Privacy Policy
Last updated: August 20, 2026
This page explains what information ClariMDS collects, how it is used, and with whom it may be shared. ClariMDS is a product of Clarisolv LLC, a limited liability company registered in the State of Delaware, United States.
Who We Are
ClariMDS is a clinical and practice-management platform for clinics and individual practitioners — patient records, appointments, encounters, prescriptions, and billing. It is a product of Clarisolv LLC, a limited liability company registered in the State of Delaware, United States, operated on the same underlying platform as Clarisolv’s other business-management product, Idaraa. This policy applies to the ClariMDS web application, its patient- and doctor-facing portals, and the contact form available on this website. Clarisolv LLC operates ClariMDS as a US service; Egypt’s Personal Data Protection Law and the EU/UK GDPR apply in addition to this policy for a patient located in Egypt or the EU/UK respectively, as explained further in our Terms of Service. In some countries, including Egypt, ClariMDS may be marketed and supported locally through an independent local business that acts only as a reseller and is not the operator of the Service.
Controller and processor roles
For your own clinic account and staff data — the information used to run and secure your ClariMDS account — Clarisolv LLC acts as the data controller. For patient data your clinic enters into ClariMDS (patient records, appointments, medical history, diagnoses, prescriptions, and other clinical documentation), your clinic is the data controller and Clarisolv LLC acts only as a data processor, handling that data on your clinic’s instructions to provide the service. Health data is sensitive personal data under most data-protection laws — your clinic is responsible for having its own lawful basis for collecting and processing patient data, for any licensing or consent requirements that apply to it under the law of the countries where it operates, and for its own patients’ requests about their data — see “Your rights and how to reach us” below.
What we collect
Clinic account information provided when a clinic is onboarded (clinic name, legal name, tax registration number, contact details). Staff and practitioner login information for each user a clinic creates (name, username or email, phone number, and, for practitioners, profession and specialty). Patient information your clinic enters into ClariMDS: identifying details (name, phone number, date of birth, national ID where entered), medical history and clinical notes, diagnoses, prescriptions, vitals, body-map and dental-chart findings, uploaded documents such as lab results or imaging, and an optional patient photo — this belongs to the clinic, and ClariMDS processes it on the clinic’s behalf, not as its own data. Basic technical data needed to keep the service secure (sign-in timestamps, IP addresses used for rate-limiting and abuse prevention, and an audit log of sensitive account actions, including access to patient records).
How we use it
To operate the service your clinic signed up for — managing patient records, appointments, encounters, prescriptions, billing, and the rest of what ClariMDS does. To keep accounts secure, including rate-limiting logins and keeping an audit trail of sensitive changes, including access to patient records. To respond when you contact us. We do not use clinic or patient data for advertising, and we do not sell it to anyone. If you or your patients provide a phone number and opt in to receive SMS/WhatsApp messages, we use that number only to send the messages described in that opt-in — such as order, account, and appointment updates. We do not sell or share your SMS opt-in data, or any other personal information collected through it, with third parties for marketing purposes. See our Terms of Service’s “SMS and text messaging terms” section for more.
Payments
ClariMDS itself never stores or has access to complete card numbers. Where online card payment is used — for example, a merchant’s storefront customer paying online, or a merchant paying their own ClariMDS subscription online — payment happens through a redirect to a PCI-compliant hosted checkout page operated by our payment gateway partner; card details are entered there, never on ClariMDS’s own systems. Payment methods recorded manually by a merchant’s own staff (cash, card paid in person, or other) are just a record of what happened — no card details pass through ClariMDS in that case either.
Where data is stored
ClariMDS currently runs on Microsoft Azure, on its own dedicated database and application server, hosted in the United States (Central US region) — separate from the infrastructure used by Clarisolv’s other product, Idaraa. General uploaded files (clinic logos and similar branding assets, stored the same way as on Clarisolv’s other product) are hosted in the UAE North region. Patient documents (photos, ID-verification status, lab results, imaging, and similar clinical files) are hosted in a separate Azure Storage Account in the United States, in a private storage area that isn’t reachable by a public link — access requires a signed-in session with the right permission, and download links expire after a few minutes. We may host data in other Azure regions or with other reputable infrastructure providers in the future as the service grows. See “Subprocessors” below for the specific providers we use and what each one handles.
Subprocessors
We use a small number of service providers to run ClariMDS, each with access limited to what they need to do their job: Microsoft Azure (application hosting, database, file storage, and outbound email delivery via Azure Communication Services); Hostinger (hosts the info@idaraa.com mailbox); our payment gateway partner (only when a merchant’s storefront customer, or the merchant themselves, pays online by card); and, only where a merchant explicitly connects one, the specific delivery or order-aggregator platform they’ve linked to their own account. We’ll keep this list current here as our vendors change, rather than leaving outdated infrastructure details in the sections above.
Who we share it with
We share data only with the subprocessors listed above, each receiving only what they need to do their part, and — only if a merchant chooses to connect one — the delivery or order-aggregator platforms that merchant explicitly links to their own account. We do not sell or rent data to advertisers or data brokers.
Security measures
Access within ClariMDS is role-based, so staff only see and do what their assigned role permits, and sensitive account actions are recorded in an audit trail. Sign-in attempts are rate-limited to slow automated abuse, and staff accounts created with a temporary password must set a new one on first login; two-factor sign-in (TOTP) is available on request. Data in transit is encrypted (HTTPS/TLS); data at rest is encrypted using our cloud provider’s standard storage and database encryption. As described above under “Payments,” card details are never entered on ClariMDS’s own systems.
Cookies
ClariMDS uses one session cookie to keep you signed in — it lasts up to 30 days or until you sign out, whichever comes first. We don’t use advertising or tracking cookies. The English/Arabic language you see is set by a link parameter, not a cookie.
Data retention
We keep clinic, staff, and patient data for as long as the clinic’s account is active, so historical patient records, appointments, and billing records stay usable. If a clinic’s account is closed, we retain their data for a limited wind-down period in case it’s needed to resolve a dispute or meet a legal obligation, then delete it — or delete it sooner on request, as described below. We haven’t yet published an exact retention period for this wind-down or for backup copies after deletion; if that matters for your clinic, ask us at info@idaraa.com before signing up.
Children’s data
ClariMDS is a clinical tool built for clinics and practitioners, not a consumer service directed at children, and we don’t knowingly collect personal data directly from a child through this website. That said, ClariMDS’s core purpose includes clinics recording and managing pediatric patients’ medical records — that data is entered by clinic staff and practitioners, not submitted by the child directly. If your clinic treats minors, you are responsible for obtaining any consent from a parent or guardian that applicable law requires before entering a minor’s data into ClariMDS, and for your own guardian-authorization process — ClariMDS does not currently provide a dedicated guardian-consent capture flow, and a minor patient’s portal access, where used, relies on the same phone-based patient account your clinic registers, not a separate child or guardian account type.
Your rights and how to reach us
To ask what information we hold about you, correct it, or request deletion, contact info@idaraa.com. These requests are currently handled individually by our team rather than through an automated tool — expect a personal reply, not an instant export. If your request is about a merchant’s own customer or order data rather than your own ClariMDS account, we’ll typically point you to that merchant directly — as explained under “Controller and processor roles” above, they’re the data controller for that information and are best placed to act on it.
Changes to this policy
If this policy changes, we’ll update this page and the date at the top of it.
If your business needs a formal data-processing agreement, see our Data Processing Agreement.