Privacy Policy

ClinPath (“we”, “our”, or “us”) operates the website clinpath.in and related services (collectively, the “Platform”). This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, and your rights over it.

By using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information you provide directly

• Name and email address — collected when you create an account or subscribe to our newsletter. Your email is used to send account notifications, transactional emails, and (if opted in) our weekly pharma career newsletter via Brevo. You can unsubscribe from marketing emails at any time.
• Phone / WhatsApp number — collected optionally at the time of booking a 1:1 expert session. This is used solely to confirm your booking and send your Google Meet link if email delivery fails. We do not use your phone number for marketing or share it with third parties.
• College, degree, and domain of interest — collected when you use our AI tools to personalise your experience.
• CV content, job descriptions, and interview responses — submitted to our AI tools for processing. These are not stored permanently unless you explicitly save them to your account.
• Messages via contact forms or email — used only to respond to your query.

1.2 Information collected automatically

• IP address and approximate location (country / city level)
• Browser type, device type, and operating system
• Pages visited, features used, and time spent on the Platform
• Referral source (how you found ClinPath)

1.3 Analytics tools

We use Google Analytics 4 and Microsoft Clarity to understand how users interact with ClinPath. These tools collect anonymised usage data including page views, scroll depth, and click patterns. Microsoft Clarity may record heatmaps and session replays — no passwords or payment card details are ever captured.

2. How We Use Your Information

• To provide and operate the AI-powered tools on ClinPath
• To personalise your experience (e.g. remembering your domain preference and roadmap progress)
• To track your usage against free-tier limits and enforce them fairly
• To send transactional emails — booking confirmations, Google Meet links, payment receipts
• To send our weekly pharma career newsletter if you have opted in
• To contact you via phone/WhatsApp only for expert session logistics (if you provided a number)
• To process payments for Job Alerts, Pro subscriptions, or expert bookings via Razorpay
• To analyse aggregate platform usage and improve our product
• To comply with applicable Indian laws and regulations

We will never: sell your personal data to third parties, use your CV content or interview responses to train AI models without your explicit consent, or send unsolicited marketing messages to your phone number.

3. AI Tools & Data Processing

ClinPath uses Claude by Anthropicas our AI model to power the CV Builder, ATS Checker, Interview Prep, Mindset Corner, Cover Letter AI, and 90-Day Roadmap. When you use these features, your input (e.g. your CV text, the job description you paste, or your interview answer) is sent server-side to Anthropic's API.

Your inputs are processed in real time to generate a response. They are not used by Anthropic to train their models (we use the API under Anthropic's privacy-protective terms). Your API calls are not logged or stored by Anthropic beyond the duration of the request.

ClinPath stores AI outputs (generated CVs, ATS scores) only when you explicitly save them to your account. You can delete saved content at any time from your account settings.

All AI calls are made server-side through our own secure API routes. Your data is never sent directly from your browser to Anthropic — it always passes through our server, which applies rate limiting, sanitisation, and length restrictions before forwarding to the AI model.

4. ClinRadar — Job Data & How We Collect It

ClinRadar is our daily pharma job board. We collect job listing data through the following legally compliant methods:

• SerpAPI and Google Search API — we query publicly indexed pharma job listings through authorised API access. We do not bypass any access controls or authentication walls.
• Public job board listings — we access publicly visible job postings on platforms like Naukri and LinkedIn that are indexed and accessible to any internet user.
• Gmail inbox parsing— we parse job alert emails received in our own ClinPath-owned Gmail accounts that have subscribed to public job alert services. We do not access any user's personal Gmail account.

All collected job data is classified and normalised by Claude AI before being stored in our database. Job listings are not reproduced verbatim — they are processed, summarised, and structured to serve our users. We respect robots.txt directives and do not scrape at a rate that would burden any external server.

ClinRadar does not store any candidate or applicant data from external platforms — only job metadata (title, company, location, domain, posted date, source URL).

5. Data Storage & Security

Your data is stored securely on Supabase (hosted on AWS infrastructure in the Asia region). We apply:

• Encrypted connections (HTTPS) for all data in transit
• Row Level Security (RLS) so users can only access their own data
• JWT-based authentication for all API requests
• Input sanitisation on all text fields to prevent injection attacks
• Rate limiting on all AI endpoints

Payment processing is handled exclusively by Razorpay. ClinPath never stores, sees, or handles your card numbers, bank account details, or UPI IDs. Payment data goes directly to Razorpay's PCI-DSS compliant infrastructure.

While we take reasonable steps to protect your data, no internet transmission is 100% secure. We encourage you to use a strong password and keep it confidential.

6. Cookies

ClinPath uses cookies and similar tracking technologies for:

• Authentication — keeping you logged in securely
• Analytics — Google Analytics 4 and Microsoft Clarity
• Preferences — remembering your domain selection and filters

You can disable cookies in your browser settings. Authentication-related cookies are required for the Platform to function — disabling them will prevent you from logging in.

7. Third-Party Services We Use

Each service is governed by its own privacy policy. We share only the minimum data each service requires.

• Supabase — database, authentication, and secure storage
• Anthropic (Claude API) — AI model powering our tools. Inputs are processed server-side and not retained for training.
• Razorpay — payment processing (UPI, cards, net banking). We never see your payment credentials.
• Brevo (Sendinblue) — email delivery and newsletter management. Your email is added to Brevo when you subscribe.
• Google Analytics 4 — anonymised usage analytics
• Microsoft Clarity — session heatmaps (no passwords or payment data captured)
• Google Sign-In (OAuth) — optional authentication via your Google account
• SerpAPI — authorised Google Search API access for ClinRadar job scraping

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated personal data
• Opt out of marketing emails at any time (via unsubscribe link in every email)
• Request that we stop using your phone number for any purpose
• Withdraw consent for data processing (where applicable)

To exercise any of these rights, email us at privacy@clinpath.in with your registered email address. We will respond within 30 days.

9. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law — for example, payment transaction records are retained for 7 years as required by Indian GST and accounting regulations.

Phone numbers collected for expert session logistics are deleted within 90 days of the session date, unless you have booked a follow-up session.

10. Children's Privacy

ClinPath is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal information, please contact us at privacy@clinpath.in and we will delete it promptly.

11. Applicable Law

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection (DPDP) Act, 2023 and its rules, as well as the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We are committed to compliance with the DPDP Act 2023 as its provisions come into force. This includes obtaining lawful consent before processing personal data, providing clear notice of data use, and honouring data principal rights (access, correction, erasure, and grievance redressal).

For EU/EEA users: while ClinPath is primarily an India-focused platform, we acknowledge GDPR obligations and apply equivalent data protection standards. If you are located in the EU/EEA and have concerns, please contact us at privacy@clinpath.in.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top and notify you by email if the changes are material. Continued use of ClinPath after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, data access requests, or deletion requests: