This Privacy Policy explains what data ClinicPulse collects, how we use it, who we share it with, your rights, and how we protect it. We treat your data, and your patients' data, like the sensitive healthcare information it is.
ClinicPulse is a Practice OS for specialty clinics. ClinicPulseos.com (ClinicPulse) is a DBA of RKS GROUP WA PTY LTD ("ClinicPulse," "we," "us," "our"). This Policy applies to: (a) clinic owners and operators using the Service, (b) end users (patients, members) whose data flows through the Service on a clinic's behalf, and (c) website visitors at clinicpulseos.com. Where you operate as a HIPAA-covered entity, we act as a Business Associate per a separately executed BAA.
For data you provide directly to us (account, billing, configuration), ClinicPulse is the data controller. For patient data you process via the Service on behalf of your clinic, you are the data controller and we are the data processor / Business Associate. Privacy questions, requests, or complaints go to support@clinicpulseos.com.
What we don't do: sell your patient data, sell your clinic data, train external AI models on your patient data, share your data with advertisers, or use patient data for marketing to anyone other than the clinic that owns it.
For end-user (patient) data, your clinic determines the legal basis as the data controller. We process per your instructions and the BAA where applicable.
We use a mix of vendor LLMs (e.g., OpenAI, Anthropic) and our own configurations to power AI features. Your patient conversations are not used to train external models. We've enabled enterprise privacy controls with our LLM vendors that exclude your data from their training pipelines. For HIPAA customers, BAAs are in place with all sub-processors handling PHI. We may use anonymized, aggregated patterns (e.g., "30% of refill recalls in our system convert within 7 days") to improve recall workflows industry-wide; this never includes any identifiable data from any clinic.
We share data only with:
We don't sell, rent, or trade your data. We don't share patient data with advertisers under any circumstance.
Current sub-processors:
We may add or change sub-processors with 30 days' email notice. Current list always available at support@clinicpulseos.com.
We retain your data for as long as your account is active plus a 90-day post-cancellation export window. During the export window, you can download your data in a machine-readable format. After 90 days, we delete or anonymize, except where law requires longer retention (e.g., billing records, audit logs typically retained for 7 years; HIPAA-required logs per applicable rule). Aggregated, anonymized analytics may be retained indefinitely as they don't identify any individual or clinic.
ClinicPulse is operated from Australia. Your data may be processed in Australia, the United States, and other jurisdictions where our sub-processors operate. For transfers from the EU/UK, we rely on Standard Contractual Clauses (SCCs). For transfers from California, we comply with the CCPA / CPRA. For transfers from Australia, we comply with the Australian Privacy Principles (APPs). We have implemented technical and organizational measures (encryption in transit and at rest, access controls, audit logs) appropriate to the level of risk.
Depending on your jurisdiction (GDPR, UK GDPR, CCPA / CPRA, Australian Privacy Principles, others), you may have the right to:
For end-user (patient) rights requests, contact your clinic first; we'll work with the clinic to fulfill the request as required by law and the BAA. For your own data, email support@clinicpulseos.com. We respond within 30 days. We do not retaliate against accounts that exercise their rights.
We use minimal cookies: session authentication, remembered preferences, and aggregated analytics. We don't use third-party advertising trackers. We don't use cross-site tracking pixels. You can decline non-essential cookies in your browser without breaking core functionality. We do not use Google Analytics for any patient-facing flow; for clinic-owner dashboards, we use first-party analytics.
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13 except as part of pediatric care provided through a clinic that has executed a BAA, where parental consent is obtained by the clinic per HIPAA / state law. If you believe a child under 13 has provided us with information without parental consent, contact support@clinicpulseos.com and we'll investigate and delete as appropriate.
We employ industry-standard administrative, technical, and physical safeguards:
No system is impenetrable. If we suffer a security incident affecting your data, we'll notify you per Section 16.
Where you are a HIPAA-covered entity, we operate as your Business Associate under a separately executed BAA. The BAA governs PHI handling, breach notification timelines (we notify within 24 hours of confirmed breach), sub-processor flow-down, and your rights to audit. Patient (end-user) rights under HIPAA (access, amendment, accounting of disclosures) are routed through your clinic; we provide tooling and reporting to fulfill them within HIPAA-required timeframes.
In the event of a personal data breach affecting your data, we notify you without undue delay and within 24 hours of confirmation for PHI breaches per the BAA. Notice will include: the nature of the breach, categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. We support you in any further notification you must make to end users or supervisory authorities.
We may update this Policy from time to time. Material changes will be communicated by email to your account address at least 30 days before taking effect. Continued use after the effective date constitutes acceptance. Prior versions are archived and available on request.
Questions about your privacy, want to exercise a right, or report a concern? Email support@clinicpulseos.com. We respond within one business day. For formal complaints, you may also contact the Office of the Australian Information Commissioner (OAIC), your state attorney general, or your local data protection authority.