Data Processing Agreement

This agreement covers the information a clinic and its staff enter into ClinicFlow AI while using the service, and the information the service records about that use.

It applies alongside the Terms of Service and the Privacy Policy. Where this document and the Privacy Policy describe the same control, they are intended to say the same thing.

ClinicFlow AI is outpatient clinic management software: patient registration, visit and consultation-fee billing, procedure ordering and collection, payments and receipts, staff shift settlement, and the daily and periodic reports that follow from them.

The clinic decides which patients to register, what patient information to record, which staff have accounts, and what those staff may do.

Entered by the clinic about its patients:

• name, patient number, age, sex and mobile number
• address, city and pincode where the clinic records them
• visits, tokens and the doctor each visit is recorded against
• procedures ordered, performed and collected for
• payment amounts, modes, receipt numbers and any reference the clinic enters
• refund requests, approvals and payouts

Clinical consultation records, such as complaints, history, diagnoses and prescriptions, are not part of the current ClinicFlow release and are not processed by it. If a future module records them, this agreement will be updated before that module is made available.

About the clinic and its people:

• clinic name, print name and uploaded logo
• staff and doctor names, roles, email addresses and mobile numbers
• passwords, stored only as salted hashes and never in readable form
• the clinic’s subscription, plan and capacity usage
• account and system emails sent to users, such as sign-up verification codes

Recorded by the service about its own use:

• an audit record of significant administrative and financial actions, naming who did what and when
• staff shift records, such as opening cash, counted cash and settlements
• the secure backup files and readable exports a Clinic Admin downloads
• sign-in sessions and rate-limiting counters
• support sessions where ClinicFlow AI staff access a clinic at its request

ClinicFlow AI does not store card numbers or bank credentials. Where a card payment is recorded, only the last four digits are kept, and only because the clinic enters them onto its own receipt.

The people whose information is processed are the clinic’s patients, and the clinic’s own Clinic Admin, doctors and staff.

Information is processed to provide the service the clinic has asked for: running the clinic’s workflow, producing its documents and reports, operating and securing the accounts, and supporting the clinic when it asks for help.

ClinicFlow AI does not sell information, does not use patient information to advertise, and does not use one clinic’s information to build a product for another.

The clinic is responsible for what it collects and records, for the lawfulness of that collection, for informing its own patients, for who it gives accounts to, and for the roles it assigns them.

The clinic is responsible for information after it leaves the service — an export, a printed receipt or a downloaded report is the clinic’s to protect.

ClinicFlow AI processes the clinic’s information to provide the service and on the clinic’s instructions, applies the controls described in this document, and does not use the information for unrelated purposes.

Access to a clinic’s information is limited to the people who need it to run or support the service, and is recorded where it happens.

ClinicFlow AI support staff do not have standing access to a clinic’s patient records. Support access is a distinct, time-bound session, and actions taken during one are written to the clinic’s audit record.

The permission model treats a support account as its own role rather than as a clinic user, so what support may see is decided separately from what a clinic’s own staff may see.

The controls implemented in the application are:

• each clinic’s information is scoped to that clinic in the data layer, so one clinic’s records are not reachable from another clinic’s account
• role-based permissions, checked on the server rather than in the browser
• passwords stored using salted password hashing, never in readable form
• sign-in sessions using cookies that page scripts cannot read and that are marked secure in production
• rate limiting on sign-in, sign-up and other sensitive actions
• audit records for significant actions, which the database does not permit to be edited or deleted
• server-side validation of submitted data
• checks on the actual bytes of an uploaded clinic logo before it is stored
• integration credentials, such as the email mailbox password, encrypted before they are stored
• secure ClinicFlow backup files, encrypted before download
• backup and restore tooling that verifies a restored copy rather than assuming it

This agreement does not claim encryption of stored data or of server-level backup copies, a hosting region, a backup schedule, or any security certification or standard. Those depend on the deployment and on formal assessment rather than on the application alone, and ClinicFlow AI does not state them until they have been verified.

ClinicFlow secure backup files (.cfbackup) are encrypted before download.

Readable exports are provided separately, for portability. They are designed to be read, and are not the encrypted secure backup.

Server-level infrastructure backups are managed separately from ClinicFlow. This agreement does not state how they are stored or protected, and ClinicFlow AI does not claim to have verified it.

ClinicFlow AI uses third-party infrastructure and transactional email service providers to operate the service. Where a provider processes personal information on ClinicFlow AI’s behalf, that provider is treated as a subprocessor for the purposes of this agreement. Current providers are disclosed in this section and in the Privacy Policy.

The current provider for server hosting and for transactional email is Hostinger. This agreement does not state a hosting jurisdiction and makes no data-residency claim about it.

ClinicFlow AI does not send clinic or patient information to an analytics provider, an advertising network, or an artificial-intelligence provider.

If a further subprocessor is engaged in future, this section will name it and say what it handles, and the clinic will be able to see the change here.

ClinicFlow AI keeps an audit record of significant administrative and financial actions, which is the record an investigation would begin from. That record cannot be edited or deleted once written.

A formal incident-response and notification procedure has not yet been published. Until it is, this agreement does not state a notification period, and the clinic should not assume one.

Where a patient asks the clinic for information the clinic holds about them, the clinic can see and export that information from within the product without contacting ClinicFlow AI.

For anything the product does not cover, the clinic can reach ClinicFlow AI through the contact page.

A clinic can correct its staff and doctor records, procedure list and its own clinic details using the screens on which they were entered.

A patient’s registration details — such as name, sex, age and mobile number — can be corrected by the Clinic Admin from the patient’s record. A reason is required, and the old and new values are recorded in the audit trail. A Front Desk User cannot make this correction.

A correction changes the patient’s record from that point on. A receipt or other document that was already issued keeps the details it showed on the day, so the history remains readable rather than being rewritten.

A clinic may also ask ClinicFlow AI to make a correction through a privacy request. Such a request is recorded, the person asking is verified, and the change is made only against that verified request.

Records that exist to be evidence are deliberately not editable: a payment and an audit entry cannot be altered after the fact. A correction to money is recorded as a further entry, so the history remains readable rather than being overwritten.

ClinicFlow AI does not currently provide a self-service way to delete a clinic’s account and its records, and the service does not delete them automatically.

A Clinic Admin can ask for the clinic’s account to be closed. That is a request that ClinicFlow AI reviews; it deletes nothing by itself. ClinicFlow AI also reviews, record by record, whether a deletion would be allowed — for example where a legal hold applies or a record must be kept — and records the result. A request to close an account does not refund a payment.

A deletion process, including what happens to financial records that must be retained and to backup copies, has not yet been decided. Until it is, a clinic that wants its information removed should contact ClinicFlow AI, and this section will be updated when the process is settled.

Information entered by a clinic is retained while the clinic uses the service. When a trial or a paid subscription is no longer active, existing records remain available and new clinic activity is paused until the plan is restored; backups and exports remain available according to the current permissions, and the information is not deleted.

ClinicFlow AI has not yet set a retention period for information after an account stops being used. No period is stated here because none has been decided, and stating one that is not operated would be worse than saying so.

A clinic can export its information from inside the product as spreadsheet (CSV) files, and a Clinic Admin can download readable exports and secure backup files, without asking ClinicFlow AI and without a fee. A Clinic Admin can also export the clinic’s data as a single package from Settings → Data & backup; the package states what it contains and what it leaves out.

The export covers the operational and financial reports and the patient register. Once exported, the file is the clinic’s to protect.

On termination, the clinic should export anything it needs. Access ends according to the Terms of Service and the Cancellation & Refunds policy.

What happens to the information after termination depends on the retention and deletion decisions described in sections 15 and 16, which are not yet settled.

ClinicFlow AI will provide a clinic with information reasonably needed to understand how its data is handled, so far as doing so does not expose another clinic’s information or compromise the security of the service.

The controls listed in section 10 are properties of the software and can be demonstrated. Matters that depend on the deployment are not certified here.

ClinicFlow AI does not publish a hosting region, and this agreement makes no commitment about where information is stored or whether it crosses a border. That will be stated only once it can be evidenced.

This agreement carries a version date. When it changes, the version date changes with it, and the current version is the one published on this page.

Questions about this agreement, or a request concerning a clinic’s data, can be submitted through the ClinicFlow AI contact page.