Clinics outside Canada

ClinicPilot is used by clinics in Canada and in other countries. Our Privacy Policy, Terms of Service and Your patients' data apply everywhere. If your clinic is in Australia, New Zealand, the United Kingdom, Ireland or elsewhere in the European Union, this page adds what the law there requires. It forms part of those documents. Where it says something different, this page applies to your clinic.

The same everywhere

• We never receive, store or process your patients' information. It stays on your clinic's computer, wherever the clinic is.
• ClinicPilot never messages or calls your patients. Your clinic sends offers itself.
• What reaches us is the account, billing, check-in, diagnostics, AI-help and support information listed in our Privacy Policy, and nothing else.

Your clinic's role and ours

Your clinic is responsible for its patients' information. In the UK and the EU your clinic is the controller of it. In Australia and New Zealand your clinic is the agency or organisation that holds it. Because ClinicPilot never receives that information, we are not your processor or service provider for it.

For your own account (your name, email, clinic, billing and the rest of what our Privacy Policy lists), Sanskan Digital Services Inc. is responsible. In the UK and the EU we are its controller.

If your clinic used our earlier website version and it still holds a copy of your clinic's information, we hold that copy only on your clinic's instructions, to give it back to you or to delete it. Write to privacy@clinicpilot.net and we will do either.

Where your account information goes

Your account information is held in Canada, in our database hosted by Supabase. Some of our providers handle parts of it in the United States: Vercel (website), Stripe (billing), Resend (email), Groq (AI help and sorting support messages) and Slack (our team's copy of support conversations). Our Privacy Policy lists what each one receives.

• UK and EU: Canada is recognised by the European Commission and by the UK as protecting personal information adequately. For providers in the United States we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK extension) or on the standard contractual clauses in its data processing terms.
• Australia: when we send account information outside Australia, we take reasonable steps so that it is handled in line with the Australian Privacy Principles.
• New Zealand: we send account information outside New Zealand only to providers bound to protect it in ways comparable to the Privacy Act 2020.

Why we use account information (UK and EU)

• To provide the service you signed up for (contract): your account, licence checks, linking computers, billing and support.
• To meet legal duties (legal obligation): tax and accounting records, and answering lawful requests.
• Our legitimate interests, which we have weighed against yours: keeping accounts secure, the app's check-ins so we can help a clinic that gets stuck in setup, knowing which of our emails led to a download, and sorting support messages.

You can object to any use based on legitimate interests by writing to us.

Cookies for visitors in the UK and the EU

Links in our emails carry a code saying who the email was sent to. Elsewhere our website keeps that code in a cookie for 90 days. For visitors in the UK and the European Economic Area we do not set that cookie, because it is not needed to run the website. The other cookies we set are needed for something you ask for: signing in, signing in with Google, and linking the app to your account.

Your rights about your account information

• UK and EU: you can ask for a copy of your information, have it corrected or deleted, restrict how we use it, take it with you in a common format, and object to how we use it. We reply within one month.
• Australia: you can ask to see your information and have it corrected. We reply within 30 days.
• New Zealand: you can ask to see your information and have it corrected. We reply within 20 working days.

Write to privacy@clinicpilot.net. Patients should contact their clinic, because the clinic holds their record and we do not.

If you are not satisfied with our answer, you can complain to your regulator:

• Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
• New Zealand: the Office of the Privacy Commissioner (privacy.org.nz)
• United Kingdom: the Information Commissioner's Office (ico.org.uk)
• Ireland: the Data Protection Commission (dataprotection.ie)
• Elsewhere in the EU: the data protection authority in your country

If something goes wrong with account information

We tell affected account holders directly. We also report to the regulator when the law there requires it: in the UK and the EU within 72 hours of learning of a breach that puts people at risk; in Australia under the Notifiable Data Breaches scheme; and in New Zealand as soon as practicable when a breach has caused or is likely to cause serious harm.

Your clinic's duties to its patients

Your clinic decides whom to contact and sends every offer itself, so your clinic must follow the law where it practises. These are the main laws; this list is not complete and is not legal advice.

• Australia: the Privacy Act 1988 and the Australian Privacy Principles (health service providers are covered whatever their size), state health-records laws such as Victoria's Health Records Act 2001 and NSW's Health Records and Information Privacy Act 2002, the Spam Act 2003 for email and texts, and the Do Not Call Register Act 2006 for calls.
• New Zealand: the Privacy Act 2020, the Health Information Privacy Code 2020, and the Unsolicited Electronic Messages Act 2007 for email and texts.
• United Kingdom: the UK GDPR and the Data Protection Act 2018 (health information is special category data), and the Privacy and Electronic Communications Regulations for email, texts and calls, including the Telephone Preference Service.
• Ireland and the EU: the GDPR, Ireland's Data Protection Act 2018, and the ePrivacy rules for email, texts and calls (in Ireland, S.I. No. 336 of 2011).

Your clinic is responsible for having each patient's consent or other lawful basis before contacting them, for saying who the message is from, and for honouring requests to stop.

Your rights under consumer law

• Australia: ClinicPilot comes with guarantees under the Australian Consumer Law that cannot be excluded. Nothing in our terms takes them away. Because ClinicPilot is a service for businesses, not for personal use, our liability for failing a guarantee is limited, where the law allows, to supplying the service again or paying the cost of having it supplied again.
• New Zealand: your clinic acquires ClinicPilot for the purposes of a business, so, to the extent the law allows, the Consumer Guarantees Act 1993 does not apply. Nothing in our terms limits rights under the Fair Trading Act 1986 that cannot be limited.
• UK, Ireland and the EU: nothing in our terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow to be limited.

Where our terms say ClinicPilot is provided “as is”, that applies only as far as the law of your country allows.

Prices and tax

ClinicPilot costs 49.99 a month per clinic, plus 14.99 a month for each extra front-desk person or location, in your local currency: Australian or New Zealand dollars, pounds sterling or euros. GST or VAT is added at checkout where it applies, based on the clinic's address. Every clinic starts with a 14-day free trial, and no card is needed.

Changes to the terms

We email account owners at least 30 days before a material change takes effect. If a change is worse for your clinic, you can cancel before it takes effect, and we refund anything you paid in advance for the time after it.

Governing law

Our terms are governed by the laws of Ontario, Canada. That choice does not take away any protection that the law of your clinic's country gives and that cannot be excluded by agreement, and it does not stop your clinic bringing a claim in its own country's courts where that law gives it the right to.

Contact

Sanskan Digital Services Inc., 6109 Starfield Crescent, Mississauga, Ontario, Canada.
Privacy: privacy@clinicpilot.net
Legal notices: karthik@clinicpilot.net