Privacy Policy

1. Who We Are

Clinic OS Pro is a business name registered in Ontario, Canada (Ontario BIN 1001580753), based in Windsor, Ontario, Canada ("Company," "we," "us," or "our"). References to "Clinic OS Pro" refer to this business name.

We provide:

• Clinic OS Pro: A Software-as-a-Service (SaaS) platform designed to help physical therapy and rehabilitation clinics identify revenue leakage, manage patient outreach, and improve plan-of-care completion rates.

We are a software platform, not a healthcare provider. We do not provide medical advice, make clinical decisions, or have any direct relationship with your patients. Your clinic is the data controller for patient information; we act as a data processor on your behalf.

2. Information We Collect

2.1 When You Visit Our Website (clinicospro.com)

• IP address and device information
• Browser type and operating system
• Pages visited and time spent on our website
• Referring website or source
• Cookies and similar tracking technologies
• Contact form submissions (name, email, phone, company, message)

2.2 When You Create a Clinic OS Pro Account

• Clinic name, address, phone number
• User names, email addresses, and roles
• Billing and subscription information
• Timezone and regional preferences
• EMR system credentials (encrypted, for integration purposes only)

2.3 Patient Information

We collect the patient data our services use. Most of it comes from your EMR, CRM or the files you import; messages, calls and notes are created as you use the platform:

• Identifiers: Patient name (and a preferred name, if the patient gives one), email address, phone number, date of birth, ZIP or postal code
• Visit Metadata: Last visit date, next scheduled visit, visit counts
• Plan of Care Data: Planned visits vs. completed visits
• Appointment Status: No-show flags, appointment history
• Program Information: Treatment program type (e.g., "Sports Rehab") and primary sport
• Payment Type: How the patient pays (for example Medicare or self-pay) and, where your clinic tracks visit authorizations, the insurer's name and the visits it authorized
• Contact Preferences: Do-not-contact flags, communication preferences, SMS consent records
• Notes and Labels: Notes your staff write about a patient, a task or an appointment; appointment notes from an imported calendar or schedule file; labels (tags) from your EMR or CRM
• Messages and Calls: Texts and emails sent to patients and their replies, messages that reach a connected Facebook or Instagram inbox, and recordings and transcripts of calls made or answered by our AI voice agent

2.4 Usage & Technical Data

• IP addresses and device information
• Browser type and operating system
• Pages visited and features used within Clinic OS Pro
• Login timestamps and session information
• Error logs and performance data

2.5 Communication Data

• Records of emails and SMS messages sent through our platform
• Delivery status and engagement metrics
• Message templates and customizations

3. Information We Limit, But Do Not Eliminate (PHI Scope)

Our platform is designed to keep the PHI we process to what patient outreach uses. For US clinics, everything described in Section 2.3, tied to an identifiable patient, is treated as Protected Health Information (PHI) under HIPAA. We do not import diagnoses, imaging, lab results or prescriptions, and the platform has no field for them. Free text is different: notes your staff write, appointment notes and labels from your other systems, and what patients write in messages or say on calls can contain health details, clinical ones included. We protect all of it as PHI.

4. How We Use Information

We use collected information solely to:

• Provide the Clinic OS Pro platform and its features
• Generate task lists for patient outreach
• Calculate revenue metrics and generate reports
• Send communications on your behalf (when you initiate them)
• Create meeting notes, documentation, and action items
• Provide customer support
• Improve and secure our services
• Comply with legal obligations

We do NOT:

• Sell your data or patient data to third parties
• Use identifiable patient data for advertising or marketing. We may publish de-identified, aggregated statistics that cannot identify any patient, as section 7.3 of our Terms of Service describes.
• Share data with third parties except as described in this policy
• Make clinical or treatment decisions
• Contact patients directly -- all communications are sent by your clinic
• Use identifiable patient information to train generalized AI models for use outside your account

5. Information Sharing & Subprocessors

We share information only with trusted service providers who help us deliver our services:

For the complete, current list of subprocessors, see our Subprocessor List.

No behavioral ad tracking inside the product. For logged-in areas where PHI may be present, we do not use third-party advertising pixels or cookies for behavioral advertising.

We may also disclose information:

• To comply with legal obligations, court orders, or government requests
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets (with notice)

6. Data Security

We implement industry-standard security measures including:

• Encryption in Transit: All data transmitted via TLS 1.2 or higher (HTTPS)
• Encryption at Rest: Database encryption using AES-256
• Access Controls: Role-based access, multi-factor authentication available
• Audit Logging: Comprehensive logs of data access and modifications
• Regular Backups: Automated backups with tested restore procedures
• Vulnerability Monitoring: Regular security scans and updates
• Employee Training: Security awareness and HIPAA training every year for everyone with access to patient data, with a dated record of each completion

While we take security seriously, no system is 100% secure. We maintain an incident response plan and will notify affected parties in accordance with applicable breach notification laws.

7. Data Retention

• Active Accounts: Data retained while your subscription is active
• Proof of Consent: When a clinic's data is deleted, we keep only the proof of consent: SMS consent and opt-out records, and a minimal log of AI calls (the number, the date and the outcome), for the numbers we texted or called in the 4 years before the deletion. We keep these for 4 years after we delete your clinic's data (Section 12.4), and then delete them
• Backup Data: Backup copies expire within 120 days, so deleted data is gone from every backup within 120 days of the deletion
• Audit Logs: Kept for at least 7 years for compliance purposes, including after the rest of a clinic's data is deleted. The log cannot be edited, and an entry can name the patient whose record was viewed or changed
• Financial and tax records: As long as the law requires
• Call Recordings & Transcripts: Our voice provider, Retell AI, keeps each call's recording and its own transcript for up to 2 years, then deletes them. Our copy of the transcript is kept while your account is active or archived, and deleted with the rest of your clinic's data
• Biometric Data (voiceprints): 2 years or when purpose is satisfied

Accounts without an active plan

When a clinic’s plan or 60-Day Sprint ends without a new plan, its account is paused and archived, not deleted. Nothing is sent from an archived account. We keep its data securely, under the same protections as an active account, including the Business Associate Agreement, so the clinic can restart where it left off. We keep an archived account for up to 12 months after it ends; before we delete it, we email the account owner at least 30 days in advance. The clinic can export its data, or ask us to delete it, at any time. We delete it within 90 days of the request, it is gone from every backup within 120 days of the deletion, and we confirm the deletion in writing on request. The Agreement and the Business Associate Agreement stay in effect while an account is archived and end when the account is closed.

You may request earlier deletion by contacting support@clinicospro.com.

8. Call Recording & Biometric Data

Laws like the Illinois Biometric Information Privacy Act (BIPA) and similar state laws may give you additional rights regarding biometric data. Where these laws apply, we will honor their requirements for notice, consent, retention, and destruction.

8.1 Recording of Communications

We may record and transcribe customer calls and meetings for documentation, quality assurance, and training purposes. Recordings may be made using various platforms including Zoom, Google Meet, and AI-powered transcription tools.

8.2 Biometric Data Collection

AI transcription tools may create voice profiles or "voiceprints" to identify and distinguish between speakers. These voiceprints may constitute biometric identifiers under laws such as the Illinois Biometric Information Privacy Act (BIPA) and similar state laws.

8.3 Purpose of Biometric Data Collection

Biometric data (voiceprints) is collected solely for:

• Accurate speaker identification in meeting transcripts
• Creating attributed meeting notes and action items
• Quality documentation of customer engagements

8.4 Retention and Destruction

Biometric data will be retained for no longer than 2 years from collection, or when the purpose for collection has been satisfied, whichever comes first.

8.5 No Sale of Biometric Data

We will NOT sell, lease, trade, or otherwise profit from your biometric data. Biometric data is disclosed only to service providers necessary for transcription services.

8.6 Consent and Opt-Out

When recording meetings or calls you participate in, we will disclose recording in advance. You may opt out of recording for specific meetings by notifying us in writing before the meeting begins.

Where required by law, we will obtain written or electronic consent before collecting biometric data and will provide a clear method to withdraw that consent.

9. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at support@clinicospro.com. We will respond within 30 days (or as required by applicable law).

Note for Patient Rights: Clinic OS Pro stores patient data on behalf of clinics. Patients seeking to exercise their rights should contact their healthcare provider directly. Clinics can use our data export and deletion features to fulfill patient requests.

10. HIPAA Compliance (US Healthcare Clients)

Your clinic remains the covered entity. We act as your business associate only as described in a signed BAA. Clinic OS Pro may be considered a "Business Associate" under HIPAA when processing protected health information (PHI) on behalf of covered entities (healthcare providers).

No BAA = No PHI. US clinics must sign our Business Associate Agreement (BAA) before they can connect their EMR, import patient data that qualifies as PHI, or send PHI in patient communications. Using Clinic OS Pro with PHI without a signed BAA is a violation of our Terms of Service and is done at your sole risk.

Our HIPAA-aligned measures include:

• Encryption of PHI at rest and in transit
• Access controls and audit logging
• Workforce training on HIPAA requirements
• Business Associate Agreements with the subprocessors that handle PHI (our SMS carrier relies on the HIPAA conduit exception instead)
• Incident response and breach notification procedures (without unreasonable delay and within the timeframes required by applicable law and our BAA)

11. United States Specific Provisions

11.1 California (CCPA/CPRA)

California residents have additional rights under the CCPA/CPRA:

• Right to know what personal information is collected and how it's used
• Right to delete personal information
• Right to opt-out of "sale" of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

Do Not Sell My Personal Information: We do not sell personal information as defined by the CCPA.

11.2 Other US State Laws

We comply with applicable state privacy laws including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other emerging state privacy regulations.

12. Canada Specific Provisions

12.1 PIPEDA Compliance

Your clinic remains the data controller under PIPEDA. We act as your data processor under a signed DPA. For Canadian clinics, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 fair information principles.

12.2 Provincial Health Privacy Laws

We recognize and support compliance with provincial health information laws including:

• Ontario: Personal Health Information Protection Act (PHIPA)
• Alberta: Health Information Act (HIA)
• British Columbia: Freedom of Information and Protection of Privacy Act (FIPPA)
• Quebec: Act Respecting the Protection of Personal Information in the Private Sector

12.3 CASL Compliance (Anti-Spam)

When using our messaging features, Canadian clinics must ensure compliance with Canada's Anti-Spam Legislation (CASL). The clinic is responsible for obtaining and documenting express or implied consent before sending commercial electronic messages.

12.4 SMS Consent Records (TCPA Compliance Infrastructure)

For every patient that may receive SMS messages through Clinic OS Pro, we store the following consent record fields in the patient’s database row. This is shared infrastructure between Clinic OS Pro and the clinic that owns the patient relationship; the clinic is the legal data controller for this consent.

• smsConsentAt — ISO 8601 timestamp of when consent was first recorded. The system refuses to send SMS to any patient with this field null.
• smsConsentMethod — one of WEB_INTAKE, BULK_IMPORT_TPO, MANUAL_FRONT_DESK, PHONE_VERBAL, or LEGACY_SEED (for patients present before May 3, 2026 when the consent infrastructure went live).
• smsConsentTextSnapshot — the exact text the patient (or attesting clinic owner) agreed to at the moment of consent. Captured at consent time and never modified afterwards. Locked at the database layer against accidental clearing.
• smsConsentIp — for web-collected consent only, the IP address from which the form was submitted.
• smsConsentAttestedById — for non-WEB_INTAKE methods, the user ID of the clinic staff member who attested consent on the patient’s behalf.
• smsConsentSource — ops metadata for debugging (e.g., intake-page-v1:peak-performance-pt, bulk-import:2026-05-03:owner@clinic.com).

These records stay on the patient’s record while your clinic’s account is active or archived. When your clinic’s data is deleted, we keep a smaller record as proof of consent, only for the numbers we texted or called in the 4 years before the deletion: for each number, the patient’s ID in our system, when and how consent was given, the date of the last text and whether the patient had opted out; each opt-out, with the number, the reason and the date; and a minimal log of AI calls from those 4 years, with the number, the date and time, the direction and the outcome. It holds no names, no message text, no recordings and no transcripts. We keep this record for 4 years after the deletion, as proof of consent if a text or call is ever challenged under the TCPA (whose statute of limitations is four years), and then delete it, unless ongoing litigation, an audit or a regulatory hold requires us to keep it longer. While we keep it, it is protected like the rest of your patient data and used for nothing else. On request, we can produce a per-patient consent audit report for legal proceedings.

13. European Union / GDPR

Your clinic remains the data controller under GDPR. We act as your data processor under a signed DPA. While our primary markets are the US and Canada, we comply with GDPR requirements for any EU-based users:

13.1 Legal Basis for Processing

• Contract: Processing necessary to provide our services
• Legitimate Interest: Improving services, security, fraud prevention
• Legal Obligation: Tax, audit, and regulatory compliance
• Consent: Where specifically obtained (e.g., marketing communications)

13.2 International Transfers

Data is transferred to the United States. We rely on Standard Contractual Clauses (SCCs) and supplementary measures to ensure adequate protection. Our Data Processing Addendum includes the latest EU SCCs.

13.3 Data Protection Contact

For GDPR inquiries, contact us at support@clinicospro.com.

14. Children's Privacy

Clinic OS Pro is designed for use by healthcare businesses, not individual consumers. We do not knowingly collect personal information from children under 13 (or applicable age of consent in your jurisdiction). If you believe we have inadvertently collected such information, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending email notification to account administrators
• Displaying a notice within the Clinic OS Pro application

Continued use of our services after changes constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related inquiries: