Privacy Policy

Depending on how you use the service, we may process:

• Account and workplace information, such as your name, work email, employee identifier, role, clinic, department, and authentication information.
• Workforce information, such as shifts, clock-in and clock-out activity, attendance, leave, and related operational records.
• Patient and appointment information entered by a clinic or patient, such as contact details, date of birth, appointment details, check-in information, consent records, queue status, and insurance-related information.
• Communications, including support requests, operational notifications, and review responses.
• Technical information, such as device and browser details, IP address, timestamps, diagnostic events, and security or audit logs.
• Subscription information. Payments may be handled by a payment provider; we receive transaction and subscription details but do not store complete payment-card numbers.

We use information to provide check-in, scheduling, lobby, workforce, reporting, notification, account, security, support, and subscription features; maintain and improve the service; prevent misuse; comply with law; and protect patients, clinics, users, and the service.

Clinics control the patient and workforce information they submit to ClinicFlow Pro. We generally process that information on the clinic's behalf and according to its instructions. Questions about a clinic's records, care, appointments, or privacy practices should be directed to that clinic. ClinicFlow Pro is an operations tool and does not provide medical advice.

We may disclose information:

• to the clinic or organization that provides your access or care;
• to vendors that provide hosting, databases, communications, payment processing, security, and technical support under appropriate contractual restrictions;
• when you direct us to disclose it or enable an integration;
• to comply with law or a valid legal request, or to protect rights, safety, and security; and
• as part of a merger, financing, acquisition, or transfer of business assets, subject to applicable confidentiality requirements.

We do not sell patient health information. We do not use patient health information for third-party targeted advertising.

We retain information for as long as needed to provide the service, follow clinic instructions, meet contractual and legal obligations, resolve disputes, and maintain security and audit records. Retention periods vary by record type and clinic requirements. Backups may remain for a limited period after deletion.

We use administrative, technical, and physical safeguards designed to protect information, including access controls and encryption where appropriate. No system is completely secure, and we cannot guarantee absolute security. Please promptly report suspected unauthorized access.

You may have rights to access, correct, delete, restrict, or obtain a copy of personal information, depending on your location. Workforce users should first contact their employer or clinic administrator. Patients should contact the clinic responsible for their record. You may also contact us, and we will route or respond to the request as appropriate.

ClinicFlow Pro is intended for use by healthcare organizations, their authorized workforce, and patients using clinic-directed services. It is not directed to children for independent consumer use. A clinic or a parent or guardian may provide information about a minor when permitted by law.

Information may be processed in the United States and other locations where we or our service providers operate. Where required, we use appropriate safeguards for cross-border transfers.

We may update this policy as the service or applicable requirements change. We will post the updated policy here and revise the effective date. Material changes may also be communicated through the service or by email.

For privacy questions or requests, contact:

Altmed First — ClinicFlow Pro
info@altmedfirst.com

Do not include medical records or other sensitive health information in an unencrypted email.