Your practice stays in control
- Your practice
- Controls its client records and decides who on your team can access them.
- Clara
- Handles those records to provide, secure, and support the services you choose.
Clara does not sell client information, use it for third-party advertising, or use it to train AI models.
Access, exports, and support
Your practice can export records and contact support for help with access, corrections, or account closure. Clients request their clinical records through their practice, with Clara supporting the practice as needed.
Authorized Clara staff may access information to provide support, follow your instructions, or respond to an incident. Access is limited to what is needed for that purpose.
Where information goes
Your practice’s primary clinical records and files are hosted in Canada. Some features involve processing in other countries, as shown below.
| Service | Where information is handled |
|---|---|
| Clinical records and files | Primary storage in Canada |
| Video and transcription | Canadian-hosted services |
| Text AI | Microsoft Azure in Canada East. Abuse monitoring and support can involve personnel outside Canada. |
| Phone calls and SMS | Twilio processing and storage in the US |
| AI receptionist | OpenAI voice processing internationally, separate from Azure |
| Payments and delivery networks | International processing. See providers and agreements for details. |
Clara uses Twilio for phone and messaging services, with communications data processed and stored in the US under contractual privacy and security safeguards.
What Canadian hosting means
Canadian hosting describes where primary records are stored. Service providers may also use staff and subcontractors outside Canada for support, security monitoring, and administration. Email providers, telephone carriers, and mobile notification networks help deliver communications.
Information processed outside Canada is subject to the laws of those countries, including lawful access by authorities. See the provider table for the services involved.
How we protect information
Encryption
Encryption protects information in transit between your device and Clara and at rest with our hosting providers. Scribe session recordings have an additional layer of encryption.
Account security
Staff can enable two-factor authentication for an extra check at sign-in. Individual accounts and role-based permissions let your practice manage each team member’s access.
Practice separation
Database access checks keep practice records separate. Access also depends on the team member’s permissions for the client or chart.
Private files
Clinical attachments are private and available through authorized access or time-limited links. Public profiles and product images are separate from clinical files.
Audit records
Audit records capture supported changes to records, permissions, and settings, along with when they occurred. Coverage varies by workflow and does not include every view of a record.
Data minimization
Features use the information needed for the task. Diagnostic reports have restricted access and filters to reduce clinical content. Software tests use fictional client records.
Secure development and access
Privileged credentials are kept out of users’ browsers. Automated security tests check database permissions and sensitive workflows. Your practice helps protect access by keeping devices secure and staff permissions up to date.
Backups and recovery
Clara’s recovery procedures cover database records and uploaded files, including the permissions and encryption needed to use them securely.
- Database and files
- A complete independent backup of Clara’s database and stored files has been verified.
- Recovery testing
- Recovery has been tested separately from the live service, using fictional records.
Recovery scope and retention
Independent backups are stored with AWS in Canada. A 30-day retention lock protects them from early deletion. What can be restored depends on the incident and the available backup.
Eligible deleted or archived records can also be recovered individually. Recovery does not undo completed actions such as sent emails or processed payments.
AI, communications, and recordings
Ask Clara, Scribe note generation, and reply drafting use Microsoft Azure in Canada East. Audio transcription runs on Clara’s Canadian-hosted service. Clinicians should review AI-generated content before using it in care.
The optional AI receptionist uses OpenAI directly for live voice processing, separately from Azure. Practices are responsible for providing appropriate notices and obtaining consent for recording and AI-assisted services.
AI information, retention, and review
AI features process the information needed for the request, which may include a question, selected record information, a transcript, a message, or live receptionist audio. Clara does not use this information to train AI models. Providers may retain information for security monitoring under their terms.
Azure’s standard abuse monitoring is enabled to detect misuse. Flagged prompts and responses may be kept for up to 30 days and reviewed by authorized Microsoft staff, who may be outside Canada. OpenAI’s voice service follows its API data controls and agreement.
Calls, messages, and connected inboxes
Twilio handles calls, text messages, and voicemail recordings. Its 30-day message access setting is separate from your saved Clara conversations and voicemail. See retention and deletion below for details.
Clara sends managed email through Amazon Simple Email Service (SES). Connected inboxes also involve your chosen email provider. Ordinary email, calls, and SMS are not end-to-end encrypted by Clara, so your practice should choose a suitable channel for sensitive information.
Retention and deletion
Retention depends on the record, the practice’s instructions, professional obligations, and any legal hold or outstanding access request. Archiving a client or cancelling a subscription does not automatically destroy the clinical record.
| Information | How it is handled |
|---|---|
| Clinical records and files | Deletion follows a review of your practice’s instructions, professional retention requirements, client age, legal holds, and export needs. |
| Scribe recordings and transcripts | For chart drafts, encrypted transcripts remain available until the note is signed or deleted. Signing or deleting removes the active transcript and schedules audio deletion. Appointment-note recordings are cleared when applied or discarded. Backups and provider copies have separate retention periods. |
| Messages and voicemail | Saved communications can form part of the practice record. Twilio SMS/MMS access is set to 30 days with extended backup storage disabled; voicemail has a separate reviewed deletion process. |
| Deleted files | Files queued for deletion have a 30-day recovery window before permanent removal. Required retention and legal holds still apply. |
| Independent backups | 30-day retention locks protect recovery copies. Deletion from the active service does not immediately remove unexpired backups. |
| Incident records | Kept to document investigation and response. Where PIPEDA applies, breach records are retained for at least 24 months. |
Before closing your account, contact us to arrange an export and confirm what will be deleted, when, and whether anything must be retained.
Breach response
Our breach response procedure covers containment, investigation, evidence preservation, recovery, and corrective action. We assess which information and practices are affected.
We notify affected practices at the first reasonable opportunity and provide updates as the investigation develops. We share the available facts without delaying required notice until the investigation is complete.
We help practices assess the impact and prepare any required client or regulator notifications. Clara also follows its own reporting obligations under applicable privacy laws.
Report a suspected privacy or security incident to support@startclara.com. Include a contact method and brief description; avoid sending clinical records or passwords in the initial email.
Providers and agreements
Clara uses service providers, including subprocessors that handle personal information on our behalf, to deliver the features your practice uses. Their Data Processing Addenda (DPAs) and other privacy terms set out their responsibilities for handling and protecting that information.
| Provider | Purpose | Location | Agreement |
|---|---|---|---|
| Supabase | Clinical database, files, authentication | Canadian primary hosting; some support and operational processing outside the selected region. | DPA |
| Vercel | Application hosting and request processing | Application requests run in Canada; network delivery and operational services can involve other countries. | DPA |
| Amazon Web Services | Video, transcription, managed email, connected-inbox hosting, independent backups | Services hosted in Canada; communications delivery and support can involve other countries. | Data protection terms |
| Microsoft Azure | Text AI: questions, selected context, transcripts, drafts | Text AI runs in Canada East; abuse monitoring and support access can involve personnel outside Canada. | DPA |
| Twilio | Calls, SMS/MMS, voicemail, delivery metadata | US processing and storage; telephone networks can involve other countries. | DPA |
| OpenAI | Optional AI receptionist: realtime audio and conversational context | International processing, separate from Canadian Azure. | DPA |
| Stripe | Payments, payer information, transaction details | International processing under Stripe’s service and privacy terms. | DPA |
Clara Production has an active AWS Business Associate Addendum (BAA), effective August 28, 2026. A BAA addresses a provider’s responsibilities for protected health information under US HIPAA rules. Clara’s Microsoft Azure services are covered by Microsoft’s Business Associate Agreement (BAA), subject to its applicable service terms. Coverage depends on the services and agreement conditions.
Self-hosted software and other delivery services
Clara hosts LiveKit for video and EmailEngine for connected inboxes within its own infrastructure. These are software components, rather than separate hosted services for those workflows.
Connected mailbox and calendar providers are selected by the practice. Apple and Google deliver mobile notifications where enabled. The Privacy Policy also describes diagnostics, integrations, and website technologies.
Documentation for your practice
Our DPA sets out Clara’s responsibilities to your practice. This page summarizes our security safeguards, audit records, breach response, and backup arrangements. Contact support@startclara.com to discuss supporting documentation for your vendor assessment. Sensitive operational details and confidential agreements are reviewed before sharing.