Privacy Policy
Last updated: 12 November 2026
This policy explains how Clinic Flow handles data when clinics use our cloud system to manage inquiries, bookings and follow-up.
1. Who we are and who is responsible
- Clinic Flow is a cloud CRM that clinics subscribe to. Each clinic is responsible for its patients’ data (the data controller); we process that data on the clinic’s behalf and only on its instructions (the data processor).
2. Data we process
- Clinic and staff account data: name, e-mail, role, branch.
- Patient inquiry data entered by the clinic or received from channels it connects: name, phone number, requested service, notes, messages, appointments.
- Technical data for security: IP address, sign-in times and failed sign-in attempts.
- We do not store any payment card data.
3. Where the data comes from
- Directly from clinic staff, from the clinic’s website forms, and from platforms the clinic connects and authorizes itself: Facebook and Instagram lead ads, WhatsApp Business, Instagram messaging, and TikTok through integration tools.
4. How we use data
- Only to provide the service to the clinic: showing inquiries, assigning them to staff, sending the replies staff write, and reports.
- For security and abuse prevention.
- For technical support only after the clinic manager grants us temporary read-only access.
- We do not sell data, use it for advertising, or use it to train AI models.
5. Meta Platform data
- Data from Facebook, Instagram and WhatsApp is used only to show and answer messages and inquiries for the clinic that connected its account. Access tokens are stored encrypted, and syncing stops and tokens are deleted as soon as the clinic disconnects the account. We comply with the Meta Platform Terms and WhatsApp Business policies.
6. Storage and security
- The system runs on Cloudflare’s cloud infrastructure. All connections are encrypted (HTTPS), secrets are encrypted (AES-GCM), passwords are stored as one-way hashes, each clinic’s data is fully isolated, and permissions follow each staff member’s role.
7. Retention
- We keep data for as long as the clinic is subscribed. When a subscription ends the system becomes read-only and the clinic can export its data. Data is deleted on the clinic’s written request, or within 90 days after the account is permanently closed.
8. Data deletion
- Patients: to access, correct or delete your data, contact the clinic you messaged; it will carry out your request through the system.
- To delete data that arrived through Facebook, Instagram or WhatsApp, or if you cannot reach the clinic: e-mail us at support@clinicflow.vip with the clinic name and your phone number or account name, and we will delete the data and confirm within 30 days.
9. Cookies and local storage
- We use no tracking or advertising cookies. We use the browser’s local storage only to keep you signed in and remember your language. Fonts are loaded from Google Fonts.
10. Changes and contact
- We may update this policy and will show the new date at the top of this page. Contact: support@clinicflow.vip.