Privacy policy | Clinica World

1. Information We Collect

Patients: Name, email, phone number, appointment history, and health preferences.

Providers: Name, email, phone, medical license details, specialty, clinic information, and uploaded documents (license copies).

Automatically: Device information, IP address, browser type, and usage analytics.

2. How We Use Your Data

To facilitate appointment bookings between patients and providers
To verify healthcare provider credentials
To send appointment confirmations, reminders, and updates
To improve our platform and user experience
To comply with UAE healthcare regulations

3. Data Sharing

We do not sell your personal data. We share information only with:

Healthcare providers you book appointments with (relevant contact and appointment details)
Service providers who help us operate the platform (hosting, email, analytics)
Regulatory authorities when required by UAE law

4. Data Security

We use industry-standard security measures including encryption in transit and at rest, access controls, and regular security audits to protect your data. However, no system is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Medical records and appointment history may be retained longer as required by UAE healthcare regulations. You can request account deletion at any time.

6. Your Rights

Access and download your personal data
Correct inaccurate information
Request deletion of your account and data
Opt out of marketing communications
Withdraw consent for data processing

7. Cookies

We use essential cookies for authentication and session management. Analytics cookies help us understand how users interact with the platform. You can manage cookie preferences in your browser settings.

8. Children's Privacy

Clinica is not intended for users under 18. We do not knowingly collect data from minors. Parents or guardians may create accounts on behalf of their children for booking purposes.

9. Google Calendar Integration (for Doctors)

Clinica provides doctors with the option to connect their Google Calendar to the Clinica platform. This integration is voluntary and is activated only after the doctor signs in to their Google Account and expressly authorises Clinica to access the requested Google Calendar permissions.

9.1 What Clinica Accesses

With the doctor's authorisation, Clinica may access the availability information (free/busy status) of the Google Calendars selected by the doctor, including only the start and end times of periods marked as busy.

Clinica's purpose is to know only whether a doctor is available or busy. Clinica does not access, read, display or use the content of the doctor's calendar events. In particular, Clinica does not access event titles, descriptions, attendees, locations, notes, attachments or other event content.

Clinica may also access the list of calendars associated with the authorised Google Account, including calendar names and identifiers, so that the doctor can select which calendars should be considered when determining availability.

Clinica may create and manage a separate calendar named “Clinica” within the doctor's Google Account for Clinica bookings. This does not give Clinica access to the content of the doctor's other calendars.

9.2 How Availability Information Is Used

Clinica uses free/busy information solely to identify periods during which the doctor is unavailable and to block those periods in the doctor's Clinica schedule. As a result, patients using the Clinica application or website will not be offered appointment times during periods identified as busy in the calendars selected by the doctor.

Clinica may refresh the doctor's availability approximately every five minutes and may also check availability with Google at the time of booking in order to keep the Clinica schedule accurate.

Clinica does not need to know why the doctor is busy, what the doctor is doing, who the doctor is meeting, or any other information contained in the doctor's Google Calendar event.

9.3 Google Calendar Data We Store

Subject to applicable law, Clinica may store the email address of the connected Google Account, the names and identifiers of calendars selected by the doctor, free/busy periods for the next 30 days consisting only of relevant start and end times, encrypted Google access tokens required to maintain the authorised connection, and records of connection and disconnection dates and related technical or support information.

Clinica does not intentionally store the contents of events from the doctor's selected calendars.

9.4 Clinica Calendar

Clinica may create a separate calendar named “Clinica” in the doctor's Google Account and add Clinica booking events to that calendar. These events may contain booking information necessary for the doctor to manage Clinica appointments, such as the patient's first name, service, clinic, appointment time, booking link and reminder.

The doctor may access and manage this calendar through their Google Account. The doctor is responsible for the sharing settings of their Google Calendar and should ensure that access is provided only to persons they authorise.

9.5 Who Can See Availability Information

Clinic administrators may see that the doctor's calendar integration is active and whether relevant periods are marked as busy for the purpose of managing Clinica availability. They are not provided through Clinica with the content of the doctor's personal Google Calendar events.

Authorised Clinica operations and support personnel may access the connected Google Account identifier, selected calendar information and connection status where reasonably necessary to provide technical support, administer the integration, investigate security issues or comply with applicable law.

9.6 Service Providers

Clinica may use trusted service providers, including Google for Google Calendar API services, Supabase for hosting and database infrastructure, and Infobip for certain communications services. Such providers may process personal data only to the extent necessary to provide their contracted services and subject to appropriate contractual, technical and organisational safeguards.

Where personal data is transferred or processed outside the United Arab Emirates, Clinica will apply the requirements and safeguards applicable under UAE law, including applicable requirements governing cross-border transfers of personal data and, where relevant, healthcare information.

9.7 Security

Clinica implements appropriate technical and organisational measures designed to protect personal data and Google user data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing. Google access tokens are stored using encryption and are used only to maintain the authorised Google Calendar connection. Access is restricted according to applicable access controls and operational requirements.

9.8 Retention and Deletion

Clinica retains Google Calendar information only for as long as reasonably necessary to provide the integration, maintain the connection, provide support, comply with applicable legal obligations, and protect Clinica's legal and security interests.

When the Google Calendar connection is disconnected, Clinica will delete stored free/busy information and access tokens associated with the connection, subject to any retention required by applicable law or reasonably necessary for security, dispute resolution, fraud prevention, auditing, or the establishment, exercise or defence of legal claims.

Clinica will revoke its authorised access to the doctor's Google Account where technically available through the applicable Google API. Future Clinica booking events may be removed from the Clinica calendar following disconnection where technically supported. Past events and the Clinica calendar itself remain in the doctor's Google Account unless and until the doctor deletes them.

9.9 Disconnecting the Integration and Withdrawing Consent

The doctor may disconnect the Google Calendar integration at any time by requesting disconnection through the relevant clinic, contacting Clinica support, or removing Clinica's access through the doctor's Google Account security settings.

The connection may also end where the relevant clinic requests disconnection, Clinica disconnects the integration for an appropriate operational or security reason, or the doctor is no longer associated with any clinic using the Clinica integration.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

9.10 Data Protection Rights

Subject to applicable UAE law, doctors may have rights in relation to their personal data, including rights to request access to, correction of, deletion of, or restriction of processing of their personal data, together with other rights available under applicable data-protection legislation. Requests concerning the Google Calendar integration may be submitted using the contact details provided in the “Contact Us” section of this Privacy Policy. Clinica may take reasonable steps to verify the identity of the requester.

9.11 What Clinica Does Not Do With Google User Data

Clinica does not sell Google user data.
Clinica does not use Google user data for advertising or targeted advertising.
Clinica does not transfer Google user data to data brokers or information resellers.
Clinica does not use Google user data to create, train or improve artificial intelligence or machine-learning models.
Clinica does not use Google user data for purposes unrelated to the Google Calendar functionality described in this section.
Clinica does not read the content of the doctor's personal Google Calendar events, including titles, descriptions, attendees, locations, notes or attachments.

9.12 Google Limited Use Requirement

Clinica's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Clinica will limit its access to and use of Google user data to the permissions and purposes expressly described in this Privacy Policy and the corresponding user authorisation.

9.13 Patient Information in the Doctor's Google Calendar

If a doctor has connected Google Calendar to Clinica, limited appointment information may be added to the doctor's dedicated “Clinica” Google Calendar. This may include the patient's first name, the service booked, the clinic name and the appointment time, together with a booking link and reminder. This information is made available to the doctor through the doctor's Google Account and may be accessible to persons with whom the doctor has chosen to share that calendar.

10. Changes to This Privacy Policy

Clinica may update this Privacy Policy from time to time to reflect changes in its services, applicable law, regulatory requirements or data-processing practices. Where Clinica proposes to access, use, store or share Google user data in a materially different manner from that described in this Privacy Policy, Clinica will update this Privacy Policy and, where required, obtain the appropriate user authorisation before implementing the new processing.

11. Contact

For privacy inquiries or data requests, contact our Data Protection Officer at privacy@clinica.ae.