ClinivaAI legal
Consumer Health Data Privacy Policy — Cliniva AI
How Cliniva AI handles consumer health data in the website analytics tool it provides to clinics.
Document details
This policy describes how Cliniva AI ("Cliniva") handles consumer health data. It is written to satisfy the Washington My Health My Data Act, Nevada SB 370, and the consumer health data provisions of the Connecticut Data Privacy Act.
1. Our role and scope
Service provider to clinics. Clinics use Cliniva software on their own websites to count visits and attribute bookings to outreach campaigns. When we do this, we act only on the clinic's instructions under contract, and the clinic's own consumer health data privacy policy governs.
Our own marketing website. This policy applies to the analytics Cliniva provides on clinic websites. It does not apply to clinivaai.com, which is covered by our Privacy Policy. If we ever use the clinic analytics mode on clinivaai.com or otherwise collect consumer health data there, we will update this policy and provide any required notice and consent before collection.
2. Consumer health data we collect
Analytics counts (with your consent). If you accept the consent prompt on a site that uses Cliniva, your visit is added to anonymous counts: pages viewed per hour, visits per outreach campaign per day, funnel steps, scroll milestones, outbound link clicks, and bookings started or completed per campaign per week. These counts contain no name, IP address, device identifier, session identifier, user agent, or advertising click ID. Once added, a count cannot be linked back to you.
Consent choice. Your accept or decline choice is stored only on your device (a cookie or local storage), never on our servers in a form tied to you. Consent is remembered for 12 months and a decline for 30 days; we ask again when the choice expires or the prompt text changes. The stored value records only the choice, its date, and the prompt version.
Standard server logs (no consent required; not analytics). As with any website, our load balancer records your browser type, the time, and the site domain for every request — including the request that checks whether to show you the consent prompt. Requests reach us through Amazon CloudFront, so the address our logs record is CloudFront’s, not yours. These logs are encrypted, used only for security and operations, and deleted within 90 days.
Pending booking records (clinics booking through Cliniva only). To credit a deposit booking when payment settles, we hold a hashed booking reference with its campaign for at most 7 days. The hash cannot be reversed to a person in our analytics system.
3. What we never collect
We never collect or store, in analytics: your name, email, IP address, device ID, precise location, search queries, page URLs tied to you, or the content of any form you complete. We never use tracking cookies, fingerprinting, or cross-site identifiers.
4. Purposes
Counts are used for one purpose: showing the clinic how visitors reach and use its pages and which outreach campaigns lead to bookings. We do not use consumer health data for advertising profiles, we do not combine it across clinics, and we do not use it for our own marketing.
5. Sharing and sale
We do not sell consumer health data, and we do not share it with third parties. Counts are visible only to the clinic's administrators and to Cliniva platform administrators under access controls and audit logging. Our hosting subprocessor is Amazon Web Services, under a business associate agreement.
6. Retention
- Analytics counts: deleted within 90 days by an automated job.
- Pending booking records: deleted within 7 days.
- Server logs: deleted within 90 days.
- Your consent choice stays on your device: consent for 12 months, a decline for 30 days.
7. Your rights
Under Washington, Nevada, and Connecticut law you have the right to:
- Confirm and access the consumer health data we hold about you;
- Delete consumer health data concerning you;
- Withdraw consent to future collection at any time;
- Appeal our response to a request.
To exercise any right, contact us at privacy@clinivaai.com or 8735 Dunwoody Pl, Ste R, Atlanta, GA 30350.
How this works given our design:
- Withdrawal: use the Privacy choices link on the site where you consented. It stops all future counting immediately.
- Access and deletion of counts: our analytics counts contain no identifier, so there is no record we can retrieve or delete "about you." Withdrawal is the effective remedy and is always available.
- Server logs: if you make a verified request, our logs record CloudFront’s address rather than yours, so there is no entry we can match to you. They are deleted within 90 days.
We will respond to requests without undue delay and within the period your state's law requires (45 days under Connecticut and Nevada law, with one permitted extension). If we deny a request, you may appeal by replying to our response; we will decide appeals within the statutory period (60 days in Connecticut; 45 days in Nevada) and tell you how to reach your state attorney general if the appeal is denied.
8. Changes
If we change this policy, we will post the new version here with a new effective date. If a change expands what we collect, we will ask for your consent again.
9. Contact
Cliniva AI · 8735 Dunwoody Pl, Ste R, Atlanta, GA 30350 · privacy@clinivaai.com