Privacy Policy

We collect two categories of information:

• Account information. The email address and password you sign up with. Both are handled by our authentication processor, Supabase, which stores your password only in hashed form; we never store or log your password at all. Signup asks for nothing else — no name, school, phone number, or demographic details.
• Content you enter. The material you put into your record: experiences (including titles, organizations, dates, hours, supervisor names and contact details, and descriptions), session logs, clubs and roles, publications, awards, certifications, hobbies, documents you attach to your entries or keep in your Documents section (PDF, PNG, or JPEG files, up to 10 MB each; five per entry and fifteen in the Documents section), and your recorded acceptance of the Terms (version and timestamp). All of it is provided voluntarily and at your discretion.

Like any web service, our processors also keep routine, short-lived operational logs (for example, IP addresses and browser types in web-server and authentication logs) as part of running and securing the Service; we do not use them for analytics or profiling.

Beyond that, we do not collect analytics or telemetry, run no trackers, load no third-party scripts in the application, and do not acquire data about you from any other source. Because the beta is free, we collect no payment information.

We use your information solely to operate the Service: to authenticate you, to store and display your record back to you, to generate your exports, and to send the transactional emails the Service requires — the signup-confirmation email and the password-reset email you request. We send no marketing or promotional email, and the Service contains no mailing-list machinery.

The Service runs on two processors, which handle your information on our behalf and under their own security and data-processing commitments:

• Supabase — authentication, database, and file storage. Your account, your record content, and the documents you upload are stored in our Supabase project, hosted in the United States.
• Vercel — application hosting. The web application that serves Clinova runs on Vercel in the United States.

By using the Service you understand that your information is processed and stored in the United States.

We do not:

• sell your information, or rent, trade, or license it;
• use it for advertising, or show advertising at all;
• use your content to train machine-learning models;
• share it with any third party other than the processors listed above, except where we are compelled by law — and then only to the extent legally required, after we have reviewed the demand.

If Clinvanta is acquired or its assets are transferred, your information may transfer to the successor only if the successor is bound by this policy’s commitments; we will notify you before such a transfer takes effect, and your export and deletion rights continue unchanged.

Each person’s record is isolated at the storage level: access rules enforced by the database and file store themselves (row-level security) limit every read and write of your record — the documents you upload included — to the signed-in account that owns it. The application performs all database access on the server — no database queries run in your browser — and files move only over your own signed-in session: uploads go directly to storage under your account’s credentials, and viewing uses short-lived links issued on the server to the signed-in owner. If a breach of security ever affects your information, we will notify you as Florida law requires.

The Service sets only authentication-session cookies — the strictly-necessary cookies that keep you signed in, set by our authentication processor’s libraries. There are no analytics, advertising, or preference cookies. Blocking cookies entirely will prevent signing in.

The Family Educational Rights and Privacy Act (FERPA) governs education records maintained by educational institutions that receive federal funding, and parties acting on their behalf. Clinova is a consumer service: it is not provided by, through, or on behalf of any school, and the information in your record is entered voluntarily by you into an account you control. FERPA obligations therefore do not attach to the Service. This is a statement about which law applies — the protections this policy itself promises apply in full.

• Export. One click (Settings → Export, or the Export button in the app) downloads your complete typed record as JSON — every field of every record you entered, plus your account email and id; a second click downloads everything as a zip that bundles the JSON with every document you’ve uploaded; and the PDF export assembles your record into a single document. All of it at any time, free, with no lock-in.
• Correction. Every entry in your record — and every document you’ve uploaded — can be edited or removed in place, at any time. The record of your Terms acceptance is kept while your account exists and is removed with account deletion.
• Deletion. Settings → Delete this account purges your account and every row and file of your content immediately and permanently — every content table row and every stored document is deleted in the same stroke as the account itself. There is no retention period, no soft-delete, and no grace window on our side; the only copies that outlive the deletion are our processors’ routine, time-limited backups, which expire on their fixed schedules and are not used to restore deleted accounts in the ordinary course. If we ever restore from a backup to recover from a failure, we will re-apply any account deletions the restore undid. After deletion, the same email address can register again as a brand new, empty account.

For any privacy request these controls don’t cover, contact us at hello@getclinova.com.

The Service is not directed to anyone under 18; the Terms of Use require every account holder to be at least 18, and we do not knowingly collect information from anyone younger. If you believe a minor has created an account, contact us and we will delete it.

We may revise this policy. Each revision carries a new version identifier and effective date at the top of this page; this policy and the Terms of Use are versioned and accepted together as a single unit. For material changes we will provide notice — by email to your account address or by an in-app prompt — and the Service will ask you to accept before you continue using it. We will not weaken this policy’s commitments retroactively for information collected under an earlier version.

Privacy questions and requests can be sent to Clinvanta LLC at hello@getclinova.com.