How we collect, use, and protect information on Clinexaa.
This Privacy Policy explains how Hermitz Ventures ("Clinexaa," "we," "us") collects, uses, stores, and protects information in connection with the Clinexaa clinic management platform. It is structured around the principles of the EU General Data Protection Regulation (GDPR) to reflect global best practice, and applies to Clinic staff who use the Platform as well as, where relevant, patients whose data Clinics process through it. Clinexaa acts as a data processor with respect to Patient Data entered by Clinics, and as a data controller with respect to Clinic account and billing information.
This Policy applies to the Clinexaa website (clinexaa.hermitz.com), the Clinexaa application, and any related services. It covers: (a) information about Clinics and their Authorized Users, collected directly by Clinexaa as controller; and (b) Patient Data that Clinics input into the Platform, which Clinexaa processes as a processor strictly on the Clinic's instructions, as further described in our Data Processing Agreement.
Personal Data (Account Holders & Authorized Users). Name, email address, phone number, job role, login credentials, and Clinic affiliation, collected at registration or when a Clinic adds staff.
Clinic Data. Clinic name, business address, branding assets, vertical/specialty, subscription plan, and configuration settings.
Patient Data. Where a Clinic uses the Platform to manage patient care, the Platform may process patient demographics, contact details, appointment history, consultation notes, prescriptions, treatment courses, billing and insurance records, and vaccination history (for veterinary clinics). This data is entered by the Clinic or its Authorized Users; Clinexaa does not independently collect Patient Data.
Usage Data. Log data such as IP address, browser type, device information, pages visited, and feature usage, collected automatically to operate, secure, and improve the Platform.
Payment Information. Billing name, address, and subscription history. Full card numbers are never stored by Clinexaa; payment is processed directly by our payment processor (currently Stripe), which maintains its own PCI-DSS compliant infrastructure.
Cookies. See Section 5 and our separate Cookie Policy for details.
Where GDPR or an equivalent framework applies, Clinexaa processes Personal Data on the following legal bases: (a) performance of a contract, to provide the Platform under a Subscription; (b) legitimate interests, for security monitoring, fraud prevention, service improvement, and direct communications with existing Clinics; (c) consent, for optional marketing communications and non-essential cookies; and (d) legal obligation, where processing is required to comply with applicable law (such as VAT recordkeeping). For Patient Data, the applicable legal basis is determined by the Clinic as controller; Clinexaa relies on the Clinic's instructions and the Data Processing Agreement as the basis for its processing as processor.
We use the information described above to: provide, maintain, and secure the Platform; process Subscription payments; provide customer support; send service-related communications (including trial and billing reminders); send WhatsApp appointment and vaccination reminders on a Clinic's behalf, where enabled; analyze aggregated, de-identified usage trends to improve features; and comply with legal and regulatory obligations. We do not sell Personal Data or Patient Data to third parties, and we do not use Patient Data for advertising purposes.
The Clinexaa website and application use cookies and similar technologies for essential functionality, analytics, and (where consented) performance measurement, including Google Analytics. Full detail is provided in our separate Cookie Policy, including how to manage your preferences.
Data is retained for as long as a Clinic maintains an active Subscription, plus a limited retention period after termination to allow for data export and to meet legal recordkeeping obligations (such as billing and tax records, which are typically retained for the period required by applicable tax law). Trial Account data not converted to a paid Subscription is retained only for a short grace period before deletion. Clinics may request earlier deletion of specific data in accordance with Section 11, subject to legal retention requirements (for example, financial records that must be retained for statutory periods).
Clinexaa implements administrative, technical, and organizational measures designed to protect data against unauthorized access, alteration, disclosure, or destruction, including encrypted transmission (TLS) for data in transit, role-based access controls within each Clinic's Account, regular backups, and restricted administrative access to production systems. No system can guarantee absolute security; Clinexaa will notify affected Clinics of any confirmed data breach in accordance with the breach notification provisions of our Data Processing Agreement and applicable law.
Subject to applicable law (including GDPR Articles 15–22 where they apply), individuals may have the right to: (a) access the Personal Data we hold about them; (b) request correction of inaccurate data; (c) request erasure of their data; (d) restrict or object to certain processing; (e) request data portability; and (f) withdraw consent at any time where processing is based on consent, without affecting prior lawful processing. Requests relating to Account Holder or Authorized User data may be sent directly to hello@hermitz.com. Requests relating to Patient Data should generally be directed to the Clinic that holds the patient relationship, as the Clinic is the data controller for that information; Clinexaa will assist Clinics in fulfilling such requests as described in the Data Processing Agreement.
Clinexaa is based in Dubai, UAE, and primarily serves clinics in the UAE and the wider GCC region, with growing use by clinics in other countries. Where Personal Data or Patient Data is transferred across borders (for example, to a Subprocessor located in another country), Clinexaa takes steps intended to ensure an adequate level of protection, such as relying on Subprocessors with appropriate contractual data protection commitments. Clinics serving patients in jurisdictions with specific data residency requirements (such as UAE health data localization rules) are responsible for confirming that their use of the Platform meets those requirements, and should contact us at hello@hermitz.com to discuss configuration options.
We share data with a limited number of Subprocessors engaged to deliver the Platform, including: payment processing (Stripe); messaging delivery (WhatsApp Business Platform / Meta); authentication and analytics (Google); and email delivery infrastructure operated on our behalf. Each Subprocessor is engaged under contractual terms requiring appropriate protection of the data it processes. A current list of Subprocessors is available on request at hello@hermitz.com.
To request deletion of Personal Data, Account Holders or Authorized Users may contact hello@hermitz.com. Clinics may delete or export Patient Data directly within the Platform, or request assistance from Clinexaa support. Deletion requests will be honored within a reasonable timeframe, except where retention is required by law (such as financial recordkeeping obligations) or necessary to resolve disputes or enforce agreements.
The Platform is intended for use by Clinics and their Authorized Users, who must be adults. Where Patient Data relates to a minor (for example, a pediatric patient), that data is entered and controlled by the Clinic under the legal basis of providing care, consistent with applicable healthcare and guardianship law; Clinexaa processes such data solely as instructed by the Clinic.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated to Clinics via the Platform or email in advance of taking effect. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.
Hermitz Ventures — Clinexaa
Email: hello@hermitz.com
WhatsApp / Phone: +971 54 438 1614
Location: Dubai, United Arab Emirates