What we do for clinics
- Request current hosting regions and applicable transfer documentation before processing patient data.
- Row-level isolation for clinic-scoped patient records.
- Signed Data Processing Agreement available for every paying clinic.
- Sub-processor list maintained transparently in our Privacy Policy.
- Tooling for data subject access, rectification, and erasure requests.
- The clinic, as controller, assesses any required supervisory notification within 72 hours of awareness. As processor, Clincue must notify the clinic without undue delay as set out in the DPA.
What we expect from clinics
- Inform patients that an AI receptionist may answer first.
- Ask patients not to share clinical or sensitive data via chat.
- Keep the knowledge base accurate and free of patient identifiers.
- Use the dashboard's role and access controls.
Sub-processors
We use a short, vetted list of sub-processors — see the Privacy Policy for details. Any change is announced before it takes effect.
Request access, correction or deletion
Clinic account users can contact privacy@clincue.com. Patients should contact their clinic first. Provide enough information to identify the account, but do not send passwords or medical records. Requests are normally addressed within one calendar month, subject to identity verification and lawful extensions. You may complain to the UK ICO or your relevant EU supervisory authority.
Get the DPA
The full Data Processing Agreement applies automatically to every paid account. Contact legal@clincue.com for a countersigned copy.