Privacy Policy
Last updated: August 3, 2026
At Clintria we respect your privacy and protect the information we process through our platform (the “Service”). This Policy describes what data we collect, how we use it and what your rights are.
1. Information we collect
We may collect: (a) account data (name, email, role); (b) operational data uploaded by the research site to manage its activity; (c) technical usage data (access logs, IP address, browser) for security and Service improvement purposes.
We do not request or collect patient data directly: all clinical and operational information is uploaded by the authorized staff of the research site as part of its own activity and under its responsibility. Nor do we collect precise geolocation data, financial information or the content of communications unrelated to the Service. When a site enables an optional integration (for example, email, messaging or calendar), we process only the minimum data that integration needs in order to work, as detailed below.
2. Use of information
We use the information to provide and maintain the Service, authenticate users, provide support, ensure security and comply with legal obligations. We do not sell personal information.
Under no circumstances do we use the information for advertising purposes, disclose it to data brokers, or make automated decisions that produce legal effects on individuals. We may produce aggregated, anonymized statistics about use of the Service — for example, appointment volume or system performance — which do not allow any individual to be identified and are used exclusively to improve the product.
3. Controller and processor
The research site using the Service is the controller of the data it uploads. Clintria acts as a processor, processing such data on behalf of and under the instructions of the site.
In that capacity, we process the data solely in accordance with the site’s documented instructions, impose a duty of confidentiality on our personnel, assist the site in responding to requests from data subjects or authorities, and notify it without undue delay of any security incident affecting its information. Any sub-processors we engage are bound by obligations equivalent to those assumed in this Policy.
4. Retention
We retain the information for as long as necessary to provide the Service and comply with legal obligations. Upon termination of the service, data is deleted or anonymized as appropriate.
Specific periods depend on the purpose: account data is retained for as long as the account remains active; technical access logs, for a limited period for security and audit purposes; and operational data, for the term of the contract with the site. Before final deletion, the site may request an export of its information. Backups are overwritten according to their rotation cycle, so deletion may be reflected in them with a reasonable delay.
5. Security
We apply reasonable technical and organizational measures (role-based access control, encryption in transit, backups and audit logging) to protect information against unauthorized access, loss or alteration.
Among other measures, user permissions are validated against the database on every request, passwords are stored using non-reversible hash functions, sessions expire after inactivity, and access to the infrastructure is restricted to the personnel who need it to operate the Service. Even so, no system is completely invulnerable: should we detect an incident compromising personal data, we will notify the responsible site and, where applicable, the competent authorities, in accordance with applicable law.
6. Third parties
We may use infrastructure and service providers (for example, cloud hosting or messaging) that process data on our behalf under confidentiality and data protection agreements.
These providers act as sub-processors: they access only the data necessary to deliver their service and are not authorized to use it for their own purposes. Where a provider processes information outside the country of origin, we seek to ensure that appropriate international transfer safeguards are in place. Under no circumstances do we sell, rent or disclose personal information to third parties for commercial or advertising purposes.
7. Google Calendar integration and use of Google user data
Google Calendar synchronization is optional and is enabled by each professional from their own Google account. When a user enables it, Clintria requests the “https://www.googleapis.com/auth/calendar.events” scope and accesses only: (a) the email address of the primary calendar, in order to display which account was linked; and (b) the creation, modification and deletion of the calendar events that correspond to the appointments assigned to that professional within Clintria. We do not read, store or analyze any other event on the user’s calendar. From this integration we retain only the identifiers of the events created by Clintria and the access tokens required to keep the synchronization working, associated with the user and always transmitted over an encrypted connection.
Clintria’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we do not sell this data, we do not transfer it to third parties except as strictly necessary to provide the Service, we do not use it for advertising purposes, we do not use it to train generalized artificial intelligence models, and we do not allow humans to read it, except with the user’s express consent, for security purposes, to comply with a legal obligation, or when the data is aggregated and anonymized.
Users may revoke access at any time from Settings → Google Calendar within Clintria, or from their Google Account permissions page; upon revocation we delete the stored tokens and synchronization stops.
8. Your rights
Subject to applicable law, you may request access, rectification, deletion or object regarding your personal data. Requests related to operational data must be handled through the responsible research site.
To exercise these rights you may write to the address given at the end of this Policy, providing adequate identification; we will respond within the periods established by applicable law. If your request concerns information uploaded by a research site, we will forward it to that site as the data controller. You are also entitled to lodge a complaint with the competent data protection supervisory authority.
9. Cookies
We use cookies and similar technologies strictly necessary for the operation of the Service (for example, session and language). We do not use advertising cookies.
Specifically, we use a session cookie to keep you signed in, a language preference cookie and, only if you expressly choose it, a cryptographically signed “remember me” cookie so that you do not have to authenticate on every visit. We do not embed third-party tracking cookies or advertising networks. You may block or delete cookies from your browser settings, bearing in mind that strictly necessary cookies are essential in order to sign in and use the Service.
10. Changes
We may update this Policy. We will publish the current version on this page with its update date.
Where changes are substantial — for example, if they affect the purposes of processing or introduce a new third-party integration — we will give reasonable advance notice through the Service or by email to the contracting site. Continued use of the Service after the updated version takes effect constitutes acceptance of it.
11. Contact
To exercise your rights or for privacy inquiries, write to us at info@clintria.com.
We handle privacy inquiries in Spanish, English and Portuguese, and we aim to respond within ten business days of receipt. If your inquiry relates to a specific patient’s information or to data uploaded by a research site, we ask that you first raise it with that site, which maintains the direct relationship with the data subject.