Legal

Privacy policy

Last updated September 2026

CWW (Care Without Waiting) is a clinic operations platform. This policy explains what data CWW stores, why, who can see it, and how it is protected.

1. Who is responsible

Each clinic that uses CWW is responsible for its own patients’ data; CWW processes that data on the clinic’s behalf.
Pharmacies see only the prescriptions a clinic’s doctor explicitly sends them.
The CWW platform operator sees business and operational aggregates and support requests — not clinical notes.

Clinic staff accounts: name, email or phone number, password (stored only as a secure hash).
Patients (per clinic): name and phone number entered at booking, appointment times, queue status, pre-visit answers if you choose to fill them.
Clinical records created by the doctor: visit notes, prescriptions, follow-ups.
Pharmacy handoffs: the prescription content needed to dispense, patient name and phone.
Security and business audit events (who did what, when) without clinical content.

To run bookings, queues, visits, prescriptions and pharmacy handoffs for the clinic you interact with.
To send appointment, prescription-ready and follow-up notifications when the clinic enables them.
To secure accounts, prevent abuse (rate limits) and investigate incidents.
Optional assistant features send the minimum necessary context to an AI provider only when a clinic enables them; AI output is always a draft reviewed by a person.

Every clinic is isolated at the database level; one clinic can never read another clinic’s data.
Access inside a clinic follows roles (owner, manager, reception, doctor). Reception does not see private clinical notes.
Patients access their own appointment through a private link; prescriptions require stronger verification.

CWW sets only necessary cookies: the sign-in session and your language choice.
No analytics or marketing cookies are used today. If that changes, the cookie banner choice will be honored first.

Encrypted connections (HTTPS), hashed passwords, per-request tenant isolation enforced by the database, audit logging, and least-privilege database roles.
Payment card numbers are never entered into or stored by CWW; payments are handled by a licensed payment provider.

Clinical and audit records are retained for as long as the clinic account is active and as required by applicable regulation.
A clinic can request export or deletion of its data through support; deletion requests are honored subject to legal retention duties.

Ask the clinic you visited to correct or delete your personal data; CWW supports the clinic in fulfilling that request.
Questions about this policy: contact CWW through the support channels published on the website.