Verified Legal & Compliance Document

Privacy Policy

At CliniQNotes, protecting your personal health information is our highest priority. We maintain strict safeguards, transient analysis pipelines, and full statutory compliance.

Last updated: February 2026
~3 min read
India (DPDP Act) & US (HIPAA)

Zero Data Selling

We never sell or monetize your sensitive health records or reports.

Transient AI Analysis

Medical images are deleted immediately after AI extraction completes.

Local Storage (India)

Firestore databases and inference hosted in the Mumbai cloud region.

Complete Deletion

Permanently delete individual reports or your entire account on demand.

1
Scope & Applicability

1. Introduction

CliniqNotes ("we", "our", "the App") is a medical report analysis application. This Privacy Policy explains how we collect, use, and protect your information when you use our App.

2
Data Categories

2. Information We Collect

We may collect the following information:

Account Information: Name, email address, and profile photo when you sign in
Medical Reports: Images of reports you upload or capture for analysis
Analysis Results: AI-generated summaries and findings from your reports
Usage Data: Basic app usage information like report count and account type
3
Processing Purposes

3. How We Use Your Data

Your data is used to:

Analyze your medical reports using AI
Store your report history securely in your account
Process payments for premium features
Improve the app experience and functionality
4
Infrastructure & Safeguards

4. Data Storage & Security

Your data is stored securely in the cloud with industry-standard encryption and security measures. We implement appropriate technical safeguards to protect your personal information from unauthorized access, alteration, or destruction.

Encryption & Protection Standard

All sensitive medical records are protected by strong cryptographic controls during transit (TLS/HTTPS) and securely encrypted at rest within cloud environments.

5
Strict Non-Disclosure & DPAs

5. Data Sharing & Third-Party Processors

We do not sell, trade, or share your personal data or medical reports with any third parties for marketing or advertising purposes.

To operate our services, we share limited personal data with authorized third-party processors who process data strictly on our behalf under signed Data Processing Agreements (DPAs):

Google Cloud / Firebase Signed DPA

Vertex AI: Transiently processes medical images for AI analysis under the Google Cloud Data Processing Addendum.

Razorpay Signed DPA

Securely processes verification and subscription payment transactions under standard merchant payment service agreements.

6
Lifecycle & Erasure

6. Data Retention & Deletion Policy

We retain your data only for as long as necessary to provide our services:

Reports: You can delete any individual report from your History at any time. Deleted reports are permanently removed from our servers and cannot be recovered.
Account Deletion: You can delete your entire account and all associated data from the Settings page. This permanently removes your profile, usage history, and all stored reports.
7
User Autonomy

7. Your Rights

You have the right to:

Access and view all your saved reports
Delete your account and all associated data at any time through the Settings page
Opt out of data collection by discontinuing use of the App
8
Age Limitations

8. Children's Privacy

CliniqNotes is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

9
Updates & Notices

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected in the App with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance of the updated policy.

10
DPDP Act, 2023 Statutory Officer

10. Grievance Redressal Officer (GRO)

In accordance with the Digital Personal Data Protection (DPDP) Act, 2023, you may address any queries, concerns, or grievances regarding the processing of your personal data to our Grievance Officer:

Designation: Grievance Redressal Officer (Privacy & Compliance)
Email Alias: privacy@cliniqnotes.com
Response Timeline: We will acknowledge your grievance within 48 hours and resolve it within the statutory timeline of 30 days.
11
IT Act, 2000 Compliance

11. Data Residency & Processing Localization

Under the Information Technology (IT) Act, 2000, we implement reasonable security practices and procedures for Sensitive Personal Data:

Local Storage: Your personal information, user accounts, and report history database (Firestore) are stored in secure servers physically located within India (Mumbai region).
Local AI Inference: The images of reports uploaded for analysis are processed transiently on Google Cloud Vertex AI servers located within India (Mumbai region). Raw images are deleted automatically immediately after extraction.
12
CERT-In Compliance Channel

12. Vulnerability Reporting & Security Incidents

We take cybersecurity seriously. In compliance with CERT-In directions under Section 70B of the IT Act, 2000, if you discover any security vulnerability, system weakness, or believe a security incident / data breach has occurred, please report it immediately to our security channel at privacy@cliniqnotes.com. We investigate all security issues promptly.

13
United States Regulatory Framework

13. HIPAA Compliance Policy (US Users)

If you are accessing this App from the United States or submit Protected Health Information (PHI) subject to the Health Insurance Portability and Accountability Act (HIPAA):

Technical Safeguards: We enforce end-to-end encryption in transit (HTTPS/TLS) and at rest, secure Firebase App Check to prevent unauthorized API requests, and automatic transient file deletions.
Access Audit Logging: We record a secure, tamper-proof audit trail of all access events (including record creation, viewing, and deletion) within our databases to satisfy HIPAA § 164.312(b) requirements.
Business Associate Agreements (BAAs): We ensure standard BAA clauses are executed with our critical infrastructure partners (Google Cloud Platform and Firebase hosting) for HIPAA compliance.