Privacy Policy

ClinicPilot is a desktop app for Mac and Windows. It helps allied-health clinics that use Jane, Walnut EMR, Cliniko, Juvonno or Universal Office see their schedule and fill empty appointments. This policy says what stays on your computer, what reaches us, and how to have it corrected or deleted. It covers clinicpilot.net and the ClinicPilot app. If your clinic is outside Canada, Clinics outside Canada adds what the law there requires and forms part of this policy.

ClinicPilot is a service of Sanskan Digital Services Inc., an Ontario corporation at 6109 Starfield Crescent, Mississauga, Ontario, Canada. “We” in this policy means Sanskan Digital Services Inc. Legal notices go to karthik@clinicpilot.net.

The short version

• We never receive, store or process your patients' information. It stays on your clinic's computer.
• We hold your account, your clinic's name and address, your billing, and the diagnostics and support messages you choose to send us.
• ClinicPilot never messages or calls your patients. Your clinic sends offers itself.
• If your clinic used our earlier website version, its copy stays on clinicpilot.net only until you move it into the app. See below.

What stays on your computer

The app reads your schedule from your practice software, read-only, onto the computer where it is installed. It uses the calendar link Jane or Walnut EMR gives you, an API key for Cliniko or Juvonno, or our agent on your Universal Office server. It never writes into any of those systems.

Patients, appointments, reports and notes stay on that computer, and in any encrypted backup files you choose to keep. They are not sent to us. Your clinic is responsible for that information and for the computer it is on.

What leaves your computer and reaches us

Only these six things:

• A licence check, once a day. It carries a licence code only.
• Linking a computer to your account. A one-time code, a hashed secret, the computer's name and that copy's random number.
• A check-in, every time the app starts, at each setup step, and once a day. A random number for that copy of the app; the app's version and the type of computer; how far setup has got; your clinic's name, practice system and time zone; the clinic owner's name and email (before the clinic is made, the email of the person signing up, and the email typed on the app's first screen if one was); when the free trial ends; whether the computer is linked; which of our emails the app was opened from, if you pressed Open ClinicPilot on the download page; and totals only: how many patients, practitioners and visits in the last 30 days, and how many patients your desk reached and booked from ClinicPilot and what those bookings were worth. Never which patients: no name, contact detail or appointment. The app's update checks carry the same random number.
• Diagnostics, only when you press Send. You see exactly what goes before it goes: the app version, the type of computer, which practice system you use, which switches are on, sync error codes, counts shown as ranges, and how many times the app has crashed.
• AI help, unless the clinic owner switches it off in Settings. When you upload a report: its column names, the kind of thing in each, and up to three example dates, amounts or statuses. At most once a day: the shapes of your appointment titles, with every name hidden. Never a patient's name, contact detail or row. We pass it to Groq for an answer.
• Support messages you write. Patient names, phone numbers and email addresses are removed on your computer before the message leaves it.

A privacy gate in the app blocks any request that contains a patient's name, phone number, email address or health-card number.

What we hold on clinicpilot.net

• Your account: your name, email address, your password stored only as a one-way hash, and your two-step sign-in secret
• Your clinic's name and address
• Billing: your plan and subscription status. Card details go straight to Stripe. We never see or store a card number.
• Licence links: which computers are linked to your account
• Each installed copy's latest check-in, as described above: the clinic and owner it belongs to, how far setup got, how many times it was opened, the trial's end and the totals, and the country, region and city its first check-in came from
• Diagnostics reports and support messages, as described above
• Downloads of the app and its updates: which file, when, and the country, region and city the request came from, worked out from its internet address; for an update, the copy's random number; and, when you came from a link in one of our emails, which person that email was sent to. We don't keep the address

We send account holders service email, such as sign-in codes, invites and billing notices. Links in our emails to our website carry a code saying who the email was sent to, so we know who downloaded the app and can help them set it up. Our website keeps that code in a cookie for 90 days, except for visitors in the UK and the European Economic Area.

Clinics that used our earlier website version

Before the desktop app, ClinicPilot ran on clinicpilot.net. If your clinic used that version, the copy of your clinic's information it held, including the patient and appointment details it read from your practice software, stays on clinicpilot.net, in our database hosted by Supabase in Canada, until you bring it into the desktop app. Once it is on your computer, you can ask from the app for the website copy to be deleted. We will email you 30 days' notice before we delete any copy that has not been moved, and delete it after that notice.

Messages to patients

ClinicPilot never sends messages to your patients and never calls them. The app helps your staff write an offer. Your clinic sends it from its own email, phone, WhatsApp or practice software. Your clinic is responsible for having each patient's consent and for honouring requests to stop.

How we use information

• To run your account, check your licence and bill your plan
• To fix problems and answer support messages
• To keep accounts secure

We do not sell information, share it for advertising or use it to train AI models.

Cookies on our website

• __Host-cp_session keeps you signed in to clinicpilot.net: it ends after 12 hours without use, after 7 days at most, and on every device when you sign out.
• __Host-cp_signin lasts 15 minutes, between your password and your authenticator code.
• __Host-cp_admin_mfa is used only by ClinicPilot staff, for 12 hours after entering an authenticator code to open the admin area.

We count visits to our public website with Vercel Web Analytics, and with a simple count of our own. Neither sets cookies or follows you to other sites. We use no advertising cookies.

Where it is stored

Our website is hosted on Vercel. Its database, hosted by Supabase in Canada, holds the account and billing details listed above, not patient information, apart from the earlier-website copies described above. Stripe handles payments and Resend delivers our email to account holders. Information handled outside Canada may be accessed by the courts and authorities of the country where it is handled, under its laws.

Service providers

Each provider receives only what it needs to do its job. None of them receives patient information from us, apart from Supabase holding the earlier-website copies described above.

• Supabase: database hosting, in Canada, for account and billing details (and the earlier-website copies described above)
• Vercel: website hosting, and counting visits to our public website
• Stripe: billing. Stripe handles card details.
• Resend: email to account holders. Receives the recipient's address and the message.
• Canada Post and Google Places: filling in your clinic's address when you type it at sign-up. They receive what you type for the clinic's address and name.
• Have I Been Pwned: checking a new password isn't a known leaked one. It receives only the first five characters of a scrambled form of the password, never the password.
• Groq: AI help. It receives the AI-help requests described above, which hold no patient information, and the support messages and emails you send us, so we can sort them. It does not use them to train its models.
• Google: signing in, if you choose to sign in with Google.
• Slack: our own team's copy of support conversations, so we can answer quickly. It receives your support messages, which have patient details taken out on your computer first.

Jane, Walnut EMR, Cliniko, Juvonno and Universal Office are your clinic's own systems, which your clinic chooses to connect to the app on its own computer. They are not our providers, and we do not receive what the app reads from them.

Who can see information

• Your patients' information is on your clinic's computer. We cannot see it.
• ClinicPilot staff look at your account, diagnostics and support messages only to support you, fix a problem, act on a request or meet a legal obligation. Our admin area requires a password and an authenticator code.

We disclose information to authorities only when the law requires it, such as a valid court order.

How long we keep it, and deleting it

On your computer: your clinic deletes its own data. Uninstalling the app does not delete it. Delete the app's data folder and your backup files to remove it.

On clinicpilot.net: we keep your account while it is open. You can ask us to close it at any time by writing to privacy@clinicpilot.net.

Your rights

You can ask what we hold about you, ask for it to be corrected, or withdraw consent. Account holders can write to us directly, and we reply within 30 days. Patients should contact their clinic, because the clinic holds their record and we do not.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner, such as Ontario's Information and Privacy Commissioner. Outside Canada, see Clinics outside Canada for your rights and your regulator.

If something goes wrong

If account information we hold is lost, stolen, or seen or used without permission, we tell affected account holders directly. Where there is a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada.

Children

ClinicPilot is for clinics, not for the public, and we do not knowingly collect information from children.

Changes to this policy

We post any change here with a new date. For a change that matters, we email account owners before it takes effect.

Contact

Our Privacy Officer answers questions about this policy and requests about your data: privacy@clinicpilot.net