Privacy Policy

1. Introduction

This policy explains how Cluvix Health collects, uses, and protects personal data, both on the cluvixhealth.com website and within the Cluvix Health clinic management software used by our clinic customers.

Cluvix Health plays two different roles depending on context: it acts as a data controller for information about website visitors and customers who register for the service; and it acts as a data processor for medical record data that a clinic enters into the software. The clinic remains the data controller of its own patients’ data.

2. Data collected on the website

The "Request a consultation" form on the Contact page does not currently send data to Cluvix Health’s servers. When you click submit, your own browser opens your default email application with the content pre-filled, and the email is sent directly from your own mailbox to the Cluvix Health team. We do not store the information you enter into the form in any database until that email is sent.

If the website integrates a server-side form submission or a visitor-analytics tool in the future, this policy will be updated to accurately describe the data collected, its purpose, and the corresponding retention period.

3. Data processed within the Cluvix Health software

When a clinic registers to use Cluvix Health, the system processes the following categories of data, entered by the clinic or its staff:

• Clinic staff account information (full name, email, phone number, role)
• The clinic’s administrative customer information (full name, contact details, appointments)
• Electronic medical record data (diagnoses, orders, prescriptions, lab/imaging results), classified as sensitive personal health data
• Operational data (pharmacy inventory, invoices, reports) not directly tied to a specific individual

Medical record data is owned and controlled by the clinic. Cluvix Health processes this data as instructed by the clinic (as controller) and does not use it for its own purposes beyond operating and improving the service.

The Cluvix Health mobile app (Android / iOS)

Cluvix Health is the mobile app for clinic staff, published by CLUVIX SOLUTIONS. There is no sign-up inside the app: staff sign in with an account issued by their clinic. The app works on the same data as the web software, so everything in this policy applies to it. In addition, the app handles the following data:

• Precise location: collected only at the moment a staff member chooses to clock in/out by GPS, and sent to the clinic’s server to record attendance. The app does not collect location in the background.
• Wi-Fi network name and identifier (SSID/BSSID): collected only when a staff member chooses to clock in/out by Wi-Fi, to confirm they are at the clinic.
• Camera and photos: the camera is used to scan the clinic’s attendance QR code (the image is processed on the device, only the code content is sent) and, if the staff member chooses, to take or pick a profile photo that is uploaded to their profile.
• Device identifiers: a random identifier created by the app on first launch, used to limit the number of devices signed in to one account; and a push notification token, used to deliver work notifications (appointments, reminders). Notification content does not contain patient medical information.
• Fingerprint / face unlock: handled entirely by the device’s operating system; biometric data never leaves the device and is not accessible to the app.

All data between the app and the server is encrypted in transit (HTTPS/TLS). Data kept on the device for offline use is stored in an encrypted database and is wiped when the staff member signs out. The app contains no advertising or third-party tracking SDKs, and Cluvix Health does not share app data with third parties for advertising.

Staff can revoke location, camera and notification permissions at any time in the device settings; the related features (GPS clock-in, QR clock-in, notifications) then stop working, while the rest of the app still works. To delete an account or its data, staff contact their clinic administrator or Cluvix Health using the details in the Contact section below.

Trial environment app.cluvixsolutions.com

The workspace code "app" (app.cluvixsolutions.com) is a test and demo environment. Trial accounts on it are handed out to prospective customers and to app-store reviewers so they can explore and review the software. The environment is meant to hold sample data only: users must not enter real personal or health data of patients. Data there may be viewed by other trial users and may be modified or reset at any time without notice. CLUVIX SOLUTIONS is not responsible for any information that users enter into this trial environment themselves.

4. Purposes and legal basis for processing

• Providing and operating the software under the service contract signed with the clinic
• Responding to consultation or technical-support requests initiated by the customer
• Sending operational notices (maintenance, feature updates, invoices)
• Complying with legal obligations, including requests from competent state authorities

5. Sharing data with third parties

Cluvix Health does not sell personal data. Data is shared only with parties that process it on Cluvix Health’s behalf to operate the service, and only to the extent necessary, for example: cloud server infrastructure, payment gateways, e-invoice providers, and Zalo ZNS/SMS messaging providers when a clinic enables appointment reminders through those channels. These parties are bound by equivalent confidentiality obligations.

Google Calendar (optional, enabled by each staff member)

The software allows each staff member to voluntarily connect their own Google account so that appointments are synced to their personal Google Calendar. This feature is OFF by default; it only operates after the staff member actively grants permission on Google’s consent screen.

Data sent to Google: administrative appointment information (time, branch, service) and — depending on the detail level chosen by the staff member — the appointment code, a shortened name, or the customer’s full name together with their phone number.

The software does NOT send any medical record data to Google: no diagnoses, ICD-10 codes, symptoms, vital signs, or internal notes.

The permission scope requested is calendar event management (calendar.events). The software uses this permission only to create, update and delete events that the software itself created; it does not read, modify or delete the staff member’s pre-existing events.

Access tokens issued by Google are stored encrypted. When a staff member disconnects, or when a clinic administrator force-disconnects them, the events created by the software are removed from Google Calendar and the token is deleted from the system.

For clinics using Google Workspace, the clinic administrator may enable syncing at the organisation level instead of each staff member connecting individually; the data scope and limitations above remain unchanged.

6. Data security

• Data encryption and role-based access control within the clinic
• Periodic data backups
• Electronic medical records built in line with Circular 32/2023/TT-BYT issued by the Ministry of Health
• Operating infrastructure hosted on internationally certified cloud platforms

No system is ever completely secure. If we discover an incident affecting personal data, Cluvix Health will notify the affected clinic and, where required by law, the competent authority within the prescribed time limit.

7. Retention period

Data is retained for as long as the service contract remains in effect, plus the minimum retention period required by law for medical records and accounting records. When the contract ends, the clinic may request that its data be exported or deleted in accordance with the service contract.

8. Rights of the data subject

Under Decree 13/2023/NĐ-CP on personal data protection (Vietnam’s Personal Data Protection Decree), you have the right to be informed, to consent, to access, to withdraw consent, to erasure, to restriction of processing, and to object to the processing of your personal data. For medical record data managed by a clinic, please contact that clinic directly. Cluvix Health assists the clinic in fulfilling such requests within the system when instructed to do so.

9. Cookies

See the separate Cookie Policy for details.

10. Changes to this policy

This policy may be updated as the product or legal requirements change. The most recent update date is always shown at the top of the page.

11. Contact

For any questions about this policy, please contact contact@cluvixsolutions.com or hotline 0976 365 284.