Privacy policy

ClinicCue keeps as little personal information as it can, and only uses it to send appointment reminders and run your account.

Who we are

ClinicCue is operated by ClinicCue, South Africa. You can reach us, including our Information Officer, at [email protected].

Two kinds of information, two roles

• Practice accounts (the people who sign in: owners, reception, practitioners). For this information ClinicCue is the responsible party under South Africa's Protection of Personal Information Act (POPIA).
• Patient information that a practice adds to send reminders. Here the practice is the responsible party and ClinicCue is its operator: we process it only on the practice's instructions, to send its reminders.

What we collect

• Practice accounts: name, work email, password (stored only as a secure one-way hash), role, practice name, country, time zone, address (if entered), and records of sign-ins and changes, kept for security.
• Patients: first name, mobile number, appointment date and time, practitioner, whether they agreed to or stopped reminders, and the WhatsApp messages sent to and received from them. We never store clinical notes, treatments or medical records, and reminders only ever say “your appointment”.
• Payments: handled by our payment provider (see below). ClinicCue never sees or stores card numbers.

Why we use it

• To send appointment reminders and record patients' replies (Confirm, Reschedule, STOP).
• To run practice accounts: sign-in, invitations, password resets and support.
• To bill practices, keep the service secure, and meet legal obligations.

We don't sell personal information, and we don't use patient information for marketing.

Consent and opting out

Practices must have their patients' agreement to receive appointment reminders (for example on an intake form) and confirm this in ClinicCue. Patients can reply STOP to any message to stop reminders from that practice, or ask the practice to remove them.

Who we share it with

Only the service providers we need, each bound to protect it:

• Meta (WhatsApp Business Platform): delivers WhatsApp messages.
• Creem: our payment provider and merchant of record for subscriptions.
• Resend: sends account emails such as invitations and password resets.
• Cloudflare: website security, bot protection and encrypted backup storage.
• xneelo: hosts ClinicCue's servers in South Africa.

Some of these providers process information outside South Africa. Where that happens we rely on the safeguards POPIA requires, such as agreements that give an adequate level of protection. Backups are encrypted before they leave our server.

How long we keep it

• Patient information stays while the practice uses ClinicCue. A practice can delete any patient, with all their appointments and messages, at any time.
• When a practice closes its account, we delete its patient information within 30 days, and it disappears from backups within a further 35 days.
• Billing records are kept for as long as tax law requires.

Security

Information is sent over encrypted connections, passwords are hashed, each practice can only ever see its own information, access is limited by role, and backups are encrypted with a key held outside the server.

Your rights

You can ask to see, correct or delete personal information we hold about you, or object to how it's used. Patients should contact their practice first, since the practice controls their information; we'll help the practice respond. Email [email protected]. You may also complain to South Africa's Information Regulator (inforegulator.org.za).

Changes

If we change this policy we'll update the version and date above, and tell practices by email about any significant change.