Privacy Policy

Last updated: 26 October 2026

Clinexa is clinic management software. Clinics use it to keep patient records, book appointments, bill, and talk to patients and enquiries on WhatsApp, Facebook Messenger, Instagram and in comments on the clinic's own YouTube videos. This policy explains what data Clinexa handles, why, and how you can have it deleted.

Who is responsible for your data

Each clinic that uses Clinexa decides what patient data it collects and is responsible for it. Clinexa stores and processes that data on the clinic's behalf, only to provide the service to that clinic. If you are a patient, your clinic is your first point of contact; you can also write to us at [email protected].

What we collect

• Clinic staff accounts: username, role and the actions each user takes in the system (kept as an audit log).
• Patient records entered by the clinic: name, contact details, appointments, clinical notes, prescriptions, photos, files and invoices.
• Messages from WhatsApp, Facebook Messenger and Instagram: when someone messages a clinic that has connected its WhatsApp number, Facebook Page or Instagram account to Clinexa, we receive the sender's name as shown on that platform, their platform user ID or phone number, the message text, any photos, files or voice notes they send, the time, and — if they came from an advert — which advert it was.
• Comments on the clinic's YouTube videos: when a clinic connects its own YouTube channel, we receive comments posted on that channel's videos: the commenter's display name and YouTube channel ID, the comment text, the video it was left on, and the time.

How we use it

• To show the conversation to that clinic's staff so they can read and reply from Clinexa.
• To list new enquiries for the clinic and, if the clinic chooses, add a message, photo or file to the patient's record.
• To send messages the clinic asks us to send, such as appointment reminders and aftercare instructions.

We do not sell data, use it for our own advertising, or share it with other clinics. Each clinic sees only its own patients and messages.

Data we receive from Meta's platforms (WhatsApp, Facebook Messenger, Instagram) is used only for the purposes above, in line with the Meta Platform Terms. We do not sell, license or buy it; use it for advertising, surveillance or to build profiles of people; use it to discriminate against anyone or to decide their eligibility for housing, employment, insurance, credit, benefits or immigration; or transfer it to data brokers.

We delete this data promptly when the person it is about or Meta asks us to, and when it is no longer needed to provide the service to the clinic.

YouTube API Services

Clinexa uses YouTube API Services. By connecting a YouTube channel to Clinexa, the clinic agrees to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.

• What Clinexa reads: the connected channel's name and ID, and the comments left on that channel's own videos (as listed above). It does not read the clinic's other Google data, private videos, analytics or subscribers.
• What Clinexa writes: only the public replies that the clinic's staff write and choose to send from Clinexa. Clinexa never posts on YouTube by itself.
• Why: so the clinic's reception can answer questions left in YouTube comments from the same inbox as its other messages.
• What we store, and for how long: the comments and replies, as part of the clinic's messages, for as long as the clinic uses Clinexa (see "How long we keep it"); and the access tokens Google issues, encrypted, until the clinic disconnects YouTube.
• Sharing: YouTube data is shown only to that clinic's staff. We do not sell it, use it for advertising, or share it with anyone else except where the law requires.
• Revoking access: the clinic can disconnect YouTube at any time in Clinexa (Settings → Messaging → Connections → YouTube → Disconnect), which deletes the stored tokens, or revoke Clinexa's access from its Google Account at myaccount.google.com/permissions. To have stored comments deleted, see how to delete your data.

Clinexa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

Only the service providers needed to run Clinexa, each bound to use the data only for that purpose:

• Meta (WhatsApp, Facebook Messenger, Instagram) — to receive and deliver the clinic's messages.
• Google (YouTube API Services) — to receive comments on the clinic's videos and post the clinic's replies.
• Our hosting and network providers — to store data and serve the application.
• Stripe — to bill clinics for their Clinexa subscription (no patient data).

We may also disclose data where the law requires it.

How we protect it

• All connections use HTTPS.
• Each clinic's data is kept separate at the database level.
• Staff see only what their role allows, and access to patient records is logged.

How long we keep it

Data is kept for as long as the clinic uses Clinexa, as part of the clinic's records. When a clinic stops using Clinexa, or when a valid deletion request is received, we delete the data, except where the clinic must keep medical records by law.

Your choices and deleting your data

You can ask for a copy of your data, a correction, or deletion. See how to delete your data, or email [email protected].

Changes

If we change this policy we will update this page and the date above.