Legal Agreement

Privacy Policy

Last updated: June 23, 2026

1. Introduction and Scope

Clinex. ("Clinex," "we," "our," or "us") is committed to safeguarding the privacy, confidentiality, and security of all information entrusted to us by the clinicians, healthcare organizations, and patients whose data passes through our platform. This Privacy Policy describes how we collect, use, disclose, store, and protect information in connection with our AI-powered clinical documentation system and related services (collectively, the "Services").

This Policy applies to all users of the Services, including individual physicians, practice administrators, health system employees, and any other individuals or organizations that access or interact with the Clinex platform. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy.

Clinex operates as a Business Associate, when processing Protected Health Information (PHI) on behalf of Covered Entities. Our data practices are designed to meet or exceed the requirements of HIPAA, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and other applicable federal and state health privacy laws.

2. Key Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

  • Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form or medium, as defined under 45 C.F.R. § 160.103.
  • Clinical Documentation: Transcribed encounter notes, SOAP notes, physician narratives, diagnostic impressions, and any other clinical records generated through the Services.
  • User Data: Account credentials, usage metrics, preferences, and other non-clinical information collected from users of the platform.
  • De-identified Data: Information from which all eighteen HIPAA identifiers have been removed in accordance with 45 C.F.R. § 164.514(b).
  • Business Associate Agreement (BAA): A written contract between Clinex and a Covered Entity that governs the handling of PHI, as required under 45 C.F.R. §§ 164.308, 164.310, and 164.314.
  • EHR: Electronic Health Record system, including but not limited to Epic, Cerner, Allscripts, athenahealth, and eClinicalWorks.

3. Information We Collect

3.1 Clinical and Health Information

Our primary function involves processing clinical conversations and generating structured documentation. In the course of providing these Services, we may process the following categories of health-related information:

  • Audio recordings of physician-patient encounters, captured through our speech recognition interface with appropriate patient and clinician consent.
  • Transcribed text of clinical encounters, including patient history, physical examination findings, assessment, and treatment plans.
  • Structured clinical data extracted from narratives, such as diagnosis codes (ICD-10), procedure codes (CPT), medication names, lab values, and vital signs.
  • Information received from integrated EHR systems, including demographic data, prior visit history, active problem lists, and existing medication records.
  • Corrections and annotations made by physicians during the review and editing process.

All clinical information processed through the Clinex platform is treated as PHI and handled in strict accordance with our obligations under HIPAA and the terms of applicable Business Associate Agreements.

3.2 Account and Organizational Information

When a healthcare organization or individual clinician creates an account with Clinex, we collect:

  • Full name, professional title, and medical license number.
  • Business contact information including email address, phone number, and practice or organization name.
  • Specialty designation and primary clinical setting (e.g., inpatient, outpatient, emergency medicine).
  • Billing and payment information, processed through our PCI-DSS compliant payment processor.
  • EHR system details and integration credentials necessary to establish secure connections.

3.3 Platform Usage Data

We automatically collect certain technical and behavioral data to support service delivery, performance optimization, and system security:

  • IP address, browser type, operating system, and device identifiers.
  • Session logs, feature interaction data, and navigation patterns within the platform.
  • API request and response metadata, including timestamps, endpoint identifiers, and response latencies.
  • Error logs and diagnostic information used to identify and resolve technical issues.

Usage data is collected through server logs, cookies, and embedded analytics tools. This data is not linked to PHI and is used exclusively for operational and improvement purposes.

4. How We Use Your Information

4.1 Core Service Delivery

The information we collect is used primarily to provide, maintain, and improve the clinical documentation Services, including:

  • Transcribing physician-patient encounters and generating structured clinical notes using artificial intelligence and natural language processing.
  • Synchronizing completed documentation with integrated EHR systems in real time.
  • Personalizing note templates and documentation preferences based on specialty, workflow patterns, and prior usage.
  • Supporting physician review, editing, and approval of AI-generated content prior to EHR submission.

4.2 AI Model Training and Improvement

Clinex is committed to continuous improvement of our AI transcription and note-generation capabilities. We may use de-identified and aggregated data to train, validate, and refine our machine learning models. We will never use individually identifiable PHI for model training without explicit written authorization from the applicable Covered Entity.

Physician feedback and corrections to AI-generated content serve as a quality signal that is incorporated into our improvement pipelines in anonymized form only.

4.3 Security and Compliance Operations

We use collected information to maintain the security and integrity of our platform, including:

  • Detecting, investigating, and responding to unauthorized access, data breaches, or other security incidents.
  • Conducting access control audits and enforcing role-based permission policies.
  • Meeting our obligations under HIPAA breach notification requirements (45 C.F.R. §§ 164.400–414).
  • Fulfilling reporting obligations to regulatory authorities as required by applicable law.

4.4 Business Operations

Non-PHI information is used for legitimate business purposes, including:

  • Billing, invoicing, and subscription management.
  • Customer support and technical troubleshooting.
  • Communication of product updates, feature announcements, and service notifications.
  • Internal reporting, financial planning, and board-level analytics.

5. Disclosure of Information

5.1 Authorized Disclosures

We do not sell, rent, or trade personal information or PHI. We disclose information only in the following circumstances:

  • To the Covered Entity (e.g., the physician's employing healthcare organization) on whose behalf we are acting as a Business Associate, pursuant to an executed BAA.
  • To authorized EHR systems for the purpose of completing clinical documentation workflows.
  • To subcontractors and service providers who assist in delivering the Services, each of whom is bound by appropriate confidentiality and data processing agreements.
  • As required by applicable law, court order, or regulatory directive, including disclosures mandated under the HIPAA Privacy Rule at 45 C.F.R. § 164.512.
  • In connection with a merger, acquisition, or sale of substantially all assets, subject to advance notice and continuity of privacy protections for data subjects.

5.2 Subprocessors

Clinex engages third-party cloud infrastructure and technology vendors to support platform operations. All subprocessors who handle PHI are required to execute Business Associate Agreements and comply with applicable security and privacy standards. A current list of our primary subprocessors is available upon written request from authorized Covered Entities.

5.3 Prohibited Disclosures

We strictly prohibit the disclosure of PHI for marketing purposes, the sale of PHI in any form, and the use of PHI in a manner inconsistent with the purpose for which it was collected, except as permitted by the applicable BAA or required by law.

6. Data Security

6.1 Technical Safeguards

Clinex maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of all data processed through our platform. Technical safeguards include:

  • End-to-end encryption of PHI in transit using TLS 1.3 or higher.
  • Encryption of PHI at rest using AES-256 encryption.
  • Multi-factor authentication required for all platform access.
  • Role-based access controls limiting data access to the minimum necessary.
  • Continuous intrusion detection and security event monitoring via a dedicated SIEM platform.
  • Automated vulnerability scanning and semi-annual third-party penetration testing.
  • Geographically distributed data centers with automated failover and disaster recovery.

6.2 Administrative Safeguards

  • Annual HIPAA and security awareness training for all personnel.
  • Background screening for all employees with access to PHI.
  • Documented incident response plan with defined breach notification procedures.
  • Quarterly internal compliance assessments and annual third-party audits.
  • Formal vendor risk management process for all subprocessors.

6.3 SOC 2 Type II Certification

Clinex is committed to achieving and maintaining SOC 2 Type II certification across the security, availability, confidentiality, processing integrity, and privacy trust service categories. Audit reports are available to Covered Entities under appropriate non-disclosure agreements.

7. Data Retention and Deletion

Clinex retains PHI and clinical documentation for the duration of the applicable Business Associate Agreement and for such additional periods as are required by federal or state law governing medical records retention. Upon termination of a BAA, Clinex will return or securely destroy all PHI in its possession within sixty (60) days, except to the extent that applicable law requires continued retention.

Account and usage data that does not constitute PHI is retained for a period of three (3) years following account closure, after which it is permanently deleted or anonymized.

De-identified and aggregated data used for product improvement and analytics may be retained indefinitely, as such data does not contain individually identifiable information.

8. Individual and Patient Rights

To the extent that Clinex processes PHI on behalf of a Covered Entity, patients retain all rights afforded to them under the HIPAA Privacy Rule, including the right of access, the right to request amendment of records, the right to an accounting of disclosures, and the right to request restrictions on use and disclosure. Clinex supports Covered Entities in fulfilling these obligations by providing data access, export, and correction capabilities within the platform.

Requests by patients to exercise their HIPAA rights should be directed to the Covered Entity (i.e., the physician or healthcare organization) with whom they have a direct care relationship. Covered Entities may direct specific technical requests to Clinex through our designated Privacy Officer.

9. Rights of Platform Users

Registered users of the Clinex platform have the following rights with respect to their account and usage data:

  • Access: You may request a copy of the personal account information we hold about you.
  • Correction: You may request correction of inaccurate or incomplete account information.
  • Deletion: You may request deletion of your account and associated personal data, subject to retention obligations under applicable law and our BAA obligations.
  • Portability: You may request an export of your account data in a machine-readable format.
  • Objection: You may object to specific uses of your data for non-essential purposes such as marketing communications.

To exercise any of these rights, submit a written request to our Privacy Officer at the contact information provided in Section 13 of this Policy. We will acknowledge receipt within five (5) business days and respond substantively within thirty (30) days.

10. International Data Transfers

Clinex currently processes and stores data within the Federal Republic Of Nigeria, utilizing data centers in US-East and US-West regions. In the event that data is transferred outside the Federal Republic Of Nigeria in connection with future international expansion, such transfers will be conducted in accordance with applicable cross-border data transfer frameworks, including Standard Contractual Clauses under the GDPR where applicable.

Users in jurisdictions outside the Federal Republic Of Nigeria may be subject to additional privacy rights and protections under local law. Clinex is committed to honoring these rights as we expand into international markets.

11. Cookies and Tracking Technologies

Clinex uses cookies and similar technologies to maintain session state, authenticate users, and collect platform usage data. We do not use third-party advertising cookies or cross-site behavioral tracking technologies. Users may configure their browser to block or delete cookies; however, doing so may affect the functionality of the platform.

The following categories of cookies are used on the Clinex platform:

  • Strictly Necessary Cookies: Required for authentication, session management, and core platform functionality. These cannot be disabled.
  • Performance Cookies: Used to collect anonymized usage data to improve platform performance and user experience.
  • Preference Cookies: Store user settings such as language, display, and documentation preferences.

12. Changes to This Privacy Policy

Clinex reserves the right to update or modify this Privacy Policy at any time. When material changes are made, we will provide advance notice through the platform interface and, where required, by direct communication to registered users and Covered Entities. The effective date of the current version is displayed at the top of this document.

Continued use of the Services following the publication of a revised Policy constitutes acceptance of the updated terms. If a Covered Entity objects to any material change, it should notify Clinex in writing within thirty (30) days of receiving notice.

13. Contact Information

Questions, concerns, or requests regarding this Privacy Policy should be directed to:

Privacy Officer Clinex AI Scribe. info@ezerhealthcare.com

If you believe that your privacy rights have been violated and we have not resolved your concern, you may also file a complaint with the Nigeria. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr.