Privacy Policy

Who we are

MedClinora is operated by TetraSol Ontario Inc., 7 Treeline Crt., Markham, ON L3S 3T8, Canada. This policy explains what personal information the MedClinora website and application collect, why, and how long it is kept.

MedClinora is used by clinics to run their business. When a clinic keeps information about its own clients in MedClinora (for example client records, appointments, or completed forms), the clinic decides what it collects and how it uses it, and we store and process that information to provide the service to the clinic. If you are a client of a clinic, please contact the clinic about your information; we’ll pass on any request we receive to the clinic concerned.

Information we collect

• Account information: your name and email address, a securely hashed password, and — if you turn it on — two-step verification data. If you sign in with Google or Facebook, we receive your name, email address, and account ID from that service. We don’t store your profile picture or keep your Google or Facebook access tokens, and we never post on your behalf.
• Clinic workspace information: clinic names, team memberships and roles, invitations (including the invited email address), clinic feature settings, and the clinic’s plan, trial, and usage records.
• Information clinics keep about their clients: client profiles (name, date of birth, email, and phone), treatment records, appointments, and intake and consent forms, including answers and signatures. Only clinic team members whose role allows it can see this information, and each clinic’s information is kept separate from every other clinic’s.
• Website chat: if a clinic adds MedClinora’s chat to its website, we keep the messages exchanged and, if a visitor chooses to leave them, their name and email address. The chat window says when replies come from an automated assistant and asks visitors not to share health details.
• Video visits: if a clinic connects its own Zoom account, we create the meeting in that account. Zoom receives the meeting time, length, and a title with the clinic’s name, but no client name or health information. Meetings aren’t recorded by MedClinora.
• App connections a clinic turns on: for a connected Google or Outlook calendar we read only busy and free times, not event details. For connected Facebook lead forms we keep only the lead’s name, email address, and phone number.
• Security records: records of security-relevant events (for example a password change or a team change), stored without passwords, codes, or email addresses; a record of who opened client records; and rate-limit counters stored under one-way hashed identifiers.
• Inquiries: when you request a demo or contact us, the details you enter (name, work email, clinic name and type, team size, province, an optional message, and your consent to be contacted). We don’t record your IP address with these requests.

Please don’t send patient or health information through our website forms or our own demo and contact requests.

How we use it

• To provide accounts and clinic workspaces, and to keep them secure.
• To send service emails such as email verification, password resets, team invitations, and the form links a clinic sends its clients.
• To respond to demo requests and questions you send us.

We don’t sell personal information, we don’t use clinics’ client information for our own purposes, and we don’t use advertising trackers.

On the public website only, we use Google Analytics to count visits and see which pages are useful. It receives the page address (without any link codes), your browser and device type, an approximate location, and a random ID kept in a cookie. It is never loaded in the application itself, on sign-in pages, or on pages that show client forms, appointments, or video visits. See the Cookie Policy to turn it off.

How long we keep it

• Inquiries are deleted automatically 180 days after they are received.
• Security event records and the record of who opened client records are deleted automatically after 180 days.
• Website chat conversations are deleted automatically 365 days after their last message.
• Staff notifications are deleted after 90 days; Facebook leads after 180 days; calendar busy times after 2 days.
• Form links stop working after 14 days or once used. Completed forms are part of the client’s record.
• Expired invitations are deleted 30 days after they expire; sign-in sessions end when they expire or you sign out.
• Account, clinic, and client record information is kept while the account or clinic exists. Client profiles are archived rather than deleted, so a clinic keeps its treatment history.

Service providers

We use service providers to host the application and database and to send email. Clinics that choose to connect Zoom, Google, Microsoft Outlook, or Facebook share the information described above with that service, under its own terms and privacy policy. Google and Facebook are also used when you choose to sign in with them. The specific hosting and email providers, and the location where data is stored, will be listed here before MedClinora is generally available.

Your choices

You can ask to access or correct your personal information, or ask questions about this policy, through our contact form. After signing in, you can change your password and manage two-step verification from your account security page. Clinic owners can export their clinic’s client records to answer their own clients’ requests.

Deleting your data

You can ask us to delete your account and the personal information linked to it, including data received from Facebook or Google sign-in. We complete deletion requests within 30 days and confirm by email. See Data Deletion for how to send a request and how to remove MedClinora from your Facebook account.

Cookies and browser storage

We use only the cookies needed to sign you in and keep your account secure, and the website chat keeps one item in the visitor’s browser so the conversation continues between pages. See the Cookie Policy.

Changes and contact

We’ll update this policy as MedClinora develops — including before any feature that handles information differently is released — and show the date of the latest version above.