Privacy Notice

1. Scope and roles

This notice covers the OpsClinica website and platform. A clinic that uses OpsClinica normally decides why and how it handles its patient information. In that relationship, the clinic is generally the data controller (or equivalent) and OpsClinica acts as its service provider or processor. OpsClinica may act independently for its own account, billing, security, support, and website information.

2. Information the platform processes

Depending on the features a clinic enables, the platform can process:

• Clinic-owner and staff account, role, authentication, and security information.
• Patient contact details, date of birth, appointment details, service selection, and waitlist preferences.
• Patient intake details, cancellation reasons, consent selections, typed signatures, and secure messages.
• Subscription, transaction, support, device, IP-address, and security-audit information.

3. Why information is used

OpsClinica uses information to provide booking, intake, consent, appointment management, reminders, patient portal, messaging, staff access, billing, support, security, and platform-improvement services. Clinics remain responsible for ensuring they have the notices, permissions, and legal basis needed for their patient workflows.

4. Service providers and disclosures

The platform may use providers for hosting and databases, email delivery, authentication, payment processing, security, and support. The platform is hosted on Render, with its database deployed in Singapore (Southeast Asia). The public website also uses Vercel and Google Analytics for website operation and measurement. See the Subprocessors page for the current operational list. Current integrations may include PayPal for subscriptions, Google for account sign-in where enabled, and SMTP or Resend for email delivery. See the Subprocessors page for the operational list that must be confirmed before production launch.

5. Security and retention

The application includes role-based access, privileged-account 2FA, throttling, security logging, encrypted sensitive fields, and appointment-management links. Subject to the clinic agreement and applicable law, data associated with an expired clinic subscription may be marked for deletion after 90 days. Before scheduled deletion, OpsClinica will email the clinic owner and provide an opportunity to export its data. A paid data-retrieval request may be available after that period, where data remains recoverable and lawfully available. Access and retention remain limited to what is necessary for the applicable clinic agreement and legal requirements.

6. Requests and contact

Patients should normally contact their clinic first for access, correction, deletion, or consent questions. Clinic customers and other individuals can use the Privacy Requests page. For platform privacy or security questions, contact Ziloah Solutions at support@opsclinica.com. OpsClinica is based in Mintal, Davao City, Philippines. A country-specific representative may be appointed where required.