Draft pending legal review. This policy describes how ClinDose works today. It has not yet been reviewed by counsel and may change before it is final.

Privacy Policy

ClinDose is free with or without an account. Signed out, the patient values you enter stay in your browser. A free account is optional; if you create one, we collect the data described below and you can turn sharing off at any time.

Signed-out visitors

  • Patient values you enter into calculators, the medication check, the pharmacy dashboard, and the patient panel are processed in your browser and stored only on your device (local or session storage). They are not sent to ClinDose.
  • We do not set advertising or analytics cookies, and we do not create a profile for signed-out visitors.
  • Like any website, our hosting provider (Cloudflare) processes standard request data such as IP address and browser type to deliver pages and protect the service. We do not combine it with calculator use.
  • If you send a form (for example, a calculator request or an organization inquiry), we store what you typed in that form so we can respond.

Registered users

When you create a free account, and while sharing is on (the default, disclosed at sign-up), ClinDose collects:

  • Account and profile: email address, sign-in method (email link, Google, or Apple), and what you add to your profile: name, profession, specialty, organization, organization type, state, and NPI. If you verify an NPI, we store the name and taxonomy listed for it in the public NPPES registry.
  • Usage: pages you visit (path only, never the query string), search text (trimmed to 80 characters; anything with six or more digits in a row is discarded), calculators opened and completed, drug pages viewed, medication checks run (the number of orders, the matched drug names, and the result categories, never the text you typed), pharmacy dashboard runs (patient and finding counts only), pharmacogenomics lookups (gene and phenotype), and the name of an institution pack you load.
  • De-identified clinical inputs: when a calculator produces a result, its numeric and multiple-choice inputs and its primary result, plus the shared patient fields (age, sex, height, weight, and serum creatinine). For the medication check: matched drugs, the parsed dose and interval, result categories, and kidney function rounded to the nearest 5 mL/min.
  • Ask ClinDose questions: the questions you ask at /ask, the ClinDose sources retrieved for them, the answer, and any feedback you give are stored with your account. If you choose "Use my patient," the de-identified patient fields above (and the kidney function computed from them) are sent with the question and stored only while clinical sharing is on. Institution protocol text you choose to include is used for that answer and never stored. We may use questions, in de-identified and aggregated form, to improve the service and to generate insights. With usage sharing off, we keep only a count of your questions (for daily limits). Questions are exported with your data and deleted when you delete your account (fully removed within 30 days). Don't type patient names, record numbers, or dates of birth into a question.

Salary survey, public profiles, and job posts

  • Salary survey (optional): if you add your pay at /salary, we store your answers (profession, setting, experience, state and metro if you add them, pay, benefits, and the optional gender and race or ethnicity questions) linked to your account so you can edit or delete them. They are only ever shown as aggregates (medians and percentiles) for groups of at least 5 people; individual answers, minimums, and maximums are never shown, and gender and race or ethnicity comparisons appear only when at least two groups each have 5 or more people. Your answers are deleted when you delete them or your account.
  • Public profile (opt-in): your profile is private unless you turn it on. When it's on, anyone can see the display name, profession, specialty, state (if you choose), verified badge, bio, and interests you chose, at clindose.com/u/your-handle and in the clinician directory. Search engines index it only if you allow it. Your email, NPI, and salary answers are never shown. Turn it off at any time in Account settings.
  • Job posts: jobs you post are reviewed and, once approved, shown publicly for 60 days, including to search engines (Google Jobs). We keep which account posted a job, and count views and apply clicks on the post itself without recording who clicked. If you delete your account, your posts are unlinked from you.

Organizations and protocols

  • Organization data: protocols, versions, review comments, and formulary entries that members create in an organization belong to that organization. Members see them according to their role; they're delivered to members' devices while signed in, and to the organization's API keys and CDS Hooks service URL. We keep an activity log (who did what, and when) for the organization.
  • Shared library (opt-in): a protocol appears in the shared library only when an approver chooses to share it. The library shows the organization's type, bed size, and state, not its name unless the organization turns that on.
  • Aggregate use: we may use de-identified, aggregated protocol data, such as the share of hospitals using AUC-guided vancomycin dosing, and never identify an organization without its permission.
  • EHR requests and imports: CDS Hooks requests from your EHR include patient data; we process them in memory to return cards and don't store or log them. We record only call counts. Protocol text you import is sent to our AI provider (Cloudflare Workers AI) for that request only and isn't stored; PDFs are read in your browser and never uploaded.
  • Leaving: deleting your account removes your memberships. Protocol versions you wrote stay with the organization, which can ask us to delete its data at hello@clindose.com.

How we de-identify clinical inputs

  • No names, record numbers, or free text: only numbers, yes or no answers, and values from a calculator's fixed list of choices are kept.
  • No dates: date inputs are converted to a number of days (for example, days since a last menstrual period) or dropped. The time of a contribution is stored only as a calendar week (for example, 2026-W45).
  • Ages 90 and over are recorded as "90+". Measurements are rounded (for example, height to the nearest centimeter).
  • The same rules run in your browser before anything is sent, and again on our server before anything is stored.
  • Contributions are stored separately from your usage events. If you delete your account, they are unlinked from you.

How we use data

  • To run your account, sign you in, and show the Verified clinician badge.
  • To improve ClinDose: which tools to build, review, or fix next.
  • For research and to produce aggregated insights about how clinical calculations are used.
  • To share or sell de-identified, aggregated data and insights to partners such as life-science companies, health systems, and researchers. We do not sell your name, email, or other information that identifies you.
  • To send product news by email only if you turn that on.

Your choices, including "Do not sell or share"

In Account settings you can turn off Share usage and Share de-identified calculator data at any time. Turning both off is your opt-out of the sale or sharing of your data, including under the California Consumer Privacy Act as amended by the CPRA. While they are off, ClinDose stops collecting usage and clinical inputs from your account; your profile stays so you can sign in. You can also sign out, and nothing leaves your device.

Cookies

  • Session cookie (signed-in users only): keeps you signed in for 30 days of inactivity. It is HttpOnly and Secure, and we store only a hash of it.
  • Sign-in cookies: short-lived (10 minutes) cookies that protect Google and Apple sign-in from forgery.
  • Security: Cloudflare Turnstile may set cookies to tell people from bots on forms.
  • No advertising cookies and no third-party analytics.

Retention

  • Account and profile data: until you delete your account.
  • Salary survey answers: until you delete them or your account.
  • Usage events: while your account exists; deleted immediately when you delete your account.
  • De-identified clinical contributions: kept in de-identified form; unlinked from your account when you delete it.
  • Sign-in links expire after 15 minutes. Rate-limit records keep only hashes and reset each hour.
  • After deletion, a blank record with dates only is purged within 30 days.

Access, export, correction, and deletion

Signed in, use Download my data in Account settings to get every record we hold about your account as a file, edit your profile there, or use Delete my account. You can also email hello@clindose.com. We don't discriminate against you for using these rights; every tool stays free.

State privacy rights

  • California: you have the right to know, access, correct, delete, and opt out of the sale or sharing of personal information, and to limit use of sensitive personal information. Use Account settings or email us. You may use an authorized agent.
  • Washington (My Health My Data Act) and similar laws: ClinDose does not collect consumer health data from signed-out visitors; their patient values stay on their device. For registered users, clinical inputs are de-identified as described above and are about patients a clinician is caring for, not about the user. Profile and usage data are collected only with your agreement at sign-up and can be turned off at any time.
  • Residents of other states with privacy laws (for example, Colorado, Connecticut, Virginia, Oregon, and Texas) can exercise the same rights the same way.

Clinicians and patient data

ClinDose is not a medical record and should not receive patient identifiers. Don't enter names, record numbers, or dates of birth. ClinDose is not a HIPAA covered entity for its free website; organizations that need a business associate agreement should contact us.

Children

ClinDose is for healthcare professionals and students aged 18 and over. We don't knowingly create accounts for anyone under 18. If you believe a minor has an account, email us and we will delete it.

Security

Data travels over HTTPS. Sign-in links and session tokens are stored only as SHA-256 hashes; IP addresses used for rate limits are stored only as salted hashes. Access to the database is limited to the ClinDose team. No system is perfectly secure; we will notify affected users of a breach as the law requires.

Service providers

Cloudflare (hosting, database, and the Workers AI models that answer Ask ClinDose questions), Resend (sign-in emails), Google and Apple (if you choose them to sign in), and the public NPPES registry run by CMS (NPI checks; we send only the NPI you enter).

Changes and contact

We will post changes here and, for material changes, notify registered users by email. Questions or requests: hello@clindose.com.

Draft dated November 4, 2026.