This policy explains what ClinyPal LLC, a New Mexico limited liability company ("ClinyPal", "we"), does with personal data.
Who is responsible
- If you are a patient of a clinic that uses ClinyPal, your clinic decides what is recorded about you and why; it is the controller, and we process your data on its behalf. Ask your clinic first about your records, including access, correction or deletion. We will help it answer you.
- If you run or work at a clinic, or you visit our website, we are the controller of your account and website data.
For patient health information, ClinyPal acts as each clinic's business associate under HIPAA and signs a Business Associate Agreement with it on request. See our HIPAA & BAA page.
Contact: [email protected], ClinyPal LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA.
What we collect and why
| Data | Whose | Why |
|---|---|---|
| Name, email, phone, clinic details, role | Clinic owners and staff | To create and run the account |
| Password (stored only as a hash), sign-in codes, authenticator and passkey records, trusted devices | Clinic staff | To keep accounts secure |
| Billing contact and card details (held by Stripe) | Clinic owners | To charge the subscription |
| Support chats and emails | Clinic staff | To answer questions |
| Patient records the clinic enters, including health data | Patients | To provide the service to the clinic |
| Details entered when booking online or paying by link | Patients | To book or pay as asked |
| IP address, browser, pages and errors | Everyone using the service | Security, fixing faults, preventing abuse |
| Pages viewed on clinypal.com, approximate location, device and browser (Google Analytics) | Visitors to our website (not the app) | To see which pages help people and improve the site, only if you accept analytics cookies |
We don't sell personal data or use it for advertising.
AI features
Some features send text to an AI model run by our sub-processor Cloudflare. AI runs inside these features only: drafting form, note and message templates and broadcast wording; suggested filters, short observations and explanations of figures on reports; the summary on the dashboard; and the help chat. The model sees only the text the feature needs, never invents or changes figures in reports, and is not trained on what it is sent.
Text messages
Clinics can text their patients through ClinyPal, but only patients who agreed to receive texts; see our SMS Terms. Mobile numbers and text message consent are used only to send those texts. We never sell them, and we never share them with third parties or affiliates for their marketing or promotional purposes.
Who we share data with
- The companies on our sub-processor list, each bound to protect the data.
- Services a clinic connects itself (for example its accounting or calendar app), only while it keeps them connected.
- Google, for Google Analytics on our website only, and only if you accept analytics cookies. Nothing from inside the ClinyPal app goes to Google Analytics.
- Authorities, when the law requires it.
Where data is kept
All clinic and patient data is stored in the United States. Because it is held in the US, it may be accessed by US authorities under US law. It is protected by encryption and by contracts with each of our sub-processors.
Clinics in Canada are served from the United States. For their patients' data, ClinyPal acts on the clinic's behalf under its agreement with the clinic.
How long we keep it
| Data | Kept for |
|---|---|
| A clinic's account and patient records | While the account is open. After a closure request, until the end of the paid period and at least 30 days; after a subscription lapses, 60 days. Then deleted. |
| Deleted data in backups | Up to 180 days, until those backups expire |
| Email sending records | 180 days |
| Message history (emails and texts sent to patients) | 2 years |
| Payment link requests | 90 days |
| Our invoices and billing records | As long as tax and accounting law requires |
A clinic may have to keep health records longer under its own professional rules; that is the clinic's decision.
How we protect it
Encryption in transit and at rest for files and backups, each clinic's data kept separate, two-step sign-in, role-based access, audit logs, regular tested backups, and monitoring. Our staff open a clinic's account only to help with that clinic's request.
Your rights
Patients should ask their clinic first about their records; we will help the clinic answer. Clinic owners and staff can ask us for access to, correction of or deletion of their account data at [email protected].
Website visitors can ask us for access to, or deletion of, the analytics data from their visits by writing to [email protected], and can withdraw analytics consent at any time with the Cookie settings link at the bottom of every page. Messages sent through our website contact form are delivered by Brevo. We answer within one month.
Cookies
Inside the ClinyPal app we use only cookies the service needs: keeping you signed in, remembering a trusted device if you choose "Remember this device", and protecting forms against abuse (Cloudflare Turnstile). Our public website also uses Google Analytics cookies, but only after you accept them in the cookie banner. No advertising cookies anywhere. Details are in our Cookie Policy.
Changes
We will post changes here and email clinic owners about important ones before they take effect.
Questions about this page? Email [email protected], or see every way to contact us.