Privacy Notice

Harmony Care Connect is provided by Clinova (“Clinova,” “we,” “us,” or “our”). Clinova is the data controller for personal data collected about visitors to our website and account holders on the Service, other than protected health information (“PHI”) submitted by clinic customers, for which the clinic is the controller and Clinova acts as a business associate / processor under a Business Associate Agreement.

• Account data — name, email address, role, clinic association, hashed login credentials.
• Support data — messages, tickets, and attachments you send us.
• Usage and telemetry — pages viewed, features used, timestamps, and diagnostic events used to operate and improve the Service.
• Device and log data — IP address, browser type, operating system, device identifiers, referrer URLs, and error logs.
• Billing data — collected and stored by Paddle (see “Sharing” below). We do not store full payment card numbers.
• Clinical data — PHI submitted by clinic users to operate their practice. Clinova processes PHI on behalf of the clinic under a Business Associate Agreement and does not use PHI for its own purposes.

• Provide the Service — create and administer accounts, deliver features, respond to support requests. Legal basis: performance of a contract.
• Security and fraud prevention — authenticate users, detect abuse, protect the platform and its users. Legal basis: legitimate interests and legal obligation.
• Product improvement — analyze aggregated usage to improve reliability, performance, and features. Legal basis: legitimate interests.
• Communications — send transactional messages such as receipts, security alerts, and service notices. Legal basis: performance of a contract.
• Marketing — occasional product updates you can opt out of at any time. Legal basis: consent, where required.
• Legal compliance — comply with applicable law and respond to lawful requests from authorities. Legal basis: legal obligation.

We share personal data only with the following categories of recipients:

• Service providers and subprocessors — cloud hosting, database, email delivery, error monitoring, and customer support tooling used to run the Service.
• Merchant of Record — Paddle — Paddle handles the sale of the Service, subscription management, payment processing, tax calculation and remittance, and invoicing on our behalf. Paddle’s own privacy notice is available at paddle.com/legal/privacy.
• Professional advisers — accountants, auditors, and legal counsel bound by confidentiality obligations.
• Authorities — where required by law, court order, or to protect the rights, property, or safety of Clinova, our customers, or others.

We do not sell personal data.

We retain personal data only for as long as necessary to provide the Service, meet legal and accounting obligations, resolve disputes, and enforce our agreements. Account data is retained for the life of your account and for a reasonable period afterward. Clinical data is retained per the clinic’s policy and applicable state and federal law. Data is deleted or anonymized when no longer needed.

We use appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, database row-level security, role-based access controls, session security, audit logging, and screening against known compromised passwords. No system is perfectly secure; we work continuously to improve our safeguards.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your data, subject to legal retention obligations;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Receive a portable copy of data you provided to us;
• Lodge a complaint with a supervisory authority in your country.

To exercise these rights, contact us at Info@thecreativestudiobyjae.com. We will respond within the timeframes required by applicable law (typically within one month).

Personal data may be processed and stored in countries other than the one in which it was collected, including the United States. Where data is transferred outside the UK or European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions where available.

We use a small number of cookies and similar technologies. Essentialcookies are required for authentication and to keep you signed in. Analyticscookies, where used, help us understand how the Service is used so we can improve it. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent parts of the Service from functioning.

The Service is intended for use by healthcare organizations and their staff. Where clinical data about minors is submitted to the Service by a clinic customer, it is processed on that clinic’s behalf under a Business Associate Agreement and governed by the clinic’s own privacy practices.

We may update this Privacy Notice from time to time. Material changes will be communicated by email or in-app notice. The “Last updated” date above indicates when this notice was last revised.

For privacy questions, requests, or complaints, contact Clinova at Info@thecreativestudiobyjae.com.