Privacy Policy
Last updated September 30, 2026
Clinvite is referral software used by Canadian clinics. This policy explains what we collect, why, and what you can do about it. It covers three groups of people: clinic staff who use the dashboard, patients who scan a clinic's QR code, and friends who open an invite.
What we collect
| Who | What | Why |
|---|---|---|
| Patients who scan | First name. Mobile number only if the clinic offers rewards to patients. | To put your name on the invite you send, and so the clinic can match your reward. |
| Friends who claim an invite | First name, mobile number, and whether you agreed to be contacted. | To create your visit pass and, only if you agreed, so the clinic can contact you about booking. |
| Clinic staff | Name, work email, password (stored as a one-way hash), activity in the dashboard. | To run your account and keep an audit trail. |
| Everyone | Basic technical data such as IP address, used for security and abuse prevention. | To keep the service safe. |
We never collect health information, treatment details, or anything about why someone visits a clinic.
How invites are sent
Clinvite does not send text messages to friends. When a patient taps iMessage, WhatsApp or share, their own phone opens with the invite written, and the patient chooses who to send it to. We do not see their contacts.
Who sees your information
The clinic you interacted with sees the information above for its own location. Clinvite staff access it only to provide support or keep the service secure. We do not sell personal information and we do not use it for advertising.
Service providers that process data for us: Cloudflare, Inc. (hosting and database), Resend (email to clinic staff only), and Stripe (billing for clinics only). See our Security page for the full list.
Where it is stored
Data is stored with Cloudflare in North America and encrypted in transit and at rest. Some providers may process data outside Canada. When that happens, the data is protected by contract and remains subject to the laws of the country where it is held.
How long we keep it
Patient and friend records with no activity for 24 months are deleted automatically. A clinic can delete any record sooner from its dashboard. When a clinic closes its account, its records are deleted within 30 days.
Your choices
- Ask the clinic, or us at hello@clinvite.ca, to see, correct or delete your information.
- If you agreed to be contacted by a clinic, you can tell the clinic to stop at any time.
- You can complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner.
Clinics are in charge of their patients' data
For patient and friend information, the clinic decides how it is used and Clinvite processes it on the clinic's behalf. Our Data Processing Agreement sets out those terms.
Contact
Privacy questions: hello@clinvite.ca.