Privacy Policy

Information We Collect

We collect information you provide directly to us, such as your email address, practice website URL, and payment information (processed securely via our merchant of record, Paddle).

How We Use Information

We use the information to perform automated WCAG accessibility scans on your public-facing website, deliver reports, and process subscription payments.

Patient Data

ClinicGuard only scans public-facing web pages. We do not require, request, or store Protected Health Information (PHI). We do not execute forms or bypass authentication portals.

Data Retention

We keep information only as long as it serves the purpose it was collected for:

• Free scan requests (email address, scanned URL, report): retained for up to 24 months from your last scan request, so we can follow up about your results and re-scan on request. You can ask us to delete this at any time by emailing support@clinicguardhq.com or replying "stop" to any email from us.
• Paying client scan data and reports: retained for the life of your subscription (or the 12-month term of a one-time plan) plus 12 months afterward. This is deliberate — the dated, month-over-month evidence trail is part of what the service provides, including after you cancel, in case you need to show a documented history of good-faith remediation effort.
• Automated plan emails (first-scan notices, change alerts and summaries sent to your account email): a copy is kept for up to 30 days to confirm delivery, then deleted.
• Hosted reports (a report about your website that we link to in an email): deleted 90 days after they are created.
• Billing and payment records: we never see or store your card details. Paddle, our merchant of record, holds transaction records per its own retention policy and applicable financial regulations.

Subprocessors

We share the minimum data necessary with the following subprocessors to run the service:

• Google Cloud / Firebase — hosting, scan infrastructure, and the client dashboard's database and authentication.
• Google Cloud Vertex AI (Gemini) — AI-assisted accessibility review of the public web pages we scan for monitoring customers. It receives screenshots and text of those public pages only, never your account or billing details.
• Paddle.com — payment processing and billing; Paddle is the merchant of record for all orders (see Terms of Service §3).
• Google Workspace — sending scan reports and business correspondence from our clinicguardhq.com email addresses.
• Google Analytics — aggregate measurement of visits to our public website, not the client dashboard (see Cookies and Similar Technologies below).

International Data Transfers

ClinicGuard is operated from Egypt. If you are located in the United States or elsewhere, your information is transferred to and processed in Egypt and in the countries where our subprocessors above operate (primarily the United States, via Google Cloud and Paddle). We rely on our subprocessors' own safeguards for cross-border transfer where applicable.

Cookies and Similar Technologies

Our website uses Google Analytics 4, provided by Google, to measure aggregate traffic, such as which pages are viewed and how visitors find us. Google Analytics sets cookies in your browser and collects technical information such as your approximate location, your browser and device type, and the pages you view. We use it only to understand and improve our own site. We do not use it for advertising, we do not sell your personal information, and we do not configure Google Analytics to record what you type into our forms. Google signals and advertising features are switched off. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics does not set cookies at all (Google Consent Mode), and your visit is only counted in aggregate without them. Google processes this data on our behalf and under its own terms; see how Google uses information from sites that use its services. You can block or delete these cookies in your browser settings, or install Google's browser opt-out add-on.

The client dashboard does not use any analytics. It uses Firebase Authentication, which stores a session token in your browser's local storage to keep you signed in. Our pages also load some assets from third-party servers, such as web fonts from Google Fonts, the Paddle checkout script on our pricing page, and a PDF library from Cloudflare's cdnjs on the client dashboard. Those providers receive your IP address and browser details when a page loads. Paddle's checkout may set its own cookies during payment for fraud prevention; see Paddle's privacy policy for details.

Marketing Communications

If you request a free scan or the Section 504 readiness checklist, we may follow up by email about your results and about ClinicGuard's paid plans. Every such email includes a working opt-out; reply "stop" to any email from us and we will stop contacting that address. If we email you a link to a report about your website, we record when that report page is viewed (the date, time and a count). We do not record who viewed it, use cookies, or store IP addresses.

Contact Us

If you have any questions about this Privacy Policy, please contact us at support@clinicguardhq.com.