is removed from active systems immediately and purged from
encrypted backups within 30 days.
International Data Transfers
Your data may be processed or stored in Canada, the United States, or other jurisdictions where CareClinic or its service providers operate. These regions may have different data protection laws than your country of residence. To ensure a consistent level of protection, CareClinic implements legal and technical safeguards including Standard Contractual Clauses (SCCs), regional adequacy determinations, and compliance with cross-border frameworks recognized by the OECD and EU.
Transfers are reviewed annually to verify that service providers meet security and privacy expectations equivalent to Canadian, European, and U.S. standards. All cross-border vendors must adhere to encryption, restricted access, and breach notification procedures defined in our Data Protection Agreement. Sensitive health information is never transferred to any third party unless contractually obligated under these conditions.
Where applicable, we maintain data processing agreements and records of all international transfers. Each processor’s location, function, and access level are reviewed during vendor onboarding and reassessed periodically. Users may contact privacy@careclinic.io for a summary of our current data transfer mechanisms.
Data Breach Notification
In the event of unauthorized access, loss, or disclosure of data, CareClinic initiates its Incident Response Plan immediately. This plan includes detection, containment, forensic investigation, and remediation steps. All incidents are logged and reviewed by our security team within 24 hours of discovery.
If a breach presents a material risk to user privacy, we will notify affected individuals and regulatory authorities as required by law, typically within 72 hours. Notifications include the nature of the incident, affected data categories, corrective measures taken, and recommended user actions. We also perform a post-incident review to prevent recurrence and update relevant security controls.
Post-Market Review and Incident Handling
CareClinic maintains a continuous monitoring program that reviews performance data, crash logs, analytics, and user feedback to detect usability or safety issues. Support tickets and incident reports are triaged, risk-rated, and tracked to resolution through our quality management system. Findings from these reviews inform updates, feature adjustments, and documentation improvements.
Quarterly audits are conducted to evaluate product stability, clinical accuracy of symptom tracking modules, and overall user safety. Corrective and preventive actions are documented, verified for effectiveness, and included in subsequent release cycles.
Accessibility and Usability
CareClinic products are designed to promote inclusive use by patients, caregivers, and healthcare professionals. User interfaces undergo iterative testing for readability, contrast, and accessibility across devices. All instructions and health labels are written in plain language, minimizing input errors and cognitive load. Design reviews align with recognized standards such as WCAG 2.1 and ISO 62366 for usability engineering in healthcare software.
Feedback from users with visual, motor, or cognitive challenges is incorporated into design improvements. Regular usability testing ensures that updates do not impair accessibility or comprehension.
Risk Management
CareClinic maintains an active risk management framework integrated with product development and release cycles. Risks are identified, classified, and tracked through a centralized risk register covering data protection, functionality, and user safety. Each identified risk includes mitigation measures, owners, and status.
The register is reviewed quarterly by product and compliance leads and updated following any significant software update or regulatory change. High-risk findings trigger immediate review and corrective action, ensuring continuous improvement and alignment with ISO 14971 risk management principles.
Privacy Governance
CareClinic Software Inc. serves as the data controller for all activities described in this policy. We maintain documented privacy management procedures, perform annual impact assessments, and train all staff handling sensitive data. Internal compliance audits validate that privacy and security controls remain effective.
CareClinic’s Privacy Officer oversees adherence to legal, technical, and ethical standards, ensuring alignment with GDPR, PIPEDA, HIPAA, and other regional laws. Policy revisions and updates are reviewed at least annually or whenever regulations or business practices change.
Privacy Inquiries and Complaints
Questions or complaints may be directed to our Privacy Officer at support@careclinic.io. Users may also contact their local data protection authority. For Ontario residents, contact the Information and Privacy Commissioner of Ontario at info@ipc.on.ca or 1-800-387-0073.
Last Modified: Sep 5, 2026