Privacy Policy

Clicovery is clinic software for physiotherapy practices in India, provided by AASHVIRA TECH SOLUTIONS LLP, Bengaluru, Karnataka, India (“Clicovery”, “we”, “us”). This policy covers clicovery.com, app.clicovery.com, each clinic’s page at <clinic>.clicovery.com, and the patient links clinics send from Clicovery.

It is written to meet the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) as its provisions come into force. See also our DPDP Act page and Terms of Service.

Clicovery handles two kinds of personal data, in two different roles:

• Clinic account data — the clinic owner and staff who sign in to Clicovery. For this data, we decide why and how it is used, so we are the data fiduciary.
• Patient data — everything a clinic records about its patients. The clinic decides why and how it is used, so the clinic is the data fiduciary and Clicovery is its data processor. We process patient data only on the clinic’s instructions and only to provide the service.

3.1 Clinic and staff accounts

• Name, email address and sign-in method (email and password, or Google sign-in). Passwords are handled by Google Firebase Authentication; we never see or store them.
• Your role and branch at each clinic you belong to, and whether that membership is active.
• Clinic details: clinic name, branches, addresses, opening hours, fees, logo and web address.
• Staff availability and working hours, if the clinic records them.
• Who did what in Clicovery: records such as “session marked by” or “payment collected by”, and an activity log of changes.

3.2 Patient data entered by clinics

• Name, mobile number, age or date of birth, gender, address and who referred the patient.
• The problem area being treated, visit notes written by therapists, and assigned home exercises.
• Session packages, sessions attended, appointments, fees and payments.

3.3 Appointment and demo requests

• When someone requests a callback on a clinic’s page, we receive their name, mobile number, chosen branch, preferred time and, if they add them, a note about the time and a description of their problem area. That description may include health information. We pass the request only to that clinic, which is responsible for it as data fiduciary.
• When you request a Clicovery demo, we receive your name, mobile number, clinic name, city, number of branches and the tool you use today. We use these only to reply to you.

3.4 Technical data

• Usage records described in section 7.
• Error reports from the browser and server, used to find and fix faults. We design these to exclude patient details, but an unexpected error can occasionally capture text that was on screen.
• Standard web-server access logs, which include IP addresses, kept for security and abuse prevention.

• To provide Clicovery to clinics: storing records, showing them to the right staff, and producing receipts and reports.
• To sign you in, keep each clinic’s data separate from every other clinic’s, and apply the access rules the clinic sets.
• To send service emails: account verification, password reset, staff invitations and important notices.
• To support clinics, fix faults, keep the service secure and prevent misuse.
• To reply to demo and support requests.
• To meet legal, tax and accounting obligations.

We do not sell personal data, use it for advertising, or use patient data to build profiles. We do not use patient data to train artificial intelligence models.

Visit notes, the problem being treated and exercises relate to a person’s physical health, which Indian law treats as sensitive personal data. Because of that:

• Only staff the clinic has given access can see it, and each clinic can only ever see its own patients.
• Clicovery administrators do not browse patient records. Our internal monitoring tools show no patient data.
• The clinic is responsible for telling its patients that it keeps records in Clicovery and for obtaining any consent the law requires.

Clicovery is not a full medical record system and does not provide medical advice.

Each patient has a private link to see their remaining sessions and home exercises. Anyone who has the link can open it, so clinics should send it only to the patient. We store the link only in a scrambled (hashed) form, and a clinic can replace a patient’s link at any time, which stops the old one working.

By default, Clicovery does not send WhatsApp messages itself. When staff choose to share a link or reminder, Clicovery opens WhatsApp on their own device with the message ready, and the staff member sends it from the clinic’s own WhatsApp. That message is then governed by WhatsApp’s own privacy policy.

A clinic can also choose to have Clicovery send messages on its behalf from Clicovery’s WhatsApp Business account, using the WhatsApp Business Platform provided by Meta Platforms, Inc. Where a clinic turns this on, Clicovery may send that clinic’s patients appointment reminders, session updates, payment receipts and their private link. These messages contain only what is needed for that purpose — such as the patient’s name, mobile number, the clinic’s name and the appointment time — and never visit notes, the problem being treated or other clinical details.

The clinic is responsible for having the patient’s consent before turning on these messages for them. A patient can stop them at any time by replying STOP or by asking their clinic, and the clinic must then stop them.

To operate and support Clicovery, we record when staff members sign in and use the service: the time of each sign-in, the days and periods of active use at each clinic, the number of requests made, and the general type of device used (phone, tablet or computer). We also record when a patient’s portal link is opened and on what type of device — never the link itself.

These records do not include IP addresses, browser details, location, or which patient records a staff member viewed. They are visible only to Clicovery’s own administrators, whose access is itself logged, and are not shown to other clinics. We use them only to run, support and improve the service.

We share personal data only with service providers who help us run Clicovery, and only what each one needs:

• Hostinger — hosts our servers and database, and delivers our service emails.
• Google (Firebase Authentication) — handles sign-in. Receives your name, email address and sign-in details.
• Telegram — delivers internal fault alerts to our team. Alerts contain technical details such as the error type and page, not patient data.
• Meta Platforms, Inc. (WhatsApp Business Platform) — only where a clinic turns on WhatsApp messages from Clicovery (section 6). Receives the patient’s mobile number and the content of each message, and processes them under WhatsApp’s business terms and privacy policy.

We may also disclose data where the law requires it, for example to comply with a valid order from a court or government authority, or to protect the safety of people or the service. If Clicovery is ever sold or merged, data would transfer only under protections at least as strong as this policy, and we would tell clinics first.

Storage outside India

Some of these providers may store or process data outside India. Where they do, we rely on their contractual security commitments, and we follow any restrictions the Government of India places on transfers to particular countries under the DPDP Act.

• Clinic and patient records — kept while the clinic uses Clicovery. Records that staff delete are hidden in the app but kept with the audit trail, so mistakes can be traced and undone. When a clinic stops using Clicovery, we agree exit arrangements with it and then delete its data, except where the law requires us to keep it.
• Staff and portal usage records — 12 months. The most recent sign-in and most recent use are kept while the account or clinic membership exists.
• Application and error logs — 30 days for application and browser-error logs, 60 days for server-error logs.
• Accounts — your name and email are kept so that records showing who did what remain accurate. When you leave a clinic, your access there ends but those records stay with the clinic.
• Billing records — as long as Indian tax and accounting law requires, currently up to 8 years.
• Demo requests — deleted within 12 months if you do not become a customer.

• All connections use HTTPS encryption.
• Each clinic’s data is kept separate by checks in the application and enforced again by the database itself.
• Staff see only the branches and actions their clinic allows, and access removed by a clinic owner takes effect immediately.
• Patient links are stored hashed, and sign-in is handled by Google Firebase Authentication.
• Changes are recorded in an activity log showing who made them.

No system is completely secure. If you think your account or a clinic’s data has been accessed without permission, email security@clicovery.com straight away. If a breach affects personal data, we will tell the affected clinics without undue delay and notify authorities as the law requires.

Subject to the law, you can:

• ask what personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to delete it where we no longer need it and the law does not require us to keep it;
• withdraw consent you have given, which may mean we can no longer provide the service to you;
• nominate someone to exercise these rights if you die or become unable to; and
• complain to our Grievance Officer, and then to the Data Protection Board of India.

Email security@clicovery.com from the address registered to your account. Patients should contact their clinic first (see section 2). Full details are on our DPDP Act page.

We do not use advertising or analytics cookies, and our website loads no third-party trackers. The Clicovery app stores your sign-in session and some preferences, such as your selected clinic, in your browser so that you stay signed in. Signing out or clearing your browser data removes them.

Clicovery accounts are for clinic staff aged 18 or over. Clinics may record children as patients; the clinic is responsible for obtaining verifiable consent from a parent or lawful guardian where the law requires it.

We will update this page when our practices change and change the date at the top. For significant changes, we will also tell clinic owners by email or in the app before the change takes effect.

General questions: support@clicovery.com. Privacy requests, security reports and complaints go to our Grievance Officer: