Privacy Policy
Version 2026-11-v1 · Effective [[TO CONFIRM: effective date]]
In brief
- What we collect
- Your name, email and password (stored as a hash), the nickname you choose, your answers and scores, and sign-in records for security. Nothing about your health, location or payments, and no advertising trackers.
- Why
- To run events, show results, keep accounts secure, and let organisers run and recognise their events.
- Who sees what
- Other players see your nickname, rank and points, never your name or email. The organiser of an event sees what it needs to run it.
- Your rights
- You can see, correct and delete your data, withdraw consent and complain, free of charge. Change your nickname and profile in Account settings.
Questions or requests: contact@zentori.tech. CliniClue is for people aged 18 or over.
Contents
This policy explains what personal data CliniClue collects, why, who can see it, how long we keep it, and the choices and rights you have.
1. Who we are
CliniClue is a live clinical diagnosis competition for medical students.
Data controller (Data Fiduciary): Zentori Technologies L.L.C-FZ ("Zentori", "we", "us"), 6th Floor, Meydan Grandstand, Nad Al Sheba, Meydan Road, Dubai, United Arab Emirates. We build and run CliniClue and decide how it uses personal data.
Event organisers. Events on CliniClue are run by organisers. The first organiser is the Global Association of Indian Medical Students (GAIMS), a not-for-profit company registered in India under section 8 of the Companies Act, 2013, through its Medical Education Society (MESOG). Each event page names its organiser. Organisers decide who is eligible for their events, the event rules and any disqualifications, and receive the information described in section 5. When an organiser uses that information outside CliniClue, for example to issue certificates or announce winners, its own privacy policy applies.
Privacy contact and Grievance Officer: Data Protection Officer, Zentori Technologies L.L.C-FZ, contact@zentori.tech. We are your single point of contact for every question, request or complaint about your personal data on CliniClue, including anything that concerns an organiser.
2. Who this policy covers
Everyone who creates a CliniClue account, registers for or plays in an event, or helps run one as staff. CliniClue is only for people aged 18 or over. If you are under 18, please do not create an account. If we learn that an account belongs to someone under 18, we will close it and delete its data.
3. What we collect
| What | When | Required? |
|---|---|---|
| Your name and email address | When you create an account | Yes |
| Your password | When you create an account. We store only a one-way hash, never the password itself | Yes |
| Nickname, the name shown in games and on leaderboards | When you set up your profile or register for an event | Yes |
| Institution and year of study | If you choose to add them | No |
| Your agreement to these terms: which versions you accepted and when, and that you confirmed you are 18 or over | When you sign up and when you register for an event | Yes |
| Registration details: the event, when you registered and checked in | When you register for an event | Yes, to take part |
| Your answers in each case: each diagnosis you submit or clue you reveal, when, and your score | While you play | Yes, to take part |
| A random device ID stored in your browser | When you join a live event, so your registration is active on only one device at a time | Yes, to take part |
| Technical data: IP address, browser type and the times you sign in | When you use the service | Yes, for security |
| Authenticator app secret and backup codes | Staff only, when two-factor authentication is set up | Staff only |
| Messages you send us | When you contact us | No |
We do not collect your date of birth, identity documents, phone number, location, health information, payment details, contacts or photos. We do not use analytics, advertising or social media trackers.
4. How we use it
| Purpose | Data used |
|---|---|
| Create and secure your account, verify your email, let you reset your password | Name, email, password hash, sessions |
| Run events: registration, check-in, live play, scoring and results | Nickname, registration details, answers, scores, device ID |
| Show results to other players and on the event screen (section 5) | Nickname, rank, points |
| Keep competitions fair: one device per player, audit trails for disputes, disqualification for cheating | Answers, timestamps, device ID, audit records |
| Let organisers run, check and recognise their events (section 5) | Nickname, registration status, results, and name and email where needed for eligibility or certificates |
| Protect the service: detect and stop abuse, investigate incidents, meet security and incident-reporting duties under Indian law | IP address, browser type, sign-in times, logs |
| Answer your questions and requests | Your messages and the details needed to identify you |
We do not sell your personal data, use it for advertising, or use it to train artificial intelligence models. Scores and rankings are calculated automatically from the published game rules. Decisions to disqualify a player are made by people, not software.
5. Who can see your information
| Who | What they see |
|---|---|
| Other players in the same event | Your nickname, rank and points. Never your name or email |
| People in the room during a live event | The event screen shows nicknames, ranks and points |
| The event's organiser (for example GAIMS) | Your nickname, registration status and results for their events. Your name and email only where the organiser needs them to check eligibility, contact winners or issue certificates, and only through access-controlled tools |
| Zentori staff | Only what they need to operate and support CliniClue, with access logged |
| Our service providers | Cloudflare (hosting, database, storage, network, email), Vercel (website hosting), Resend (email delivery) and, for security logs, Amazon Web Services in India. Each acts only on our instructions under a data processing agreement |
| Authorities | Only where the law requires it, or to protect someone's safety |
Choose your nickname with care. It is how you appear on leaderboards and on screen. Avoid your full name if you prefer not to be identified. We will not publish results on the internet, or record or livestream an event showing your nickname, unless the event page says so and you agree separately.
6. Where your data is stored
CliniClue runs on Cloudflare's global network, with its main database placed in the Asia-Pacific region where possible. The website is served by Vercel's global network. Some emails are sent through Resend in the United States. Security logs are kept in India. Zentori is based in the United Arab Emirates. Your data may therefore be processed outside India. Indian law allows this unless the Government of India restricts transfers to a particular country, and we will follow any such restriction. Our providers' data processing agreements include the European Commission's standard contractual clauses for people protected by EU or UK law.
7. How long we keep it
| Data | How long |
|---|---|
| Your account | Until you delete it, or 3 years after your last sign-in, whichever is sooner. We email you at least 48 hours before deleting an inactive account |
| Event registration, answers and scores that identify you | 12 months after the event; after that, results are kept only in a form that does not identify you |
| IP address and browser type stored with your sign-in sessions | 30 days |
| Security and system logs | At least 180 days, and from 13 May 2027 at least one year, as Indian law requires, then deleted |
| Backups | Up to 30 days on a rolling basis |
| Messages you send us | 2 years after the matter is closed |
When you delete your account we remove your profile and sign-in data straight away. Indian law requires certain processing records and logs to be kept for a minimum period; we keep those securely, use them only as the law allows, then delete them. Past results in which you appeared will show "Deleted player" instead of your nickname. Information an organiser has already exported is governed by the organiser's own policy.
8. How we protect it
Passwords are stored only as hashes. Data is encrypted in transit, and our database and storage provider encrypts it at rest. Staff tools require two-factor authentication. Access is limited to people who need it and is logged. Event access uses short-lived, single-event credentials. No system is completely secure, but if a breach affects you, we will tell you without delay, explain what happened and what you can do, and report it to the authorities as the law requires.
9. Your rights
You can, free of charge:
- Access a summary of your personal data and how we use it, and the names of the organisations we have shared it with.
- Correct or update your data. You can change your nickname and profile yourself in Account settings.
- Delete your data. You can delete your account in Account settings or ask us to. We keep only what the law requires, as described in section 7.
- Withdraw consent at any time, as easily as you gave it, by cancelling an event registration or deleting your account. This does not affect processing before you withdrew.
- Nominate someone to exercise your rights if you die or become unable to act.
- Complain to us, and if you are not satisfied, to the Data Protection Board of India.
If you are in the European Union or the United Kingdom, you also have the rights to restrict or object to processing and to data portability, and you may complain to your local data protection authority.
How to exercise your rights. Use Account settings, or email contact@zentori.tech from the address on your account. We may ask you to confirm it is you. We reply within 30 days, and always within the period the law sets. If your request concerns something an organiser did with exported data, we will pass it to them and tell you.
10. Cookies and similar technology
We use cookies and browser storage that are strictly necessary to sign you in, keep your live event session secure and let you play on one device at a time. Your browser also remembers the display theme you choose and, for hosts, unsaved case edits on that device; these stay in your browser and are not sent to us. There are no analytics or advertising cookies, so we do not show a cookie banner. See the Cookie Notice.
11. Educational content
CliniClue cases are educational exercises written and reviewed for medical students. They are not medical advice and must not be used to diagnose or treat anyone. Cases do not identify real patients.
12. Changes to this policy
We post every change on this page with a new date. If a change affects how we use your existing data, we tell you in the app or by email before it takes effect and, where the law requires, ask for your agreement again.
13. Language
This policy is available in English. You may ask for it in Hindi or any other language listed in the Eighth Schedule to the Constitution of India by writing to contact@zentori.tech.
14. Contact
Privacy contact and Grievance Officer: Data Protection Officer, Zentori Technologies L.L.C-FZ, 6th Floor, Meydan Grandstand, Nad Al Sheba, Meydan Road, Dubai, United Arab Emirates. Email: contact@zentori.tech.
Data Protection Board of India: once you have used our grievance process, you may complain to the Board through its official channels.
To read this in Hindi or another language listed in the Eighth Schedule to the Constitution of India, write to contact@zentori.tech.