Privacy policy

The short version. Your clinic’s records belong to your clinic. We use them only to run Clinikr for you. We don’t sell data, show ads or use patient records to train AI models. This website itself uses no cookies and no analytics.

This policy covers the Clinikr app (the Android app and the web app at app.clinikr.xyz) and this website, clinikr.xyz. “We” and “Clinikr” mean the team that runs Clinikr. If anything here is unclear, write to hello@clinikr.xyz.

Who is responsible for what

Clinikr is used by clinics to manage their patients. That means there are two roles, as described in India’s Digital Personal Data Protection Act, 2023 (DPDP Act):

• The clinic is the data fiduciary for its patients’ records. The clinic decides which patients to add, what to record about them and why. Patients who want to see, correct or delete their records should contact the clinic first.
• Clinikr is the data processor for clinic data. We store and process those records only on the clinic’s instructions, to provide the app.
• Clinikr is the data fiduciary for account data — for example, the email address you sign in with and how you use the app — and for messages you send us.

What we collect

Account data. Your email address, your name, your role in the clinic (owner, front desk, nurse, doctor or patient) and the clinic you belong to. We sign you in with a one-time code sent to your email; we don’t store passwords. If you set an app lock on your phone, your PIN or pattern is stored only on that device, as a salted hash.

Clinic data, entered by the clinic and its team:

• Clinic details: name, address, letterhead details, hours, visit length, rooms, price list, tax rates, currency and time zone.
• Patient details: name, contact details, age, sex, photo (if one is taken) and other details the clinic records.
• Visits: bookings, check-ins, waiting times, vitals (such as blood pressure, pulse, temperature and weight), allergies, consultation notes, voice-note summaries, prescriptions and visit summaries.
• Billing: bills, discounts, tax, payments and dues.
• Documents generated from these records, such as invoices, receipts, prescriptions, visit summaries and patient records as PDFs.

Device data. If you turn on arrival alerts, we store a push-notification token for your device or browser. Like any web service, our hosting providers process technical data such as IP addresses and request logs to deliver and secure the service.

Messages to us. If you email us, we keep the conversation to help you.

How we use it

• To provide the app: sign-in, bookings, the shared live view of the day, bills and documents.
• To send messages: emails to patients when a visit is booked, moved or cancelled, visit reminders, visit summaries, bills and receipts as PDF links, a welcome when a clinic adds a patient; push alerts for the clinic team (for example when a patient arrives, books or cancels); team invitations and sign-in codes; and, for demo clinics, an email to the owner before the demo ends.
• To turn a doctor’s dictated notes into a draft written summary (see below).
• To keep Clinikr secure, fix problems and prevent abuse.
• To tell clinic owners about important changes, such as changes to these terms, and to reply when you ask us about paid plans.

We don’t sell personal data. We don’t use clinic or patient data for advertising, and we don’t use it to train AI models.

The demo

Anyone can sign up at app.clinikr.xyz for a 7-day demo; the demo Android app connects to the same demo. Please don’t enter real patient details in the demo — use made-up names and details. We email the clinic owner a day before the demo ends. Demo data is deleted 7 days after sign-up, together with the demo clinic’s accounts and files, unless the clinic upgrades to a paid plan, in which case it keeps everything set up during the demo. We don’t keep backups of deleted demo data for you. The rest of this policy applies to the demo as well, including the account data you sign in with.

Voice notes and AI summaries

When a doctor dictates a note, speech is turned into text by the device’s speech recognition. That text is sent to an AI model (provided by Anthropic) that drafts a structured note — complaint, findings and plan. The draft is shown to the doctor, who reviews and edits it; nothing is saved to the patient’s record until they do. Audio recordings, where used, are deleted as soon as they’ve been processed. AI drafts can be wrong: the doctor is always responsible for the final note.

Sharing documents

When someone in the clinic shares a PDF (for example, a prescription on WhatsApp or by email), it goes to whoever they choose to share it with. Share links are signed and expire after 7 days. Once a document has been shared outside Clinikr, the recipient’s app or service handles it under its own terms.

Who processes data for us

We use a small number of service providers, only to run Clinikr:

These providers may process data outside India. We share only what each one needs to do its job.

We may also disclose data if the law requires it, for example in response to a valid order from a court or government authority.

How we protect it

• Every request is checked against row-level security in the database, so each clinic sees only its own data, and each role sees only what it should. Patients see only their own visits and bills.
• Data travels over encrypted connections (HTTPS).
• Patient photos and documents are private; they are shown through short-lived signed links.
• Phones can be locked with a fingerprint, PIN or pattern.

No system is perfectly secure. If we become aware of a personal data breach affecting your clinic, we will tell the clinic owner without undue delay so they can meet their own obligations, and we will notify authorities where the law requires.

How long we keep it

We keep clinic data for as long as the clinic uses Clinikr. Clinics decide how long to keep their own patient records, and should follow the record-keeping rules that apply to them. When a clinic owner asks us to close their clinic, we delete its data, except for anything we must keep to meet a legal obligation. Copies in backups are removed as those backups expire.

Your rights

Under the DPDP Act you can ask to access, correct, update or erase your personal data, withdraw consent, and nominate someone to act for you.

• Patients: please contact your clinic, which controls your record. We will help the clinic respond.
• Clinic owners and team members: write to hello@clinikr.xyz.

If you’re not satisfied with our answer, you can complain to the Data Protection Board of India.

Children

Clinics may record patients who are children. The clinic is responsible for obtaining consent from a parent or guardian where the law requires it. Clinikr accounts for clinic staff are for adults only.

This website

clinikr.xyz is a static website. It sets no cookies, runs no analytics or advertising, and loads nothing from third parties. Our host, Cloudflare, processes standard request logs to serve and protect the site.

Changes to this policy

If we make a significant change, we’ll update this page and tell clinic owners by email before it takes effect.

Contact and grievances

For questions, requests or complaints about personal data, email hello@clinikr.xyz. We’ll acknowledge your message and respond as quickly as we can.