Privacy Policy

1. Who we are

Clinicast ("we", "us") is an AI content-automation platform for aesthetic-medicine clinics and physicians. This Privacy Policy explains what data we collect when you use clinicast.ai and how we use it.

2. What we collect

• Clinic and physician identifying information you provide (name, email, phone, clinic details).
• Content you create, upload, or generate (scripts, videos, voice profiles, media).
• Usage analytics — pages visited, feature usage, error logs.
• Data from the Instagram and TikTok accounts you choose to connect, described in section 10.
• Payments are processed by Apple, Google Play, or Dodo Payments depending on where you buy; we never receive or store card details.

We do not collect patient data. No patient names, photos, medical records, or identifiers are stored or processed through Clinicast.

3. How we use it

• Provide and improve the service.
• Generate content on your behalf via LLMs and video-rendering providers.
• Publish posts to social platforms you authorized.
• Send service and billing emails.
• Detect and prevent abuse.

4. Who we share with

Sub-processors we rely on: Anthropic (LLM), OpenAI, Dodo Payments (billing), Cloudflare R2 (storage), Railway (hosting), Vercel (hosting), Submagic (video), Kling / Fal (AI video/image), Sentry (error monitoring), PostHog (product analytics), Resend (transactional email). Each processes data only under our instructions.

We maintain a current list of our subprocessors at clinicast.ai/subprocessors and keep it updated as our providers change.

5. Legal basis for processing (GDPR Art. 6)

• Contract performance — account setup, content generation, publishing to social platforms you authorized.
• Legitimate interest — product analytics, abuse prevention, service improvement.
• Legal obligation — tax records, audit logs, anti-fraud compliance.
• Consent — marketing emails, optional feature opt-ins (revocable at any time).

6. Retention periods

• Account data (clinic profile, contact info): deleted within 90 days of subscription cancellation, unless you ask for earlier deletion.
• Generated content (scripts, videos, media): retained while your account is active; deleted with the account on cancellation.
• Billing records: retained for 7 years to meet Israeli and EU tax and audit obligations.
• Webhook and access logs: retained for 90 days for security incident response.
• Connected Instagram and TikTok accounts: deleted as soon as you disconnect the account, as described in section 10.

7. Automated processing (GDPR Art. 22)

We use large language models and video-rendering AI (Anthropic, OpenAI, Submagic, Kling, Fal) to generate content on your behalf at your explicit request. This processing does not produce legal or similarly significant effects on you — you retain full editorial control and can edit, discard, or republish any generated output.

8. Your rights

Depending on your jurisdiction (EU/UK GDPR, Israeli Privacy Protection Law 5741-1981, California CCPA, etc.) you have the right to access, correct, delete, port, or restrict processing of your personal data, and to withdraw consent at any time. Contact privacy@clinicast.ai to exercise these rights — we respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority — in Israel, the Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority); in the EU/UK, your local data protection authority.

9. International transfers

Clinicast is operated from Israel (adequacy decision from the European Commission for personal data transfers from the EU). Some sub-processors operate in the United States and EU. Where required we rely on Standard Contractual Clauses and equivalent safeguards.

10. Instagram and TikTok accounts you connect

You can connect your clinic's own Instagram professional account (through Facebook Login) and its TikTok account. We receive only what the permissions you approve allow, and use it only as described here.

What we receive

• Instagram: the account's ID, username, name and profile picture link, and which permissions you granted; the list of Facebook Pages you manage, used only to find the Page linked to the Instagram account; the account's posts (caption, media type, link, publication time and cover or image link); each post's insights (views, reach, likes, comments, shares, saves, total interactions and average watch time); and the account's follower, following and post counts.
• TikTok: the account's ID, display name and profile picture link; its follower, following, likes and video counts; its videos (title, description, link, publication time and cover image link) with their view, like, comment and share counts. When you publish, we also read the posting options TikTok offers your account, such as its privacy levels, to show them to you. We don't store those options.

How we use it

• To show which account is connected.
• To show your clinic its own posts and their results on its analytics screens.
• To publish your clinic's own videos. Only when a member of your clinic presses Publish do we send the video and caption they reviewed, including any attribution line shown under the caption, to the connected account. On TikTok we also send the privacy, interaction and commercial-content settings they chose.
• To keep a record of what your clinic published through Clinicast.

Who can see it

Only the members of your clinic's Clinicast account. If your clinic joined a brand's program in Clinicast, that brand sees aggregated totals across the clinics in its program (number of posts by platform, views and engagement rate), never individual posts, captions or account details. Our hosting and database providers process this data on our behalf, and our error-monitoring and product-analytics providers (Sentry and PostHog) may record what is shown on screen while you use Clinicast (see section 4).

What we never do

• Sell, rent or license data from your connected accounts.
• Use it for advertising or ad targeting, or to build profiles of people.
• Send it to AI or language-model providers.
• Share it with anyone except as described in this policy or as required by law (see section 11).

Security

Access tokens are encrypted at rest with authenticated AES encryption, and only the services that need the data can read it.

How long we keep it, and how to delete it

• We keep this data while the account is connected, and refresh it on a schedule.
• When you disconnect the account (You → Social connections → Disconnect), we immediately delete its access tokens, profile, synced posts, their metrics and its follower history. For TikTok we also ask TikTok to revoke our access.
• To also withdraw the permission inside Meta, remove Clinicast in Facebook under Settings → Business integrations.
• If you remove Clinicast in your TikTok account's settings, TikTok tells us and we delete the same data automatically.
• For videos your clinic published through Clinicast, we keep the record of that post (its link, caption, the settings chosen and the time) in your clinic's history until you ask us to delete it or to delete your clinic's Clinicast account.
• We also delete this data if we stop operating the service, or if Meta or TikTok ask us to.
• To request deletion at any time, follow clinicast.ai/data-deletion or email privacy@clinicast.ai.

11. Requests from public authorities

If a government or law-enforcement authority asks us for personal data, including data from a connected Instagram or TikTok account, we:

• review each request to confirm it is legally valid;
• challenge requests we consider unlawful, overbroad or disproportionate;
• disclose only the minimum data the law requires;
• keep a record of every request, our response, the legal reasoning and the people involved.

For data we received from TikTok, we also notify TikTok of the request where our agreement with TikTok requires it.

12. Contact

Privacy: privacy@clinicast.ai · Support: support@clinicast.ai