Privacy Policy

Effective date: August 29, 2026

1. Introduction

NewFrame Digital (“NewFrame”, “we”, “our”, “us”) operates NewFrameDigital.com, Cliniverse, and related online services, including the Cliniverse mobile app for iOS and Android. We respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, and share your information. By using our websites, products, services, and apps, you agree to the practices described here.

The Cliniverse mobile app is a companion to an existing Cliniverse membership. It signs you in to the same account you use on the web and handles your information the same way, with one addition: the device notification token described in Section 2.

Our Privacy Officer: Tyler Sinden is accountable for personal information at NewFrame Digital and for our compliance with this policy. Reach him at tyler@newframedigital.com or 365-737-2396 with any privacy question, access request, or complaint.

2. Information We Collect

We collect information in three ways: you give it to us, we collect it automatically, or a third-party tool collects it on our behalf.

Information you give us directly

• Name
• Email
• Phone number
• Appointment or booking details
• Payment details (processed securely through Stripe or Square; we do not store full card info)
• Account information (for Cliniverse and our courses and community)
• Uploaded content (photos, videos, comments, community posts)
• Support messages, emails, and form submissions

Information we collect automatically

• IP address
• Device information
• Cookies
• Site behaviour
• Login activity (including Google Login)

Information collected through third-party tools

• Meta Pixel
• Google Analytics
• Google Ads tracking (even if not actively running ads)
• HubSpot
• GoHighLevel (CRM and SMS)
• Google Tag Manager
• Stripe
• Square
• Supabase (database, authentication, and file storage)
• Google API authentication (Google Login)
• Firebase Cloud Messaging and Apple Push Notification service (mobile app notifications)
• Hosting and infrastructure providers such as Vercel, Cloudflare, and SiteGround
• Domain services such as Squarespace

These tools may track, store, or process data based on their own privacy policies.

Information collected by the Cliniverse mobile app

If you turn on notifications in the Cliniverse app, we store:

• A notification token issued by Apple or Google that identifies your device
• Whether that device is an iPhone or an Android phone
• The date your device last opened the app

The token is linked to your Cliniverse account so we can send notifications to the right phone, and it is used for nothing else. We do not use it to track you across other apps or websites, and we do not sell or share it for advertising.

You control which notifications you receive in Settings inside the app, and you can switch them all off in your phone's own settings at any time. Turning notifications off in your phone's settings stops delivery immediately.

We delete your device token when you delete your account, when you uninstall the app, and whenever Apple or Google tells us the token is no longer valid. You can also ask us to delete it at any time using the contact details at the end of this policy.

The app does not collect your location, contacts, or health data, and it contains no third-party advertising or analytics trackers. It reaches your camera, photo library, or microphone only at the moment you choose to attach a photo, video, or recording, and it keeps only what you upload. Those uploads are covered in Section 2.

3. How We Use Your Information

We use your information to:

• Deliver our services (Cliniverse, NewFrame courses, community access)
• Send newsletters, promotions, course updates, event reminders, booking reminders
• Send notifications to your phone about activity on your account, if you have turned them on
• Improve website performance and user experience
• Track conversions, analytics, and advertising
• Process payments
• Provide customer support
• Detect, prevent, or address security issues

We do not sell your data. We only use it to operate and improve our services.

4. Marketing Communication

By submitting your information, you agree to receive:

• Marketing emails
• Product updates
• Service announcements
• Booking reminders or confirmations

You can unsubscribe at any time using the link in any email.

SMS Opt-In and Messaging: When you provide your phone number and consent to receive SMS messages, we use that information solely to send the message types you opted into. SMS opt-in information and consent are never sold, shared, or transferred to third parties or affiliates for any purpose.

5. Patient Information on Clinic Websites (Cliniverse Sites)

This section applies when you are a patient of a clinic whose website we build and host, not a NewFrame customer. It explains our role in handling your information.

The clinic decides, we carry out: the clinic is responsible for your information and decides how it is used. We act only on the clinic's instructions, as its service provider. In privacy law terms, the clinic is the controller and NewFrame is the processor. Your relationship, and your health record, is with the clinic.

What passes through our systems: if you book an appointment on a clinic's website, the booking form collects your name, email address, phone number, date of birth, the appointment you selected, and anything you type into the optional notes field. That information passes through our booking service and is written into the clinic's practice management system, which is the clinic's record. A copy of your name, contact details, and appointment summary is also placed in the clinic's customer relationship tool so the clinic can confirm and remind you.

If you use a contact form rather than the booking form, only your name, email, phone number, and message reach the clinic's contact system. Contact forms never touch the clinic's patient records.

What we do not do: we do not use patient information for our own marketing, we do not sell or share it for advertising, we do not use it to train artificial intelligence, and we do not combine it with information from other clinics. We do not access your clinical records, treatment notes, or health history. The optional notes field on a booking form is passed to the clinic and is not read by us in the ordinary course of business.

Please do not send health details through a website form: the notes field exists to help the clinic prepare for your visit, for example to mention a preferred practitioner or an accessibility need. It is not a secure channel for medical information. Bring anything sensitive to your appointment or contact the clinic directly.

Your rights are exercised through the clinic: to see, correct, or delete patient information, contact the clinic directly, since it holds your record and decides these requests. If you contact us instead, we will refer you to the clinic and help the clinic act on your request. If you cannot reach the clinic, contact our Privacy Officer and we will do what we can to assist.

Health privacy law: clinics in Canada are subject to provincial health privacy legislation, including Ontario's Personal Health Information Protection Act. Clinics in the United States may be subject to the Health Insurance Portability and Accountability Act. Whichever applies to the clinic you are a patient of, we handle information as its service provider under a written agreement, use the information only to deliver the service, keep it secure, and do not use or disclose it for any other purpose.

6. Third-Party Sharing

We share data only with partners who help us operate our business, such as:

• Payment processors (Stripe, Square)
• Email and CRM tools (HubSpot, GoHighLevel)
• Analytics and advertising tools (Meta, Google)
• Hosting and infrastructure providers (Vercel, Cloudflare, Supabase, SiteGround)
• Login/authentication tools (Google API)

These providers only receive the minimum information needed to perform their function.

We do not sell, trade, or rent personal information.

7. Cookies and Tracking Technologies

Cookies are small files a website stores on your device. We group ours into four categories:

• Strictly necessary: signing you in, keeping you signed in, security, and remembering your cookie choice. These cannot be switched off, since the site does not work without them.
• Analytics: how many people visit, which pages they read, where they came from. We use this to decide what to build and write.
• Advertising: measuring whether an ad led to a signup, and showing our ads to people who have visited us before. This is the category that involves Meta and Google.
• Preferences: remembering choices you have made, so you are not asked twice.

Your choice: when you first visit, a banner asks what you consent to. Nothing in the analytics, advertising, or preferences categories runs until you accept it. You can change your mind at any time using the Cookie Settings link in the footer of any page, and you can clear or block cookies in your browser settings.

Regional handling: for visitors in the United Kingdom, the European Economic Area, and Canada, non-essential cookies stay off until you opt in. Elsewhere we apply the same banner, and your choice is respected the same way.

Do Not Track: browsers send this signal inconsistently and there is no agreed standard for honouring it, so we do not respond to it. Use the cookie banner or the Cookie Settings link instead, which we do honour.

8. Data Retention

We keep information only as long as we need it for the purpose we collected it, or as long as the law requires. In practice:

What	How long we keep it
Account and profile information	While your account is open, then 30 days after deletion (see Section 10)
Community posts, comments, and messages	While your account is open, then erased with the account
Support conversations	3 years from the last message, so we can pick up a thread and resolve disputes
Marketing contact records	Until you unsubscribe, then 2 years to honour the unsubscribe itself
Analytics and website usage data	26 months, the standard reporting window
Payment and invoice records	7 years, as Canadian tax and accounting law requires
Cliniverse Sites website content	90 days after the subscription ends, so you can resubscribe and pick up where you left off (see Section 5.5 of the Terms of Service)
Patient booking information on clinic sites	Per the clinic's own retention schedule, since the clinic holds the record

When a retention period ends, we delete the information or anonymize it so it no longer identifies you. If you ask us to delete something sooner, we will, unless the law requires us to keep it, in which case we will tell you which record and why.

9. Security Measures

We take security seriously and use:

• Secure servers
• SSL encryption
• Controlled access
• Third-party tools with strong compliance standards

No online system is 100 percent secure, but we work to protect your data at every step.

10. Your Rights

Everyone who deals with us gets the rights in this section, whatever their location. Some are also legal requirements where you live.

You can ask us to:

• See what personal information we hold about you, and get a copy
• Correct anything inaccurate or incomplete
• Delete your information (Section 8 covers the records we must keep)
• Limit how we use it, or object to a particular use
• Move it, by receiving it in a portable, machine-readable format
• Withdraw consent at any time, including consent you gave earlier
• Opt out of marketing email, SMS, and advertising cookies

How to ask: email tyler@newframedigital.com or use the contact details in Section 15. We will confirm we received your request, verify who you are (usually by replying from the email address on your account), and respond within 30 days. If a request is complex and we need longer, we will tell you before the 30 days are up and explain why. We do not charge for this.

If you are not satisfied: tell our Privacy Officer first and we will try to put it right. If you are still unhappy, you can complain to a regulator: the Office of the Privacy Commissioner of Canada at priv.gc.ca, your provincial privacy commissioner, or your local data protection authority outside Canada. You do not need our permission to complain.

Someone acting for you: you can authorize another person to make a request on your behalf. We will ask for written proof of their authority and confirm it with you directly before acting.

Deleting your account

If you have a Cliniverse account, you can delete it yourself at any time. Sign in, go to Account, and use Permanently Delete My Account at the bottom of the page. You can reach that page from the Cliniverse app or from cliniverse.newframedigital.com in any browser, so you do not need to install anything to delete your account.

When you delete your account, your subscription is cancelled straight away and you are signed out immediately. Your data is then held for 30 days before being permanently erased. That window exists so an accidental or regretted deletion can be undone: contact us within 30 days and we can restore the account. After 30 days the erasure is permanent and we cannot recover anything.

Permanent erasure removes your profile, your community posts and comments, your direct messages, your saved templates and course progress, and any device notification tokens.

Some records are kept after deletion where the law requires it, in particular payment and invoice records held for tax and accounting purposes. Those are retained by our payment processor (Stripe) under its own retention rules.

If you would rather we did it for you, or you cannot sign in, email us at the address below and we will delete the account on your behalf.

For California residents

California law gives you the rights above plus the following.

We do not sell your personal information for money, but our advertising cookies pass identifiers to Meta and Google so we can measure ads and reach past visitors, and California law counts that as sharing for cross-context behavioural advertising. You can stop it at any time using the Cookie Settings link in the footer of any page, which is our Do Not Sell or Share My Personal Information control, or by rejecting advertising cookies in the banner. We also honour the Global Privacy Control signal sent by your browser.

We do not knowingly sell or share the personal information of anyone under 16.

Categories of personal information: in the 12 months before the effective date above, we handled:

Category	Examples	Where it comes from	Why	Shared for advertising?
Identifiers	Name, email, phone, IP address, account ID	You, your device	Deliver the service, support, marketing	Yes, via advertising cookies
Customer records	Billing name, payment method details held by Stripe	You, our payment processor	Take payment, prevent fraud	No
Commercial information	What you bought, subscription history	Your account	Deliver and bill the service	No
Internet activity	Pages viewed, referring site, session behaviour	Cookies and analytics tools	Measure and improve the site	Yes, via advertising cookies
Geolocation	Approximate city from IP address	Your device	Regional cookie rules, analytics	Yes, via advertising cookies
Audio, visual, or similar	Photos, videos, and files you upload	You	Show your content in the community and library	No
Inferences	Interests drawn from what you read and buy	Our analysis of the above	Decide what to build and what to send you	No
Professional information	Clinic name, profession, province	You	Match compliance rules and content to your practice	No

We do not collect biometric information, and we do not ask for sensitive personal information as California defines it. We keep each category for the periods in Section 8.

Non-discrimination: we will never charge you more, give you less, or refuse service because you exercised a privacy right. Doing so is illegal, and it would also be a poor way to treat a customer.

For residents of Virginia, Colorado, Connecticut, and other US states with privacy laws

You have the same rights set out above, including the right to opt out of targeted advertising and to appeal a decision. To appeal, reply to our response and say you are appealing. We will review it and answer within 45 days. If we deny your appeal, we will tell you how to contact your state Attorney General.

11. Refunds and Guarantees

Every Cliniverse plan comes with a 30-day satisfaction guarantee. Section 3 of our Terms of Service sets out how it works, what it covers, and how to claim it.

12. Results Are Not Guaranteed

Marketing results vary between businesses.

Past performance does not guarantee future outcomes. By using our services, you understand that results are influenced by factors outside our control, such as:

• strategy implementation
• market conditions
• competition
• ad spend
• operational performance

This protects you and us by setting clear expectations upfront.

13. How We Use Artificial Intelligence

Cliniverse AI and the Cliniverse Sites editor use third-party AI models to draft marketing copy, blog posts, and website content.

What we send: when you use these features, your prompt and the clinic context you have set up (profession, province, services, tone) go to the model provider so it can generate a response. Do not paste patient information, health records, or anything confidential into an AI feature.

What providers do with it: we use business accounts with our AI providers under terms that prohibit training their public models on the content we send. Providers may retain input briefly to monitor abuse, then delete it.

We do not use your prompts, your generated content, your community posts, or your uploads to train AI models of our own.

You are responsible for what you publish: AI output is a draft, not advice. It can be wrong, dated, or inappropriate for your regulatory college. Everything Cliniverse AI writes is checked against the advertising rules for your profession and province, but that check is an aid rather than a guarantee. Review every piece before it goes out, and see Section 5 of the Terms of Service for your obligations as a regulated professional.

14. International Data Transfers

We are based in Ontario, Canada, and most of our information is stored in Canada or the United States. Some providers process information elsewhere, including the European Union.

This means your information may be handled in a country whose privacy laws differ from your own, and while it is there it may be accessible to that country's courts and law enforcement under their laws. We only use providers that commit contractually to protecting it, through standard contractual clauses or an equivalent safeguard where the law requires one.

If you would like to know where a specific provider stores your information, ask our Privacy Officer and we will tell you.

15. Policy Updates

We may update this Privacy Policy for legal or operational reasons. The updated version will always be posted with a new effective date.

16. Contact Us

For privacy questions or data requests, contact:

NewFrame Digital

Email: support@newframedigital.com

Phone: 365-737-2396