Scope and Applicable Agreements
HelloClinic is operated by KAKI TECH LIMITED. This page provides general information about Service security; it is not a specification of the controls included in every plan, feature, or environment.
Contractual Basis
Security obligations, service levels, support, and remedies are governed by applicable law and the accepted Terms of Service, order, SOW, service agreement, data-processing terms, and SLA, as applicable. Any conflict between those documents is resolved under the applicable agreement's order of precedence. The Privacy Policy explains the relevant personal-data practices. Unless expressly incorporated into an agreement, this page does not create additional contractual obligations or rights.
Risk and Liability Boundaries
No system can eliminate every security, interruption, or data-loss risk. This page does not guarantee uninterrupted availability, detection or correction of every vulnerability, or recovery of all data, and does not establish separate compensation or liability rules. Applicable exclusions, liability limits, and remedies are set out in the governing agreement, subject to liabilities and rights that cannot lawfully be excluded or restricted.
Changes to Security Arrangements
We may update providers, configurations, and security measures as technology, threats, and operational needs change. Updates to this overview do not amend signed agreements or remove obligations imposed by applicable law. Any agreed requirements for changes or notice continue to apply.
Security Measures and Access
We apply technical and operational safeguards according to the data, system, and risks involved. The controls available for a particular feature or connection depend on its supported capabilities and current configuration.
Infrastructure and Network Protection
Cloud, network, and security services can support hosting, traffic filtering, rate limiting, DDoS mitigation, and web application firewall controls where configured. The relevant infrastructure providers operate their own physical and platform safeguards. The use of a provider does not mean every service or control it offers is included in HelloClinic.
Transmission and Storage Protection
Supported client-to-Service connections use transport encryption such as TLS. Storage encryption, key management, and related controls depend on the data type, infrastructure, and service environment. These descriptions do not imply end-to-end encryption, customer-exclusive keys, or a particular encryption standard unless expressly agreed. Customers remain responsible for protecting downloaded, exported, printed, or otherwise independently held copies.
Authorized Operational Access
Access to Customer Data is limited to authorized personnel and providers who need it for permitted purposes such as support, maintenance, security, incident investigation, legal compliance, or agreed customer instructions, subject to applicable confidentiality and access controls. Remote connections or screen sharing require the customer's express authorization. Customers should remove unrelated or unnecessary sensitive information before a support session.
Customer Responsibilities
The clinic customer controls important aspects of how the Service is used. Customers are responsible for the people, data, devices, and processes within their control, alongside our responsibilities under applicable law and the agreement.
Accounts, Devices, and Integrations
Customers must manage authorized users and administrator permissions, protect credentials, avoid shared accounts, and promptly adjust access when staff or roles change. Use unique passwords and enable MFA where available. Customers also manage the security of their devices, browsers, networks, API credentials, and chosen integrations, including access granted to external parties.
Data Governance and Instructions
Customers are responsible for the lawfulness and accuracy of uploaded data, required notices and permissions, documented processing instructions, and the suitability of their use of the Service for their clinical and regulatory responsibilities. Providing a technical platform does not transfer the clinic's professional judgment, medical-record obligations, or responsibilities to patients to HelloClinic.
Continuity and Prompt Reporting
Customers should maintain the exports, independent records, backups, and contingency procedures needed for their operations, using available Service functions or agreed arrangements. Do not rely on the Service as the only backup or continuity measure. Promptly report suspected credential misuse, unauthorized access, or security issues, and provide reasonable assistance with investigation and containment.
Providers, Backups, and Retention
The Service relies on infrastructure and other supporting services. Provider arrangements, data locations, backup capabilities, and retention requirements are governed by the relevant configuration, applicable documents, and law.
Providers and Certification Scope
We may use providers such as Google Cloud, Cloudflare, and other hosting, storage, communications, support, payment, or security providers, subject to applicable processing and safeguard requirements. Processing may take place in Hong Kong or other locations as described in the applicable documents. A provider's certification, report, or compliance program applies only to its stated scope and does not by itself certify HelloClinic or establish the customer's compliance.
Backup and Recovery Boundaries
Where operational backups are provided, they support the relevant service arrangements and do not by themselves establish a dedicated archive or a customer-specific restoration service. Backup frequency, recovery points, recovery times, and restoration assistance are subject to the applicable agreement and technical capabilities. This page does not promise a particular recovery result or recovery deadline.
Export, Retention, and Deletion
Customers should complete required exports before any applicable access or export period ends. Return, retention, and deletion follow the Terms of Service, relevant Privacy Policy, and applicable customer agreement. Routine backups may retain data until normal rotation overwrites it, and records may be retained for lawful security, billing, dispute, or legal purposes. Deleted data may be irrecoverable; this page does not promise indefinite retention or immediate erasure of every copy.
Security Operations and Incidents
Security work is prioritized according to the nature, severity, and likely impact of the issue. Investigation, containment, and remediation may proceed in stages as reliable information becomes available.
Risk-Based Maintenance
Development and maintenance activities may include code review, testing, dependency review, vulnerability assessment, logging, monitoring, and patching appropriate to the relevant change and risk. The scope and timing depend on the evidence, impact, dependencies, and applicable obligations. Automated monitoring does not imply continuous human review or a round-the-clock support commitment.
Protective Action
Where permitted by the applicable agreement and law, we may restrict affected access, revoke credentials, isolate components, or temporarily limit features to address security or availability risks. Urgent protective action may be taken without advance notice where necessary under those terms. Customers may need to reset credentials, update configurations, or cooperate with other containment steps.
Incident Assessment and Notification
We assess suspected incidents and notify relevant customers as required by applicable law, the agreement, and applicable Privacy Policy commitments. If an incident involving Customer Data is confirmed and is reasonably likely to create a material risk to the customer, we will notify that customer without undue delay. Any earlier notification obligation continues to apply. Initial notices may be based on incomplete information and updated as the investigation progresses. Customers remain responsible for notifications required of them in their role, with our reasonable assistance as provided under the agreement.
Security Enquiries and Authorized Testing
Security enquiries, reviews, and vulnerability reports should use an appropriate channel and protect confidential information, patient data, and the operation of the Service.
Confidential Security Information
We may provide available security information in response to a reasonable request, subject to identity verification, confidentiality arrangements, and applicable obligations. This page does not grant access to source code, credentials, detailed architecture, complete logs, or other customers' data. Disclosure and audit arrangements follow the applicable agreement and legal requirements, with appropriate safeguards for sensitive information.
Written Authorization for Testing
This page does not authorize penetration testing, vulnerability scanning, load testing, or attempts to bypass access controls. Testing requires prior written authorization covering scope, timing, methods, and data handling, unless applicable law provides otherwise. Any agreed review must protect other customers and avoid disruption. Existing audit rights under an applicable agreement remain governed by that agreement.
Reports and Remediation
Please provide enough information to identify and reproduce a suspected issue without obtaining or disclosing unnecessary personal data. We may request further details and prioritize action according to validated severity, impact, and applicable obligations. Except where required by law or an applicable agreement, this page does not promise a fixed acknowledgement, remediation, or public-disclosure timetable, or any reward or payment for a report.