← Back to Klinical

Privacy Policy

Last updated: October 18, 2026

Who we are

Klinical (klinical.app) is a practice management tool for therapists and clinics: scheduling that syncs with Google and Outlook calendars and adds sessions to Apple Calendar, booking pages and links, secure video sessions (built in or through Zoom), intake and consent forms, measures, a client portal, notes and documents, and invoicing and payments. This policy explains what information we collect and how we use it.

Information we collect

  • Account information — your name and email address when you sign up, handled by our authentication provider (Clerk). Clients who use the client portal sign in through Clerk too, with their email address; Clerk keeps their sign-in history.
  • Google account data — if you connect your Google Calendar, we store the email address of the connected account and an encrypted token that lets the app read your calendar availability and create or cancel appointment events. We do not access any other Google data.
  • Apple Calendar credentials — if you connect Apple Calendar, we store your Apple ID email and an app-specific password you generate, both encrypted at rest. These are used only to create and cancel appointment events in your calendar. We do not access any other Apple account data. You can disconnect Apple Calendar at any time from Settings, which deletes the stored credentials.
  • Microsoft account data — if you connect your Outlook Calendar, we store the email address of the connected account and an encrypted token that lets the app read your calendar availability and create or cancel appointment events. We do not access any other Microsoft data. You can disconnect Outlook Calendar at any time from Settings, which deletes the stored token.
  • Practice data — client names, contact details, appointment times, invoice details, notes, intake and consent forms, measure responses, and portal messages that you or your clients enter into the app.
  • Booking requests and workshop sign-ups — when someone who isn't a client yet asks for a session on a clinician's booking page, or signs up for a workshop, we collect the name, email address and (if given) phone number they enter, and for a booking request any message they add and the session, time and format (video, phone or in person) they asked for. The clinician approves or declines a booking request (one left unanswered expires after 3 days); an approved request becomes a booked session in the clinician's records. Signing up for a paid workshop makes someone new a client, with an invoice for the workshop.
  • Client documents — files that clinicians upload to a client's record, or that clients upload through the client portal (for example intake forms or reports). These are held in private, access-controlled storage as described under "How we protect your data".

How we use Google user data

Klinical's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use your Google Calendar access only to:

  • read your free/busy availability so clients can book open time slots,
  • create calendar events when an appointment is booked, and
  • update or remove those events when an appointment changes or is cancelled.

We never sell Google user data, never use it for advertising, and never share it with third parties except as needed to provide the service. You can disconnect your Google Calendar at any time from Settings, which deletes the stored token.

Where your data is stored

Klinical's own server, database, uploaded documents and backups are in Canada, with DigitalOcean (Toronto) and Amazon Web Services (Montreal). Our video server is in Canada too, and our email is sent from Canada through Microsoft Azure. We follow the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA).

Some information does leave Canada, through these services:

  • Clerk (United States), for sign-in: clinicians' names and email addresses, and the email address of each client who uses the client portal, with their sign-in history. Clerk also emails sign-in codes.
  • Stripe (United States), for clinics that take card payments: the client's name and email address, each invoice's session date and type, and the card details typed into Stripe's payment page.
  • Sentry (United States): error reports, scrubbed before they leave our servers as described under "Third-party services".
  • Google, Microsoft and Apple calendars, only if a clinician connects one: each session is copied into the clinician's own calendar with the client's name and email address, the time, and the video link or in-person address. These providers often keep calendars in the United States.
  • Zoom, only if a clinician connects it: each meeting is titled with the client's name, and the session runs in the clinician's own Zoom account, wherever that account keeps its data.
  • Amazon Web Services' website firewall and content delivery network: every visit to Klinical passes through it, by way of an AWS location near the visitor, which can be outside Canada.
  • Cloudflare: a bot check can run in the browser on sign-in pages and on the public booking and workshop sign-up forms. It sees the visitor's browser and IP address, not client records.
  • Twilio (United States), only if text reminders are turned on: the client's mobile number and the reminder text.

Information held outside Canada is subject to the laws of the country where it is held.

How we protect your data

We treat the information in Klinical — including client personal and health information and any Google account data you connect — as sensitive, and protect it with the following data-protection mechanisms:

  • Encryption in transit. All data is transmitted over encrypted connections using HTTPS/TLS.
  • Encryption at rest. Sensitive personal and health information, and all third-party credentials and tokens — including the access token for a connected Google Calendar — are encrypted at rest using AES-256-GCM.
  • Key management. Encryption keys are protected using envelope encryption managed by a cloud key-management service (AWS KMS). Keys are unwrapped only in memory at runtime and are never stored in plaintext alongside the data they protect.
  • Tenant isolation and access control. Database row-level security ensures each clinic can access only its own data. Application credentials follow the principle of least privilege, and application secrets are held in a dedicated secrets manager rather than in source code.
  • Network protection. Traffic is served through a web application firewall with DDoS mitigation, and servers are firewalled with automated intrusion prevention to restrict access.
  • Rate limiting and abuse protection. Public-facing endpoints are rate-limited to mitigate automated abuse and brute-force attempts.
  • Private document storage. Uploaded client documents are kept in a private, access-controlled storage bucket in Canada that is never publicly readable. Files can be reached only through short-lived, signed links generated for signed-in, authorized users, and document names are encrypted at rest.
  • Browser-level safeguards. Our pages are served with hardened security headers — including a Content-Security-Policy and a Permissions-Policy — that prevent our pages from being embedded in other websites and restrict sensitive browser features such as camera, microphone, and screen sharing to the video-session pages that need them.
  • Backups. Backups — including uploaded documents — are kept in private, access-controlled storage.

Your connected Google Calendar access token is used only to create, read, and manage the appointment events you book through Klinical. You can revoke it at any time by disconnecting Google Calendar in Settings or from your Google Account permissions, which immediately deletes the stored token.

Video sessions

By default, video sessions run on Klinical's own video server, hosted in Canada on Amazon Web Services. Session audio and video are encrypted in transit and pass through that server to reach each participant; they are not sent to an outside video provider. Klinical does not record calls, so no audio or video is stored. If the in-call whiteboard is used, its drawings are saved, encrypted, so the board reopens at the next session with the same client.

A clinician can optionally connect their own Zoom account in Settings. Sessions they book then take place as Zoom meetings in that clinician's Zoom account (unless the clinician keeps Klinical's built-in video for a particular client), subject to Zoom's Privacy Statement and the clinician's own Zoom settings. Klinical stores only the meeting ID and join link for each session, plus the encrypted connection tokens for the clinician's Zoom account — never meeting audio, video, recordings, chats, or participant data. Disconnecting Zoom in Settings (or removing Klinical from the Zoom account) immediately deletes the stored tokens.

Third-party services

We rely on a small number of service providers to run Klinical:

  • Clerk — sign-in and account management
  • Google Calendar API — calendar sync, as described above
  • Microsoft Outlook Calendar — calendar sync, if connected, as described above
  • Apple CalDAV — adds booked sessions to Apple Calendar using Apple's CalDAV protocol, with an app-specific password you control. Credentials are encrypted at rest and used only to manage your appointment events.
  • Stripe — payment processing for invoices. When a client pays an invoice, payment details are handled directly by Stripe and are subject to Stripe's Privacy Policy. We do not store full card numbers.
  • Zoom — optional, per-clinician video provider, as described above. Used only when a clinician connects their own Zoom account.
  • Microsoft Azure Communication Services — transactional email delivery (booking confirmations, reminders, invoices). Emails it sends, such as booking confirmations and reminders, record when they are opened or a link in them is clicked, so the clinician can see the message arrived.
  • Twilio — text-message (SMS) appointment reminders, if text reminders are enabled
  • Sentry — error monitoring, so we can detect and fix problems quickly. Before a report leaves our servers we strip out cookies, form contents and the details in web addresses, leaving technical details such as the type of error and where in the code it occurred. An error message can occasionally still quote a fragment of data.
  • DigitalOcean — Canadian-region cloud infrastructure that hosts the app and the private, access-controlled storage for uploaded client documents
  • Amazon Web Services (AWS) — the video server in Canada, the website firewall and content delivery network in front of the app, secret and key management, and an offsite backup copy
  • Cloudflare — bot checks that can run on sign-in pages and on the public booking and workshop sign-up forms
  • Microsoft 365 — our support mailbox (support@klinical.app), hosted in Canada
  • Zoho Mail — our support mailbox until October 13, 2026, hosted in Canada. It still holds the support emails from before then, and receives mail sent to our former address, support@clinify.ca.

Data retention and deletion

We keep your data for as long as your account is active. If you delete your account or ask us to, we delete your data, including any stored calendar and video-provider credentials. Disconnecting Google Calendar, Apple Calendar, Outlook Calendar, or Zoom in Settings immediately removes the stored credentials.

Your rights

You may request access to, correction of, or deletion of your personal information at any time, and you may withdraw consent for optional integrations (calendars, Zoom) by disconnecting them in Settings. To exercise any of these rights, contact us at the address below — we respond to every request.

Contact

For privacy questions or data deletion requests, contact us at support@klinical.app.