Privacy policy
Effective date: November 6, 2026.
Who we are
ClinicReveal (“we”, “us”) is an independently operated consultancy based in Vancouver, British Columbia, Canada. We provide business advisory services to independent clinics and practices in Canada and the United States. Privacy questions and requests go to ClinicReveal’s privacy contact at support@clinicreveal.com.
The short version
- We only ask about your clinic’s processes, never about patients. Please don’t enter patient names, health details or anything that could identify a patient.
- Card payments are handled by Stripe. We never see or store your card number.
- We keep a paid Self-Check and its report on the website for 180 days, then delete it. You can delete it sooner yourself, from the report page.
- We send our newsletter, The Reveal, only to people who ask for it, and you can unsubscribe at any time.
- We don’t sell your information, use it for advertising, or share your answers with other clinics.
What we collect, and why
| Information | Why | How long |
|---|---|---|
| Your opening choices (primary specialty, country and city) and your four preview answers, stored only in your browser | So you can continue the preview. They’re sent to us only if you go on to checkout, to start your Self-Check. Please don’t enter patient information anywhere. | Until you clear your browser storage |
| Email address and payment details from Stripe (product, amounts before tax, tax and total, currency, Stripe reference numbers, whether a promotion code was used, and the billing country and state or province used for tax). Stripe collects the full billing address for tax; we don’t store the street address or postal code. | To confirm payment, give you access, send your links and receipt-related messages, and handle refunds and support | With your assessment (see below); Stripe keeps its own records |
| Clinic details: optional clinic name, country, state or province, city, specialty, number of locations, patient mix, main concern, optionally what you think is behind it, inquiry channels, and optional monthly totals | To choose your follow-up questions and write your report | 180 days after purchase |
| Your answers and your report | To build and deliver your report, and let you reopen it | 180 days after purchase, or until you delete them (see “Internal report copies” below) |
| A sign-in cookie (random, HttpOnly) | Strictly necessary: keeps this browser connected to your paid Self-Check | Up to 30 days, or until you sign out |
| Advisory enquiries: clinic name, your name, email, optional phone number, location and the description you write | To reply to your enquiry and discuss Advisory & Implementation. Please don’t include patient information. | 180 days after the enquiry, unless it leads to an engagement (then as set out in the proposal) |
| Newsletter sign-up: your email address, the date and time you signed up, the exact wording you agreed to, and the page you used | To send you The Reveal, and to prove your consent | Until you unsubscribe or ask us to delete it. After you unsubscribe we keep only a minimal record that you opted out, so we don’t email you again. |
| Unpaid or expired checkouts | To finish a purchase you started | 2 days |
| Server and security logs kept by our hosting provider (for example IP address and time of request) | To keep the service secure and working | As set by the hosting provider [confirm period] |
We don’t use advertising cookies or third-party analytics.
Internal report copies
Planned, not yet active: ClinicReveal intends to keep an internal copy of each completed report PDF as a business record. Once that starts, the website’s automatic deletion and the “Delete my answers and report now” button will not remove that copy. You can ask us about it at support@clinicreveal.com.
Emails we send
Service emails. A link to continue after payment (with the amounts paid, including any tax), a “report ready” link, links you request, a Deep Dive confirmation if you add it later, and a notice if a delayed payment fails. These contain a link, your reference number and payment amounts, not your answers or scores. If you send an advisory enquiry, we reply personally by email, and its details (clinic name, your name, email, phone if given, location and your message) are also emailed to ClinicReveal’s own inbox so we can reply.
The newsletter. We may email The Reveal only to people who ticked the box on our website to receive it. That tick is your express consent, it is never pre-selected, and buying a Self-Check does not sign you up. Each issue will say it comes from ClinicReveal, give a way to contact us, and include a working way to unsubscribe. You can also unsubscribe at any time by emailing support@clinicreveal.com, and we act on every request within 10 business days, usually much sooner. We don’t send other marketing emails unless you ask for them.
Who processes data for us
- Stripe (payments, receipts and tax calculation through Stripe Tax)
- Our hosting provider (website hosting, server functions and storage; currently Netlify, and we’ll update this page if that changes)
- Resend (sending service emails and delivering advisory enquiries to ClinicReveal’s inbox)
- Purelymail (ClinicReveal’s business mailboxes, and sending some customer emails)
These providers may store or process information in the United States and other countries, where it may be accessible to courts and authorities under local law.
Your choices and rights
- Delete your answers and report at any time with “Delete my answers and report now” at the bottom of your report.
- Ask us to access, correct or delete your information, or to withdraw a consent you gave (including to the newsletter), by emailing support@clinicreveal.com. We reply within two business days and act within the time the law requires.
- Depending on where you live, you may have further rights under Canadian federal or provincial law or US state law. If you’re in Canada, you may also complain to the Office of the Privacy Commissioner of Canada or your provincial privacy authority; if you’re in the United States, to your state attorney general.
Security
Connections use HTTPS. Access to a paid Self-Check uses a random sign-in cookie that scripts can’t read; we store only a scrambled (hashed) version of it. Email links work once and expire. We collect as little as we can, and delete it on schedule. No system is perfectly secure, so we can’t promise absolute security.
Patient information
The Self-Check is designed to work without patient information. We don’t ask for it and you shouldn’t enter it. ClinicReveal does not claim compliance with HIPAA, PIPEDA or any other health-privacy certification; it’s designed so that such information isn’t needed. If you think patient information was entered by mistake, use “Delete my answers and report now” or email us and we’ll delete it.
Changes
If we change this policy, we’ll update the date above and, for material changes, tell customers with an active Self-Check by email.