Privacy Policy

1. Who we are

Clinic Chimp is operated by Elite Allied Health Pty Ltd, a company registered in Australia (ACN 645 070 579), trading as Clinic Chimp ("Clinic Chimp", "we", "us", "our"). This policy explains how we use personal data in connection with the Clinic Chimp service in the United Kingdom, and the rights you have.

You can contact us about anything in this policy at reports@clinicchimp.com, or by post at 4/40 Wilson Avenue, Woombye QLD 4559, Australia.

Clinic Chimp is an analytics and coaching service used by allied health practices. We handle personal data in two different roles, and which one applies decides who you should contact.

• We are the controller of the personal data we need to run our own business: the accounts of the people who use Clinic Chimp, our customers' business contact and billing details, support conversations, and records of how the service is used. Sections 3 to 12 cover this data.
• We are a processor for the practices that use Clinic Chimp. When a practice connects its practice-management system, we process its patient and team records only on its instructions. Section 2 explains what that means for patients.

2. If you are a patient of a practice that uses Clinic Chimp

Your practice decides how your information is used and is the controller of it. We process it for your practice under a contract that requires us to protect it and use it only to provide our service to the practice. The practice's own privacy notice explains how it uses your information.

The records we process for a practice include practice-management system identifiers, your date of birth, the dates of your first and most recent visits, your appointments, invoices and payments, and the services and products you received. These can reveal information about your health. We do not store patient names as part of these records; a name is read from the practice's system when a member of its team opens a patient audit.

If you want to access, correct or delete your information, or have a concern about how it is used, please contact your practice. If you contact us instead, we will pass your request to the practice and help it respond.

3. Personal data we collect as a controller

• Account information: names, email addresses, roles, invitations, sign-in identifiers and account preferences of the people who use Clinic Chimp.
• Business contact information: the names, email addresses and roles of people at practices we deal with, including the email address of anyone a practice adds as an external report recipient.
• Practice team details: the names, email addresses, roles and practice-management staff identifiers of a practice's practitioners and staff, which we use to set up their accounts and invitations.
• Billing information: our payment provider's customer and subscription references, plan, subscription status and a summary of the payment method (such as the card brand and last four digits). Full card details go directly to our payment provider and we never receive them.
• Content you send us: support requests, bug reports, feature requests and feedback.
• Technical and usage information: sign-in and security events, sync and error logs, email delivery records, unsubscribe preferences and the times of actions in the service.

We collect this information from you when you sign up, use the service, contact us or are invited by a colleague; from your practice, including from its practice-management system through the integration it connects, which is where practice team details come from; and from our providers, for example email delivery records.

4. How we use it and our lawful bases

• To provide the service you or your practice signed up for: creating and securing accounts, controlling access by role, sending reports, invitations and account messages, and providing support. Lawful basis: performance of our contract with you or your practice; where you are a team member rather than the subscriber, our legitimate interest in providing the service your practice asked for.
• To bill for the service and keep financial records. Lawful basis: performance of our contract, and compliance with our legal obligations, including tax and accounting law.
• To keep the service secure and working: detecting and investigating errors, misuse and attacks. Lawful basis: our legitimate interests in protecting the service and the practices that use it.
• To improve the service, including from feedback and from anonymised, aggregated statistics. Lawful basis: our legitimate interest in developing the service.
• To tell business contacts about changes to the service and related products we offer. Lawful basis: our legitimate interests. You can opt out at any time, and we stop.
• To meet legal obligations, respond to lawful requests and establish or defend legal claims. Lawful basis: compliance with legal obligations, and our legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights and expectations; you can ask us for details. We do not sell personal data, we do not use it for advertising, and we do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

You need to give us account information to use Clinic Chimp; without it we cannot create or secure an account for you.

5. Who we share it with

• Authorised users of your practice, according to the roles your practice assigns.
• Supabase Pte. Ltd., which provides our database and sign-in services. Our database is hosted in London; its operational logs are held in the European Economic Area.
• Vercel Inc., which hosts and delivers the application. Our application functions run in London; Vercel is based in the United States and its global network serves pages from locations near each user.
• Plus Five Five, Inc. (Resend), which delivers our emails and keeps delivery records, in the United States.
• Stripe, which processes subscription payments. Stripe also uses some of this information as an independent controller, under its own privacy policy at stripe.com/privacy.
• The practice-management provider a practice chooses to connect, when we read its records or a user writes a treatment note.
• Anyone a practice adds as an external report recipient, who receives the reports the practice chooses.
• Our professional advisers, insurers and contractors, and a buyer of our business, where reasonably necessary and under duties of confidentiality.
• Regulators, courts, law enforcement and others where the law requires or permits it.

6. Transfers outside the United Kingdom

We are based in Australia, and our team accesses personal data from there to operate, secure and support the service. Australia is not covered by UK adequacy regulations. For data a practice provides to us, we and the practice enter into the International Data Transfer Agreement issued by the Information Commission, as part of our terms. For data we collect as a controller, we protect it to the standard of the UK GDPR wherever we access it.

Some of our providers process limited information in the United States or the European Economic Area. The European Economic Area is covered by UK adequacy regulations. For the United States, Vercel, Resend and Stripe are certified to the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), and our contracts with our providers include the International Data Transfer Addendum to the European Commission's standard contractual clauses where they are needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Account and business contact information: while the account is open, and for 90 days after it is closed or deleted so that it can be restored if that was a mistake.
• Billing and tax records: for as long as tax and accounting law requires, generally six years after the end of the financial year they relate to.
• Support and feedback messages: while the account is open, and afterwards only for as long as we need them to deal with any follow-up.
• Technical logs and email delivery records: for the periods our providers apply, generally no more than 90 days.

We may keep information longer where we need it to establish or defend a legal claim. Copies in our providers' backups are overwritten under their normal cycles. When we no longer need personal data, we delete it or make it anonymous.

8. How we protect it

We use technical and organisational measures appropriate to the information we handle, including encryption in transit and at rest, database-level separation between practices and between roles, server-side handling of integration credentials, and access for our team limited to the people who need it. No online service can guarantee absolute security, so please protect your password and tell us promptly if you think your account has been misused.

9. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use it
• receive the information you gave us in a portable format, or have it sent to another organisation, where we rely on contract or consent
• withdraw consent at any time where we rely on it, without affecting what we did before

Your right to object: where we use your personal data on the basis of our legitimate interests, you can object at any time, and we will stop unless we have compelling legitimate grounds that override your interests or we need the data for a legal claim. You can object to direct marketing at any time, and we will always stop.

To exercise a right, email reports@clinicchimp.com. We may need to confirm your identity. We respond within one month, or within three months for complex or numerous requests, in which case we tell you within the first month. Our searches for your information are reasonable and proportionate. Some rights have exceptions, and if one applies we will explain it.

10. Complaints

If you are unhappy with how we have used your personal data, you can complain to us by emailing reports@clinicchimp.com with the subject "Data protection complaint", or by writing to us at 4/40 Wilson Avenue, Woombye QLD 4559, Australia, saying what happened and what you would like us to do. We acknowledge every complaint within 30 days, look into it without undue delay, keep you informed of our progress, and tell you the outcome.

You also have the right to complain to the Information Commission, which regulates data protection in the United Kingdom and is known as the ICO: ico.org.uk, telephone 0303 123 1113, or 4th Floor, No. 3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. We would be grateful for the chance to resolve your concern first.

If your complaint is about patient information we hold for a practice, the practice is responsible for it, and we will pass your complaint to the practice and help it respond.

11. Cookies and browser storage

Clinic Chimp uses only the cookies it needs to work: cookies that keep you signed in and protect your session. We also store a few settings in your browser, such as a reminder you have dismissed, so that the app remembers your choices. We do not use advertising or tracking cookies or third-party analytics. When you pay, our payment provider's checkout page sets its own cookies under its own policy.

12. Changes to this policy

This policy is version gb-1.0, effective 10 October 2026. We update it when our use of personal data, our providers or the law change. The current version is always on this page, and we tell account holders by email about a material change.

13. Contact

Elite Allied Health Pty Ltd, a company registered in Australia (ACN 645 070 579), trading as Clinic Chimp

Address: 4/40 Wilson Avenue, Woombye QLD 4559, Australia

Email: reports@clinicchimp.com