Privacy Policy

1. Who we are

Klleav, Ontario, Canada. Our privacy officer (the Data Protection Officer for the Philippines) is Katarina, at [email protected].

2. If you are a patient

Your clinic decides what it records about you and who at the clinic can see it. Klleav stores and protects that information for your clinic and uses it for nothing else. To see, correct or delete your records, ask your clinic. If you write to us instead, we pass your request to your clinic within 5 business days and help it answer.

When you use your clinic's patient portal, Klleav also keeps your sign-in email and a record of when you signed in, to keep your account secure.

3. What we collect about clinics and staff

• Account details: name, email, phone, role, and, if your clinic adds them, specialty, licence number and photo.
• Clinic details: the clinic's name, address, country, time zone, branches and plan.
• Billing: what you bought and paid. Card details go straight to Stripe; we never see the full number.
• Sign-in and security: sign-in times, the two-factor method you set up, and, for each change to a patient's record, who made it, when, from which IP address and with which browser; and for each patient profile opened, who opened it and when.
• Support: what you send us when you email for help.
• Our website: klleav.com does not use advertising or analytics tracking. Our hosting provider keeps short-lived security logs, such as IP addresses, to stop attacks. To show prices in your currency, klleav.com uses the country your connection comes from, as our hosting provider reports it. It is not stored.

4. What clinics store about patients

What each clinic records, which may include: name, contact details, date of birth, sex, allergies and medical notes, appointments and treatments, invoices and payments, HMO and senior or PWD discount details in the Philippines, and photos, including before-and-after photos. Inside a clinic, access follows the clinic's roles: for example, front desk cannot read clinical notes or patients' photos.

5. How we use information

• to provide Klleav: sign-in, storing and showing records, backups, and the patient portal;
• to keep it secure: two-factor sign-in, the audit log, finding and stopping misuse;
• to bill you and send the emails the service needs: trial reminders, receipts, failed payments, security alerts;
• to answer support requests and fix problems;
• to meet legal, tax and accounting duties.

We do not sell personal information, use it for advertising, or use clinic or patient information to train AI models. We will send product news only to people who ask for it.

Lawful basis (Philippines): providing the service you signed up for, our legitimate interest in keeping it secure, and our legal obligations; consent where the law requires it. Canada: your consent when you sign up and use Klleav, which you may withdraw by closing your account.

6. Where information is stored

Each clinic's data lives in its region's database: Canadian clinics in Canada (Montréal), Philippine clinics in Singapore. Some service providers below handle limited information in other countries, such as the United States, under contracts that require them to protect it. Information handled in another country may be reachable by that country's courts and authorities under its laws.

7. Service providers (sub-processors)

We will give clinics 30 days' notice by email before adding a provider that handles their data, such as an SMS provider or an AI provider when those features are released. When a change is needed urgently for security or to keep Klleav running, we tell them as soon as we can instead.

8. How we protect it

• encryption in transit and at rest (AES-256);
• each clinic's data kept apart by the database itself, and tested on every change;
• two-factor sign-in required for owners and admins, and automatic sign-out after a period of inactivity the clinic chooses;
• an audit log of who viewed or changed each patient's record, which owners and admins can read;
• daily backups kept for 7 days;
• access for Klleav's own people limited to what support and running the service need.

9. How long we keep it

We email owners and admins 30 days and 7 days before a clinic is deleted. A clinic's owners can download all of its data before then.

10. Your rights

You may ask to see the personal information we hold about you, have it corrected, receive a copy to take elsewhere, object to how we use it, or have it deleted where we no longer need it. Write to [email protected]; we answer within 30 days. Patients' requests about their records go to their clinic (section 2).

If you are not satisfied, you may complain to the National Privacy Commission in the Philippines or the Office of the Privacy Commissioner of Canada.

11. If something goes wrong

If a breach affects a clinic's information, we tell the clinic without undue delay and within 48 hours of becoming aware, and help it notify its patients and regulators. For information we are responsible for ourselves, we notify the National Privacy Commission and the people affected within 72 hours as Philippine law requires, and in Canada we report to the Privacy Commissioner and notify people when there is a real risk of significant harm.

12. Cookies and browser storage

Klleav has no advertising or analytics cookies. The apps use your browser's storage to keep you signed in, to sign you out after inactivity across tabs, and to remember small preferences such as a collapsed sidebar. Our hosting provider may set a cookie that tells real visitors from automated attacks.

13. Children

Klleav accounts are for clinic staff, who must be adults. Clinics may keep records of patients who are minors; the clinic is responsible for the consent of a parent or guardian.

14. Changes to this policy

We will email clinic owners at least 30 days before a material change, and post every version on klleav.com with its date.

15. Contact

Privacy officer, Klleav, Ontario, Canada · [email protected]