Privacy policy

Cliniop sends post-treatment follow-up emails on behalf of aesthetic clinics. This policy explains what information we handle, why, and the choices you have. It covers cliniop.com and the Cliniop app.

Who this policy covers

Clinics (our customers) and their staff, who subscribe, sign in and manage follow-up workflows. Clients of those clinics, who receive follow-up emails. Visitors to cliniop.com, including anyone who completes the fit check or asks to talk to us.

For client information, the clinic decides what to send and to whom. Cliniop handles that information on the clinic’s behalf and only to deliver its follow-up emails. Questions about a clinic’s own use of your information are best sent to that clinic; we will help it respond.

Information we collect

We collect only what the service needs:

  • Clinic account: the email addresses of the owner and invited staff, and the clinic profile (clinic name, sender name, reply-to address, postal address, location names).
  • Client information entered by a clinic: email address, an optional first name, the location, which follow-up workflow was started, the scheduled messages and whether each was delivered, and whether the client rebooked.
  • Billing: Stripe processes payments. We receive the payer’s email, a Stripe customer and subscription reference and the subscription status; we never see or store card numbers.
  • Website requests: when you ask for a walkthrough or a conversation, the name, email, clinic name, message and fit-check answers you submit.
  • Product analytics: a short list of event names (for example, that a fit check was completed) with a timestamp. These events contain no names, emails, client or treatment details.
  • Technical data: like any website, our hosting provider processes IP addresses and request details to deliver pages, block abuse and limit request rates.

What Cliniop is not for

Cliniop is a follow-up email tool, not a medical record. Clinics should not enter clinical notes, diagnoses, photos or payment details about their clients. Cliniop does not sign business associate agreements; a clinic that is subject to HIPAA should confirm with its own advisor whether Cliniop suits its situation before using it.

How we use information

To provide the service: sign staff in, store workflows, schedule and send each clinic’s follow-up emails under its own sender name, show delivery status and take payment. To answer requests sent through the website. To keep the service secure and working. We do not sell personal information, we do not share it for advertising, and we do not use client information for any purpose of our own.

Service providers

A small number of companies process information for us, each only to provide its part of the service:

  • Cloudflare: hosting, database, the one-time-code sign-in and request protection.
  • Stripe: subscription checkout, billing and receipts.
  • Resend: delivery of follow-up emails and notifications.
  • Google Fonts: the website’s typefaces load from Google, which receives your IP address when a page loads.

Cookies

Cliniop does not use advertising or cross-site tracking cookies. Signing in to the app sets a CF_Authorization cookie, which keeps staff signed in. Stripe sets its own cookies on its checkout and billing pages to process payments and prevent fraud.

Retention and deletion

We keep account and client information while the clinic’s account exists, so a paused or cancelled clinic can resume. A clinic owner can ask us to delete the account and everything in it, and we will do so within 30 days of the request, except billing records we must keep by law. Website requests are kept while they are useful for answering you, and deleted on request.

If you are a client of a clinic and no longer want its follow-up emails, reply to any of them: replies go to the clinic, which can stop your emails. You can also write to us and we will pass your request on.

Security

Connections use HTTPS. Staff sign in with a one-time code sent to their email, and each clinic sees only its own account. Data is stored with Cloudflare and encrypted at rest. No system is perfectly secure; if we learn of a breach affecting your information, we will tell affected clinics without undue delay.

Your choices and contact

You can ask to access, correct or delete information we hold about you by writing to privacy@cliniop.com. We answer within 30 days. Cliniop is intended for businesses and is not directed to children under 16.

If we change this policy, we will update the date above and email clinic owners before any material change takes effect.