Privacy Policy

1. Who this policy covers

This policy covers:

• Visitors to clivita.com;
• Doctors, staff, and administrators of clinics that use the Clivita desktop application or its web companion (together, the “Service”).

It does not directly cover patients whose records a clinic enters into Clivita. If that's you, please read Section 9 — your clinic, not Clivita, controls that record.

2. Information we collect

Information you give us directly. Your name, clinic name, email address and phone number, if you fill out our demo request form, or anything you tell us by email or WhatsApp.

Information about your Clivita account. If you work at a clinic using Clivita: your name, email, phone number, role (doctor, receptionist, or admin), specialty, and the clinic your account belongs to. We store a salted hash of your password, never the password itself. We also keep a record of actions taken in the Service under your account — see Section 6.

Patient information a clinic enters into the Service. Depending on what a clinic chooses to record for a given patient: name, phone number, national ID (CNIC), date of birth, gender, address, blood group, emergency contact, medical history, allergies, clinical notes, vitals, prescriptions, billing records, and photographs or uploaded documents such as reports and referrals. Each patient also gets a record number generated automatically by the Service. This category exists because a clinic put it there for its own clinical purposes — see Section 9 for what that means for whose policy actually governs it.

Information collected automatically. Standard web server logs — IP address, browser type, pages requested — generated by our hosting and network providers as an ordinary part of serving the website. This website does not currently set cookies, or run any analytics or tracking script, for marketing or measurement purposes. If that changes, we'll update this policy and say so plainly.

3. How we use this information

• To run the Service — hosting patient records, prescriptions, billing and queue data on behalf of the clinics that use it.
• To respond to a demo request or a message you send us.
• To send account-related communications to clinic staff — billing, service notices, and similar.
• To keep the Service secure — investigating misuse, unauthorised access, or abuse.

We do not currently use patient information to train any general-purpose AI model, and we do not sell any information we hold to third parties.

4. Who we share it with

We share information with a small number of providers who help us run the Service, each only to the extent needed to do their job:

• Hosting, network and file storage — Vercel (this website), Cloudflare (network and content delivery), and Cloudflare R2 (patient files and attachments uploaded through the Service).
• Email delivery — one of SMTP, Resend, or SendGrid, depending on configuration, used to send account and transactional email.
• Messaging — if you contact us on WhatsApp, that conversation also runs through WhatsApp's (Meta's) own systems and is subject to their privacy practices, not ours. A demo request submitted through this website is relayed internally to a Slack workspace so our team can follow up on it.

We do not sell, rent, or trade personal information to third parties for their own marketing purposes. We may disclose information where required by law, or to protect the rights, property, or safety of Clivita, our customers, or others. If Clivita is ever involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy we'll notify affected customers about.

5. Where your information is processed

Clivita is based in Pakistan, and the Service is built and operated from Pakistan. The infrastructure providers listed in Section 4 may process and store data in locations outside Pakistan as part of their own global infrastructure. We choose providers with reputable security practices, but we do not currently maintain a formal data-residency guarantee restricting storage to a single country. If your organisation requires one as a condition of use, contact us before signing up so we can discuss it.

6. How long we keep information

Account and clinical data entered by a clinic is retained for as long as the clinic's account is active, so the clinical record stays usable. We do not currently operate a fully automated data-purge process — we are actively working towards one. Data belonging to a closed or cancelled account is retained for a limited window, as set out in our Terms of Service, and then deleted on request or as part of a manual process.

Demo-request and enquiry information is kept for as long as reasonably necessary to respond to you and for a limited period afterwards for our own records, then deleted.

7. Security

We use administrative, technical and physical measures designed to protect the information we hold, including access controls that limit staff and system access to what a given role requires, encrypted connections (HTTPS/TLS) for data in transit, and password hashing rather than storage of plaintext passwords. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are continuing to invest in this area, and we do not currently hold or claim any specific third-party security certification.

If you become aware of a security concern involving Clivita, please tell us immediately at hello@clivita.com — we take reports seriously and will investigate promptly.

8. Your rights and choices

Depending on your relationship with us, you can ask us to:

• Tell you what personal information we hold about you;
• Correct information that's inaccurate;
• Delete your information, subject to anything we're required to keep for legal, accounting, or clinical continuity reasons;
• Stop sending you non-essential communications.

To ask any of this, email hello@clivita.com. We'll respond as promptly as we can. If you're a patient of a clinic that uses Clivita, please read Section 9 first — these requests should generally go to your clinic.

9. Patient information entered by a clinic

If you're a patient whose doctor or clinic uses Clivita, Clivita does not have a direct relationship with you and did not collect your information from you. Your clinic collected it, decides what to record and why, and is responsible for telling you about that under whatever notice or consent process your clinic follows. Clivita processes that information on the clinic's behalf and instructions, as the software the clinic has chosen to use.

If you have questions about your own medical record, or want to see, correct, or have it removed, please contact your clinic directly — they control the record. If your clinic is unable to help and you believe we can, contact hello@clivita.com and we will work with your clinic to resolve it.

10. Children's data

This website is not directed at children, and we do not knowingly collect personal information from children through it. Clinics using the Service — a paediatric practice, for example — may enter clinical records for minors as their patients, under the clinic's own consent and legal basis for treating that patient. That is clinical data covered by Section 9, not information Clivita has collected from a child directly.

11. Changes to this policy

We may update this policy from time to time — for example, as the Service changes, or if we add website analytics. We'll update the “Last updated” date at the top of this page, and for a material change, we'll make reasonable efforts to let clinic administrators know.

12. Contact

Questions about this policy, or requests relating to your information: hello@clivita.com.