Privacy Policy
Last Updated: June 28, 2026
Introduction
ClinicAI ("we," "our," or "us") provides AI-powered medical record analysis services for legal professionals. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website (getclinicai.com) and services.
By using ClinicAI, you agree to the terms of this Privacy Policy.
Information We Collect
Information You Provide
- Account Information: Name, email address, organization name, and role when you register or contact us.
- Medical Records: Documents you upload for analysis, which may contain Protected Health Information (PHI) including patient names, dates of birth, medical histories, diagnoses, and treatment information.
- Payment Information: Billing details processed through our payment provider (Stripe). We do not store full credit card numbers.
- Communications: Messages you send us via email or chat.
Information Collected Automatically
- Usage Data: Pages visited, features used, time spent on the platform, and analysis requests.
- Device Information: Browser type, operating system, IP address, and device identifiers.
- Cookies: We use cookies and similar technologies to maintain sessions and improve functionality. See "Cookies" section below.
How We Use Your Information
We use collected information to:
- Provide and improve our medical record analysis services
- Process and analyze documents you upload
- Communicate with you about your account and our services
- Process payments and maintain billing records
- Ensure security and prevent fraud
- Comply with legal obligations
- Generate anonymized, aggregated analytics to improve our platform
AI Processing and Third-Party Services
Anthropic (Claude AI)
Medical records you upload are processed using Anthropic's Claude AI API with their HIPAA-ready offering. We have executed a Business Associate Agreement (BAA) with Anthropic to ensure HIPAA-compliant handling of Protected Health Information. For details on Anthropic's security practices, see their Trust Center.
- Anthropic processes data solely to provide analysis results
- Anthropic does not use your data to train AI models
- Data is encrypted in transit and at rest
- Zero data retention is enabled for PHI processing
Infrastructure Providers
We use the following service providers to operate ClinicAI:
- Supabase: Secure database hosting (encrypted, SOC 2 compliant)
- Netlify: Website hosting
- Stripe: Payment processing (PCI-DSS compliant)
All providers are selected for their security practices and, where applicable, HIPAA compliance capabilities.
Data Security
We implement industry-standard security measures including:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure database access controls with row-level security
- Audit logging of all data access
- Regular security assessments
- Limited employee access on a need-to-know basis
While we strive to protect your information, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.
Data Retention
- Medical Records: Analysis results are retained for as long as your account is active or as needed to provide services. Original documents may be deleted after processing unless you choose to retain them.
- Account Information: Retained while your account is active and for a reasonable period thereafter for legal and business purposes.
- Audit Logs: Retained for a minimum of 6 years to comply with HIPAA requirements.
You may request deletion of your data by contacting us at travis@getclinicai.com.
HIPAA Compliance
ClinicAI is designed to support HIPAA compliance for legal professionals handling medical records:
- We maintain administrative, physical, and technical safeguards
- We execute Business Associate Agreements (BAAs) with clients upon request
- We execute BAAs with our subcontractors (Anthropic, Supabase)
- We maintain audit logs of all PHI access
- We provide secure data handling and encrypted storage
Note: Law firms are generally not "covered entities" under HIPAA, but may have obligations under attorney-client privilege and state bar rules. ClinicAI provides tools to help you meet your professional obligations.
Cookies
We use cookies and similar tracking technologies to:
- Maintain your session and authentication state
- Remember your preferences
- Analyze usage patterns to improve our services
- Enable chat functionality
Types of Cookies
| Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, security | Session |
| Functional | Preferences, chat widget | 1 year |
| Analytics | Usage patterns | 1 year |
Your Choices: Most browsers allow you to refuse cookies or alert you when cookies are being sent. Disabling cookies may affect functionality.
Your Rights
Depending on your jurisdiction, you may have the right to:
- Access: Request a copy of your personal information
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your personal information
- Portability: Receive your data in a portable format
- Opt-Out: Opt out of certain data uses
California Residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.
To exercise these rights, contact us at travis@getclinicai.com.
Children's Privacy
ClinicAI is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
ClinicAI
Email: travis@getclinicai.com
Website: https://getclinicai.com
Business Associate Agreement
If you require a Business Associate Agreement (BAA) for HIPAA compliance purposes, please contact us at travis@getclinicai.com to request one.