Privacy Policy

1. Information We Collect

Account Information. When you create an account we collect your name, email address, professional credentials, organisation name and billing details.

Audio & Clinical Data. When you use the platform, audio recordings of clinical encounters are processed in real time. Audio is immediately and permanently deleted once the clinical note is generated. We never store audio recordings beyond the note-generation process.

Generated Documentation. Clinical notes, transcripts, codes and other outputs generated by ClinixSummary are stored in your account for your access and use. You may export or permanently delete this data at any time.

Usage Data. We collect anonymised usage analytics (feature usage, session duration, error logs) to improve platform performance. This data contains no Protected Health Information (PHI).

2. How We Use Your Information

We use your information to: (a) provide and improve our services; (b) generate clinical documentation from audio input; (c) process billing and manage your subscription; (d) communicate product updates and support responses; (e) comply with legal obligations including healthcare regulations.

We do not use your clinical data, transcripts or audio to train customer-facing AI models. Our models are trained exclusively on de-identified, non-PHI datasets sourced through compliant data partnerships.

3. Data Sharing & Disclosure

We do not sell personal information. We may share data with: (a) sub-processors who assist in service delivery, under strict data processing agreements; (b) law enforcement or regulators where legally required; (c) professional advisors (legal, audit) under confidentiality obligations.

All sub-processors are contractually required to maintain HIPAA and GDPR-equivalent protections. A current list of sub-processors is published on our Trust Center.

4. Data Retention

Audio: Immediately and permanently deleted upon note generation via cryptographic erasure. No audio is ever stored beyond the note-generation process.

Clinical notes & transcripts: Retained in your account until you delete them or close your account. Upon account closure, all data is permanently erased within 30 days.

Account information: Retained for the duration of your subscription plus any period required by applicable tax or regulatory law.

5. Security Measures

We employ industry-standard security measures including: AES-256 encryption at rest; TLS 1.2+ encryption in transit; role-based access controls; comprehensive audit logging; regular penetration testing and vulnerability assessments; SOC 2-aligned processes; and physical security controls at our data-centre partners.

6. Your Rights

Depending on your jurisdiction, you may have the right to: access your personal data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to processing; data portability; and withdraw consent. To exercise any of these rights, contact privacy@clinixsummary.ai.

7. HIPAA Compliance

For users subject to HIPAA, ClinixSummary acts as a Business Associate. We enter into Business Associate Agreements (BAAs) upon request and maintain administrative, physical and technical safeguards as required by the HIPAA Security Rule. We conduct annual risk assessments and maintain breach notification procedures in accordance with the HITECH Act.

8. GDPR Compliance

For users in the European Economic Area (EEA) and the United Kingdom, we process personal data under lawful bases including contract performance, legitimate interest and consent. We have appointed a Data Protection Officer reachable at dpo@clinixsummary.ai. Standard Contractual Clauses are used for any cross-border data transfers.

9. Cookies & Tracking

Our platform uses essential cookies required for authentication and session management. We use anonymised analytics to measure feature adoption. We do not use advertising cookies or third-party behavioural tracking.

10. Children’s Privacy

ClinixSummary is designed for healthcare professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-platform notification at least 30 days before they take effect. Continued use of the service after changes constitutes acceptance.

12. Contact

For privacy-related enquiries, contact our Data Protection Officer at dpo@clinixsummary.ai or write to: GATMEDI Ltd, Privacy Team, United Kingdom.