Privacy policy

RivCor is a business name registered in Ireland (no. 792617) by Edgar Hernandez Mendoza, sole trader, of Apartment 3, 34 Talbot Street, Dublin 1, D01 W426, Ireland. Contact us about privacy at hello@rivcor.com.

When you book with a clinic, fill in its forms or receive its emails, the clinic decides how your information is used and is the controller. RivCor processes it only on the clinic's behalf and instructions, under our data processing terms. This can include health information you give the clinic, such as answers on consent forms, treatment records and photos.

Please contact the clinic first to see, correct or delete your information, or with questions about how it uses it. If you write to us instead, we will pass your request to the clinic.

Through RivCor, the clinic sends you appointment and care emails. It sends you marketing only if you ticked the box to receive it, for example when booking, or asked the clinic to add you. We keep a record of when and how you agreed. Marketing emails come from the clinic's name on our separate marketing address (rivcoremail.com), and each one has a link to unsubscribe at once; you can also ask the clinic to remove you. RivCor never uses your information to market its own services to you, never shows you other businesses and never sells or shares your details.

• Clinic accounts: name, email, password (stored only as a secure hash), role and the business details of clinic owners and staff. We use them to provide the service and keep accounts secure. Legal basis: our contract with the clinic and our legitimate interest in running a secure service.
• Billing: plan, invoices and payment status. Card and bank details are collected and held by Stripe, not by us. Legal basis: contract and legal obligations such as tax records.
• Support and contact: what you send us by email. Legal basis: legitimate interest in answering you.
• Technical data: IP address, browser and request logs, used to keep the service working and secure, and to record when and where consent forms were signed. Legal basis: legitimate interest, and the clinic's instructions for consent records.

We only send clinic owners and staff service emails about their account, security and billing.

We use only the cookies needed to keep you signed in and secure. We do not use advertising or analytics cookies. RivCor also keeps anonymous daily totals of visits, booking starts and completed bookings on clinic booking pages, without cookies.

We share data only with these providers, so they can run parts of the service for us under data protection terms:

Some of these providers are based in the United States or may access data from outside the European Economic Area. Where that happens, transfers are protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We may also disclose data where the law requires it.

When a clinic closes its account, or its access ends for another reason, it becomes read-only for 45 days so the owner can export its data or reopen it, and its clinic data is then deleted. If the owner asks us to delete the clinic data, we delete it straight away. Backup copies are removed as those backups expire.

After clinic data is deleted, we keep a minimal record for three years to help prevent repeated use of free signup offers. It contains the clinic name, its address or addresses and booking-page address, signup, closure and deletion dates, plan, whether and how many free months it used, and one-way hashes of the owner's email address and phone number. It does not contain clients' names or contact details, appointments, payments, photos or clinical information. We keep billing records for as long as Irish law requires, normally six years for tax records. Clinics decide how long they keep their clients' information. Files a clinic uploads for us to import its data are deleted within 30 days.

Data is encrypted in transit, each clinic's data is kept separate, staff see only what their role allows, and signed treatment records cannot be changed afterwards. No system is perfectly secure; if a breach affects your data we will tell the clinic and, where required, the Data Protection Commission.

You can ask to access, correct, delete or move your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email hello@rivcor.com; we reply within one month. You can also complain to the Irish Data Protection Commission.

We will update this page when our practices or providers change, and tell clinics about material changes before they apply.