Privacy Policy

1. Introduction

ClinicGuard Inc. (“we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use ClinicGuard (“the Service”).

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you register, or Google account details if you sign in with Google.
• Clinic Information: Clinic name, address, state, number of employees, and specialty type.
• Assessment Data: Your responses to HIPAA compliance assessment questions.
• Payment Information: Processed by Creem (our merchant of record). We do not store your credit card details directly.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns.
• Device Information: Browser type, operating system, device type, and IP address.
• Cookies: We use essential cookies for authentication and session management. See Section 7 for details.

2.3 Categories of Personal Information (CCPA / CPRA)

For California residents, the table below maps our collection to the categories defined in Cal. Civ. Code § 1798.140:

We do not collect: biometric data, precise geolocation, sensitive personal information as defined by CPRA, patient PHI, or information from minors under 18.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Generate compliance assessments, risk scores, and gap reports for your clinic.
• Auto-fill HIPAA document templates with your clinic profile information.
• Process payments and manage your subscription.
• Send you compliance deadline reminders and important service notifications.
• Respond to your inquiries and provide customer support.
• Analyze usage patterns to improve the Service.

4. Data Storage and Security

Your data is stored in Supabase-managed PostgreSQL databases with Row Level Security (RLS) policies ensuring that each user can only access their own clinic's data.

We implement the following security measures:

• Encryption in transit (TLS 1.2+) for all data transmissions.
• Encryption at rest (AES-256) for stored data.
• Row Level Security policies enforced at the database level on every query.
• Secure authentication via Supabase Auth with support for Google OAuth.
• Server-side API keys and secrets stored as encrypted environment variables.
• Principle of least privilege: business-rule writes go through audited API routes, not direct client database access.

Data Breach Notification

In the event of a security incident affecting your personal data, we will notify you by email within 72 hours of discovery, and provide:

• The nature and approximate scope of the incident.
• The categories of data affected.
• Steps we are taking to contain and remediate it.
• Steps you can take to protect yourself.

We will also notify regulators where required by applicable law, including state attorneys general under each state's breach notification statute.

5. Data Sharing and Disclosure

We do not sell your personal information. We share data only with the subprocessors listed below, each of which processes data only as necessary to provide their services to ClinicGuard:

We may also disclose personal information in the following limited situations:

• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to users.

What we do not share: ClinicGuard does not send your data to any AI or machine-learning service. Your assessment answers, document profile, and clinic information are only used inside ClinicGuard and the subprocessors listed above.

6. Document Templates and PHI

ClinicGuard does not store, request, or process any Protected Health Information (PHI) about your patients. The HIPAA document templates we generate (Notice of Privacy Practices, BAAs, training forms, etc.) are pre-filled with your clinic's business profile only — clinic name, address, Privacy Officer details, and similar non-patient data you provide in Settings.

The completed documents are downloaded directly to your computer. We do not retain a copy of the rendered file.

HIPAA Business Associate Agreement (BAA)

Because ClinicGuard does not access, store, transmit, or process any PHI, ClinicGuard is not a HIPAA “Business Associate” of your practice as defined in 45 CFR § 160.103, and no BAA is required for your use of the Service. Your practice remains the sole HIPAA Covered Entity responsible for any PHI handled outside the Service.

If your compliance program requires a BAA from any vendor regardless of PHI access, please contact us at support@clinicguard.net.

7. Cookies and Analytics

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for authentication and session management (e.g., your Supabase login session). These cannot be disabled because the Service does not function without them.
• Analytics Cookies (Google Analytics 4): Help us understand which pages and features are used so we can improve the Service. GA4 sets cookies prefixed _ga and _ga_*. We do not use Google Analytics for advertising and we do not enable Google Signals or cross-device tracking.

Your control: Use the Privacy Choices link in our footer to turn analytics off at any time. Your preference is stored locally in your browser. If you visit from the European Economic Area or the United Kingdom, analytics are turned off by default and only run if you explicitly enable them.

We honor Google Consent Mode v2 to communicate your choice to Google. Even when analytics are off, basic, anonymized signals (page-load count without identifiers) may still be sent so we can roughly size traffic — these contain no cookies and no user identifier.

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your personal data and account.
• Portability: Request your data in a structured, machine-readable format.
• Opt-out: Opt out of non-essential data processing.

California Residents (CCPA / CPRA): You have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected, the right to limit use of sensitive personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email support@clinicguard.net or use the Delete Account button in your account Settings.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. After account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records retained for 7 years for tax compliance, or fraud-prevention logs retained up to 12 months).

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the Service at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@clinicguard.net.