Security and data handling

The CMO Dashboard works on daily totals, not patient records. Here is exactly what we collect, how we store it, and who can see it.

Data handling

The CMO Dashboard connects to Google Ads, call tracking, and CRM sources that you choose. Credentials for connected accounts are encrypted on our servers.

You can disconnect any source at any time. Data from a disconnected source is kept for 30 days in case you reconnect, then deleted automatically. Email info@clicktuitive.com to have it deleted sooner, with a deletion certificate.

Aggregation

Call data is stored as daily totals. CRM exports pass through a HIPAA-safe relay that keeps only aggregates and one-way hashed keys.

Any count under 5 is shown as "under 5" so small numbers cannot point to an individual.

The website pixel records clicks, scrolls and page paths only: no screen recording, nothing typed is captured, country-level location only. Raw events are deleted after 90 days.

Access scopes

Google Ads access is read-only by default and limited to the accounts you select. The dashboard does not write to your Google Ads account. Recommended changes go through an approval queue and are applied by your team.

Inside a workspace, roles control who can see which clients and settings. Agency users only see the clients they are assigned.

Authentication and MFA

Users sign in with a work email and password or a one-time email link; two-factor authentication with an authenticator app is available for every account. Sensitive actions are recorded in an audit log.

PHI policy

The dashboard is designed so it does not need protected health information. We do not store caller or patient names, phone numbers, email addresses, recordings, transcripts, or medical record numbers.

Please do not upload files containing PHI. Call data is stored as daily totals. CRM exports pass through a HIPAA-safe relay that keeps only aggregates and one-way hashed keys.

Full details are in our Privacy Policy and Terms of Service.

Book a demo