Privacy Policy

This Privacy Policy explains how Softlab Software Solutions Limited, trading as ClinicPro (“we”, “us”), collects, uses, shares and protects personal data when you use our website, web app and mobile apps (the “Service”). We handle personal data in line with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018.

Softlab Software Solutions Limited is a company registered in Ireland (CRO 792876), with its registered address at Kilcash, Rahara, Co. Roscommon, F42 TW60, Ireland. Contact: [email protected].

1. Our two services, and who is responsible for your data

We run two services. Who decides how your data is used (the “controller”) depends on which one you use and on your role in it.

ClinicPro — the patient app and online practitioners

• Your ClinicPro account. We are the controller of your account, bookings, payments made through the platform, messages, medication reminders and anything you add to your own dossier.
• Online consultations. The practitioner who treats you is an independent healthcare professional. They are the controller of the clinical record of that consultation (notes, prescriptions, referrals, certificates) and are bound by professional confidentiality. We host and deliver those records for them, and we show them to you in your dossier.
• Practitioners. We are the controller of the data practitioners give us to join and use the platform (identity, professional registration, payout set-up and fees).

ClinicPro+ — software for clinics

• Patients of a clinic. When a clinic uses ClinicPro+ to manage its patients, records, appointments, invoices, documents and video consultations, the clinic is the controller of that data. We act only as the clinic’s processor: we store and process the data on the clinic’s documented instructions, under a Data Processing Agreement (GDPR Article 28), and we do not use it for our own purposes.
• Clinic accounts. We are the controller of the data we need to run the clinic’s subscription: the clinic’s details, the names and emails of its staff logins, billing and invoices, and usage and security records.
• If your clinic links you to the ClinicPro app. The clinic remains responsible for its own clinical record. Information the clinic chooses to release to you (for example a report or result) is then shown in your ClinicPro account, which we are responsible for as described above.

If you are a patient of a clinic that uses ClinicPro+, please read your clinic’s own privacy notice and contact the clinic first about your data (see section 8).

2. What data we collect

• Account details — name, email, phone number, date of birth and login credentials (passwords are stored only as a one-way hash).
• Health data — information you or your practitioner or clinic add: consultations, notes, prescriptions, referrals, lab and imaging results, certificates, allergies, medications and adherence records. This is “special category” data under GDPR Article 9 and receives extra protection.
• Booking and consultation data — appointments, consultation type (in person, video, phone, messaging) and related messages.
• Payment data — handled by our payment provider, Stripe. Card details are entered directly with Stripe; we do not see or store full card numbers.
• Practitioner and clinic data — professional registration, clinic details, staff logins and roles, subscription and invoice records.
• Technical data — IP address, device and browser information, push-notification tokens, and security and audit logs needed to run and protect the Service.

3. Why we use your data and our legal basis

This section covers processing where we are the controller. Clinics set their own purposes and legal bases for the data they control.

• To provide the Service (accounts, bookings, dossier, reminders, clinic subscriptions) — performance of a contract (Article 6(1)(b)).
• To process health data in your own ClinicPro account — your explicit consent (Article 9(2)(a)). Practitioners and clinics process health data to provide healthcare, under Article 9(2)(h), as health professionals bound by confidentiality.
• To take payment and issue invoices — performance of a contract, and our legal obligations to keep accounting records (Article 6(1)(c)).
• To keep the Service secure (bot checks, rate limits, audit logs, fraud prevention) — our legitimate interests (Article 6(1)(f)) and legal obligations.
• To send service emails and notifications — to provide the appointment, medication and account features you use. You can unsubscribe from non-essential emails at any time using the link in each email.

We do not use your health data for advertising, and we do not sell personal data.

4. Where your data is stored

Our application, database and document storage run on servers owned and managed by Softlab in its own data centre in Ireland. Video consultations run on our own video server (meet.clinicpro.ie), which Softlab manages on an OVHcloud server in France; consultations are never recorded. Encrypted backups are made every day to a second Softlab-managed OVHcloud server in the European Union and kept for 30 days. Some of our service providers are based outside the European Economic Area; see section 7.

5. How we protect your data

We use technical and organisational measures appropriate to health data, including:

• encryption of all data in transit (HTTPS/TLS) between your device and our servers;
• access-controlled storage: documents are kept outside the public web server and are only released to signed-in users who are allowed to see them;
• role-based access inside clinics, so that reception and administration staff do not see the clinical record;
• passwords stored only as a one-way hash, and the keys we hold for connected services encrypted at application level;
• bot protection and rate limits on sign-in, registration and password reset, and an audit log of sensitive actions;
• video rooms that can only be entered with a personal, time-limited pass for that consultation.

We are extending encryption to more of the data we store. No system is perfectly secure; if a personal data breach occurs we will act promptly and notify you, the clinic concerned and the Data Protection Commission where the law requires.

6. Who we share data with

We share personal data only where necessary:

• Your practitioner or clinic, so they can provide the care you request.
• Service providers (sub-processors) who help us run the Service — for example hosting and network security, payments, email delivery and push notifications — under contracts that protect your data. The current list is on our Sub-processors page.
• Stripe, which also acts as an independent controller for some payment processing (for example fraud prevention and legal compliance) under its own privacy policy.
• Pharmacies, only when you choose to send a prescription.
• Authorities, where we are legally required to do so.

Please note that appointment and medication reminders you switch on may include the appointment time or the medication name, and are delivered through email and through Apple’s or Google’s push-notification services.

7. International transfers

Some providers, such as Cloudflare, Stripe, Apple and Google, are part of groups based in the United States or operate globally. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework, for providers certified under it) and/or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for more information about these safeguards.

8. Your rights, and who to contact

Under GDPR you have the right to:

• access the personal data held about you;
• have inaccurate data corrected;
• have your data erased, where the law allows (health records may have to be kept for a minimum period);
• restrict or object to certain processing;
• data portability — patients can export their ClinicPro dossier at any time (Article 20);
• withdraw consent at any time, without affecting processing already carried out.

Where to send your request:

• Your ClinicPro account, platform bookings and payments — email us at [email protected].
• The clinical record of an online consultation — contact the practitioner, or email us and we will pass your request on to them.
• Records held by a clinic that uses ClinicPro+ — contact your clinic, which is responsible for your data. If you write to us instead, we will forward your request to the clinic and help the clinic respond; we cannot decide on it ourselves.

We respond within one month, which can be extended by two further months for complex requests. We may need to confirm your identity first.

9. How long we keep data

• ClinicPro accounts — while your account is open. If you close it, we delete or anonymise your data, except records we or a practitioner must keep by law.
• Clinical records of online consultations — for the period the treating practitioner must retain them under Irish healthcare rules and professional guidance.
• Clinic data in ClinicPro+ — for as long as the clinic instructs us. When a clinic subscription ends, the clinic keeps read-only access to view and export its data. Exporting does not delete anything; we delete the clinic’s data when the clinic asks us to, within 30 days, as set out in our Data Processing Agreement with the clinic.
• Invoices and accounting records — six years, as required by Irish tax law.
• Security and audit logs — for 12 months, to protect the Service and investigate security incidents.

10. Cookies and similar technologies

We use only the cookies and local storage needed to run the Service and remember your preferences (such as your session and theme). Our bot check (Cloudflare Turnstile) and our payment form (Stripe) may set their own strictly necessary cookies to protect against abuse and fraud. Our website loads fonts from Google Fonts, which means your browser connects to Google’s servers. We do not use advertising or cross-site tracking cookies.

11. Children

ClinicPro accounts are for adults. Where care is provided to a minor, it must be arranged and managed by a parent or legal guardian.

12. Data protection contact and complaints

For any privacy question, contact our data protection team at [email protected] or by post at Softlab Software Solutions Limited, Kilcash, Rahara, Co. Roscommon, F42 TW60, Ireland.

You have the right to complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 (dataprotection.ie), or to the supervisory authority where you live or work. We would appreciate the chance to deal with your concern first.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date above. Where a change is significant, we will tell you by email or in the app.

This policy is provided for transparency and should be reviewed by a qualified solicitor before you rely on it for a live, commercial healthcare service.