Privacy
Educational information only — not medical advice. Clinic Compass is not a doctor and does not provide diagnosis or treatment. Always confirm with a licensed clinician. In an emergency, call 911 or your local emergency number.
Privacy
Privacy & data protection
Clinic Compass is designed so that even the people who run the site can't casually browse your health information. Here's what protects it — and where those protections stop.
Encrypted in transit (HTTPS/TLS)
Every request between your browser and our servers travels over HTTPS with modern TLS. Nothing you type — profiles, dates of birth, anatomy, ancestry, symptoms, or prep notes — moves across the network in plaintext, on public Wi-Fi or anywhere else.
Encrypted at rest
When you're signed in, your data is stored in a managed Postgres database with disk-level AES-256 encryption. Automated backups are encrypted the same way. Passwords are never stored — email sign-in uses a salted, hashed credential handled by the auth service, and Google sign-in never sends a password to us at all.
Row-level access rules
Every table that holds your information has a database policy that only returns rows matching your signed-in account (auth.uid() = user_id). Those rules are enforced by the database itself, not by app code — so even if a bug in the app tried to fetch someone else's profile, completions, metrics, or reminders, the database would refuse. One signed-in user cannot see another user's rows.
Guest mode (not signed in)
If you use the site without signing in, your profiles and completed items are saved in your browser's local storage on this device only. That data never leaves your device — but it also isn't encrypted by us. It's protected by your device login and browser sandbox, which means anyone with access to your unlocked browser profile could read it. Signing in moves your data into the encrypted cloud store above; signing out wipes the local copy.
You can wipe everything
Delete a profile from the profile switcher to clear its data locally. To permanently remove your cloud account and every row tied to it — profiles, completions, metrics, reminder preferences, and your login — go to Account settings → Delete account and type DELETE to confirm. Deletion runs immediately and is irreversible.
What we don't claim
We do not offer end-to-end encryption where only you hold the key. That means the infrastructure that runs Clinic Compass (Lovable Cloud, on Supabase's open-source stack) could technically access the underlying rows the same way any hosted service can — we just don't, and the row-level rules above stop the app itself from doing so. We never sell, share, or expose your data to advertisers, clinicians, insurers, or other users, and it is never used to train AI models.
Your controls
You can export your data, delete a single profile, or permanently delete your entire account and login at any time from Account settings.
This is not medical advice. Clinic Compass is an educational tool to help you prepare for a walk-in visit. It does not create a doctor–patient relationship, does not diagnose or treat any condition, and is not a substitute for the judgement of a licensed healthcare professional who knows your history. Never delay, avoid, or change medical care because of something you read here. In an emergency, call 911 or your local emergency number.
Your information stays private. Anything you enter — profiles, dates of birth, anatomy, risk factors, completed tests, symptoms, and prep notes — is stored on your own device and, if you sign in, in your private account. It is never shared, sold, or shown to other users, advertisers, or clinicians. Only you can see the data in your account, and you can delete a profile or sign out to wipe local data at any time.