Clinicaly Privacy Policy
Effective October 1, 2026
This policy explains what personal information Clinicaly collects, why, who we share it with, and the choices you have. We collect only what we need to run the Service, we do not sell personal information, and we do not use advertising trackers.
1. Who we are
1.1 Clinicaly is operated by Matt Topic, a sole proprietor carrying on business as Sable House, in Ontario, Canada ("Clinicaly", "we", "us"). Clinicaly is membership software for aesthetic clinics.
1.2 This policy applies to our websites, clinicaly.app and app.clinicaly.app, to the clinic join pages hosted on subdomains of clinicaly.app, and to the Clinicaly software (together, the "Service").
1.3 Our approach follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial and US state privacy laws.
2. The three groups this policy covers
We handle personal information about three groups of people, and our role is different for each:
- Website visitors. People who browse clinicaly.app or contact us. We decide how this information is used.
- Clinic owners and staff. The people who sign up for and use Clinicaly on behalf of a clinic. We decide how this information is used to run our business with the clinic.
- Patients. The members and customers of clinics that use Clinicaly. Each clinic decides how its Patients' information is used. We process it on the clinic's behalf, as its service provider. Section 6 explains what that means for Patients.
3. Information we collect
3.1 From website visitors. When you visit our marketing site, our hosting and network providers process technical information such as your IP address, browser type and the pages requested, as part of delivering the site and protecting it from abuse. If you email us, we receive your name, email address and whatever you choose to tell us.
3.2 From clinic owners and staff. When a clinic signs up and uses the Service, we collect:
- account information: names, email addresses, phone numbers, role and login credentials (passwords are handled by our authentication provider and stored in hashed form);
- clinic information: clinic name, address, city and province or state, logo, timezone, currency and settings;
- billing information for our fee: the payment card is collected and stored by Stripe, and we receive only limited details such as the card brand, last four digits, expiry and payment status;
- tax information needed to invoice correctly, such as your location;
- your Stripe connection: your connected Stripe account identifier and status (we do not receive your Stripe password or bank account numbers);
- support correspondence; and
- usage and security information, such as sign-in times, actions taken in the account and technical logs.
3.3 About Patients, on behalf of clinics. A clinic's use of the Service involves the following information about its Patients:
- contact details: first and last name, email address and mobile phone number;
- membership details: tier, status, join date, member code, referral source, and consent records for membership terms;
- balances and activity: treatment credit, included units, points, rewards, gift cards, visits and check-ins, the treatments or services purchased and their prices, and receipts;
- payment details: the Patient's Stripe customer identifier on the clinic's own Stripe account, card brand and last four digits, and payment, refund and dispute status (full card numbers are handled only by Stripe and never reach Clinicaly);
- messaging details: SMS messages the clinic sends, delivery status, and opt-out status; and
- imported history, when a clinic brings members over from another system.
Visit records show which treatments a Patient bought, which some laws treat as health information. Clinicaly is not designed for clinical charts, treatment notes, photographs, medical histories or diagnoses, and our Terms of Service require clinics not to enter them.
4. How we use information
4.1 Website visitors. To show you the site, keep it secure and reply when you contact us.
4.2 Clinic owners and staff. To create and secure your account, provide the Service, bill our fee and charge applicable taxes, send sign-in links and account emails, provide support, tell you about changes to the Service or our terms, prevent fraud and abuse, and meet legal, tax and accounting obligations. We may also email you about new Clinicaly features. You can opt out of those emails at any time; service and account messages will continue while you have an account.
4.3 Patients. Only to provide the Service to the clinic: running enrollment, subscriptions and front-desk checkouts through the clinic's Stripe account; showing balances in the member portal and on wallet cards; sending sign-in links, receipts and messages the clinic sends; producing the clinic's reports; and keeping the Service secure. We do not use Patient information to market to Patients, we do not sell or rent it, and we do not share it with other clinics.
4.4 Improving the Service. We record how clinic owners and staff use the Service, such as the pages they open, the buttons they use, how long they spend and any errors they meet, to operate and improve it. We send these usage records, with the clinic's name, to Google Analytics from our servers. They never include Patient information or anything typed into forms, and we do not record Patients' use of join pages or the member portal.
5. How we share information
5.1 Service providers. We share information with the providers that help us run the Service, only as needed for them to do so, and under agreements that require them to protect it:
| Provider | What they do for us |
|---|---|
| Supabase | Database and authentication, hosted on AWS in the US East (us-east-1) region |
| Railway | Application hosting, US East |
| Cloudflare | DNS, network delivery and security, and email routing |
| Stripe | Payment processing for clinics' Patient payments (on each clinic's own Stripe account) and for our own fee |
| Twilio | Sending and receiving SMS messages |
| Apple and Google | Delivering Apple Wallet and Google Wallet membership cards |
| Transactional email provider | Sending sign-in and account emails |
| Google (Google Analytics) | Measuring how clinic owners and staff use the Service: pages, buttons and time spent, with the clinic's name, never Patient information |
When a Patient adds a membership card to Apple Wallet or Google Wallet, the card's contents, such as the clinic name, the Patient's name, tier, member code and balances, are handled by Apple or Google under their own privacy policies. Stripe processes payment information both as our provider and under its own privacy policy. Stripe's hosted payment pages are governed by Stripe's privacy policy.
We will give clinics at least 30 days' notice, by email or on our website, before adding a new provider that will handle Patient information.
5.2 Within a clinic. Patient information is visible to the staff the clinic authorizes, according to their role.
5.3 Legal requirements and protection. We may disclose information where the law requires it, such as in response to a valid court order, or where necessary to protect the safety of any person, to investigate fraud or security issues, or to enforce our agreements. Where lawful, we will tell the affected clinic first.
5.4 Business changes. If the Clinicaly business is incorporated, reorganized, merged or sold, information may be transferred to the successor, which will be bound by this policy for information it receives.
We do not sell personal information and we do not share it for cross-context behavioural advertising.
6. Patients: your clinic is in charge of your information
6.1 If you are a member or customer of a clinic that uses Clinicaly, your clinic decides what information it collects about you and how it is used. The clinic is responsible for your information as its controller, and where applicable as its health information custodian. Clinicaly processes your information on the clinic's behalf, as its service provider, and only to provide the Service to the clinic. Your clinic's own privacy policy applies to your relationship with it.
6.2 Your membership and payments. Your membership, prices, benefits and payments are with your clinic. Your payments go to the clinic's own Stripe account. Clinicaly never receives your payment.
6.3 Questions and requests. To access, correct or delete your information, withdraw consent, or ask how it is used, please contact your clinic directly. If you contact us, we will pass your request to your clinic and help it respond. If we cannot identify your clinic, we will ask you for enough information to do so.
6.4 Text messages. You can stop text messages from your clinic at any time by replying STOP. Clinicaly records the opt-out, and no further texts will be sent to you through the Service unless you reply START. You can also ask your clinic directly.
6.5 Sign-in. You sign in to your member portal with a secure link sent to your email. Your clinic's staff do not see a password for you.
7. Where information is stored
7.1 Information in the Service is stored and processed in the United States, by the providers listed in section 5. Some providers, such as Cloudflare, Apple and Google, may also process information in other countries where they operate.
7.2 When information is stored outside Canada, it is subject to the laws of the country where it is held and may be accessible to the courts, law enforcement and national security authorities of that country. We choose providers with strong security practices and require them by contract to protect the information they handle.
8. How long we keep information
8.1 Clinic and Patient data. We keep a clinic's data, including its Patient information, for as long as the clinic has an account. When a clinic's account ends, the clinic has 30 days to export its data. We then delete the clinic's data, including Patient information, within 90 days.
8.2 Records the law requires. We keep billing, invoicing and tax records for as long as the law requires, which in Canada is generally six years.
8.3 Backups and logs. Copies in backups and technical logs are deleted as they roll off on their normal cycle, and remain protected until then.
8.4 Website enquiries. We keep correspondence with website visitors for as long as needed to respond and follow up, and then delete it.
A clinic can delete or correct Patient information during its account. Some records, such as payment and ledger history, are kept so that balances and receipts stay accurate and auditable.
9. Cookies and similar technologies
9.1 We use only the cookies and browser storage the Service needs to work:
- Sign-in cookies that keep clinic staff and members signed in securely;
- a member-portal cookie that remembers which membership to show in the browser a Patient used to enroll;
- a short-lived security cookie, lasting up to 30 minutes, that protects the step where a clinic connects its Stripe account; and
- temporary browser storage at the front desk that prevents the same checkout from being charged twice.
9.2 We do not use advertising cookies, cross-site trackers or social media pixels on our sites. Google Analytics receives usage records from our servers (section 4.4) and does not run in your browser or set cookies. Stripe may set its own cookies on its hosted payment pages to prevent fraud, under Stripe's privacy policy.
9.3 Because these cookies are essential, the Service will not work properly if you block them.
10. Security
We protect personal information with safeguards appropriate to its sensitivity, including:
- encryption of information in transit;
- role-based access controls, so front-desk staff, owners and our own team see only what they need;
- row-level separation of each clinic's data in our database;
- signature verification of incoming webhooks from Stripe and Twilio; and
- keeping access to production systems to the people who need it to run the Service.
No system is perfectly secure. If we become aware of a breach affecting personal information in our systems, we will notify affected clinics without undue delay, and we will notify individuals and regulators where the law requires us to. For Patient information, we will work with the clinic so it can meet its own notification obligations.
11. Your rights
11.1 Everyone. Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to withdraw consent to its use (subject to legal and contractual limits), to ask for its deletion, and to complain to a privacy regulator. We will respond within 30 days, or tell you within that time if we need longer as the law allows. We may need to verify your identity first. We will not charge for a reasonable request.
11.2 Canada. In Canada, you can complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy commissioner where provincial law applies. If you are in Quebec, you have rights under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, including rights of access, correction, and, where applicable, portability of information you provided, and the right to be informed of decisions made exclusively by automated processing. Clinicaly does not make decisions about individuals by automated processing alone.
11.3 United States. Residents of some US states, including California, Colorado, Connecticut, Virginia and others, have rights under state privacy laws to know what personal information is collected, to access, correct and delete it, and to opt out of its sale or its use for targeted advertising or profiling. We do not sell personal information or use it for targeted advertising or profiling. We will not discriminate against anyone for exercising their privacy rights.
11.4 Patients. For information held on behalf of a clinic, please make your request to your clinic, as explained in section 6.
12. Children
The Service is for businesses and their adult customers. It is not directed to children, and we do not knowingly collect personal information from children under 13, or under the age of digital consent where you live. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the Service and the law change. If a change is material, we will tell clinics by email at least 30 days before it takes effect and post the updated policy on our website. The effective date at the top of this page shows when it was last updated.
14. Contact us
Matt Topic is responsible for Clinicaly's compliance with this policy and acts as our privacy officer. For privacy questions, requests or complaints, email [email protected]. We will reply as soon as we can, and in any case within 30 days.