Data portability register

A stable map of the Clinilo tenant export.

This public register describes the machine-readable archive available to a clinic owner, including its files, data structures, value conventions, exclusions and provider boundaries.

Authenticated owner export

Every clinic receives the same export interface and the archive allowed by its current processing mode at no additional charge. There is no paid faster export path.

Sign in with a current clinic owner membership. Administrator impersonation is blocked and managed agreement authorization must be present. When health-data processing is enabled, health-data activation must be current for the full archive; ordinary-data mode uses the separate fail-closed policy below.

Open the owner export interface

Archive format and structure

The full health-enabled archive contains 55 registered datasets and 7 supplemental datasets (62 total), plus current tenant assets.

The ordinary-data archive contains 49 registered datasets and 7 supplemental datasets (56 total), omitting 6 clinical dataset paths.

Container and records: One ZIP archive contains the export. Each database dataset is newline-delimited JSON (NDJSON) encoded as UTF-8. Tenant assets retain their binary media types.
Machine schema: schema/catalog.json · clinilo-tenant-export-v1. lists the exact output fields, source fields, removed credential or ciphertext fields, portable replacements and exclusions.
Value conventions: Timestamps use RFC 3339 / ISO 8601. Money uses integer minor units with ISO 4217 currency codes. Each NDJSON line is one JSON record.
Assets, manifest and integrity: assets/index.ndjson, checksums/sha256.txt, checksums/manifest.sha256 map tenant objects and verify archive entries and the final manifest.json.
Full and ordinary-data modes: Full mode requires current health-data activation. When health-data processing is disabled, ordinary-data mode omits the six marked clinical dataset paths, never decrypts, and fails closed if clinical rows, known legacy clinical fields, or tenant storage categories client-photos, signatures exist. It does not silently drop discovered clinical content.

Dataset paths

Every listed dataset has a stable data/dataset-name.ndjson path. An empty dataset is still present as an empty file, so consumers can use the catalog without guessing which paths exist.

tenant_expected_signed_orders is retained compatibility evidence only; it is not a new-clinic registration or contracting route.

Registered tenant datasets (55)

data/locations.ndjson
data/tenant_activation_evidence.ndjson
data/tenant_expected_signed_orders.ndjson
data/tenant_online_agreement_acceptances.ndjson
data/clinic_legal_document_adoptions.ndjson
data/tenant_health_activation_events.ndjson
data/audit_log.ndjson
data/audit_outbox.ndjson
data/job_outbox.ndjson
data/service_categories.ndjson
data/services.ndjson
data/service_withdrawal_policies.ndjson
data/staff.ndjson
data/calendars.ndjson
data/calendar_services.ndjson
data/calendar_hours.ndjson
data/service_staff.ndjson
data/resources.ndjson
data/service_resources.ndjson
data/staff_hours.ndjson
data/staff_time_off.ndjson
data/calendar_blocks.ndjson
data/clients.ndjson
data/funnel_events.ndjson
data/booking_privacy_consent_events.ndjson
data/waitlist_entries.ndjson
data/bookings.ndjson
data/booking_items.ndjson
data/booking_contract_evidence.ndjson
data/booking_health_consent_evidence.ndjson
data/booking_withdrawal_declarations.ndjson
data/booking_resources.ndjson
data/message_log.ndjson
data/message_templates.ndjson
data/user_calendar_prefs.ndjson
data/payments.ndjson
data/connect_accounts.ndjson
data/tenant_billing.ndjson
data/widget_configs.ndjson
data/domains.ndjson
data/form_templates.ndjson
data/form_submissions.ndjson
data/journals.ndjson
data/client_photos.ndjson
data/imports.ndjson
data/import_rows.ndjson
data/gift_cards.ndjson
data/gift_card_ledger.ndjson
data/packages.ndjson
data/client_packages.ndjson
data/package_redemptions.ndjson
data/invoices.ndjson
data/invoice_lines.ndjson
data/invoice_payments.ndjson
data/invoice_sequences.ndjson

Supplemental tenant datasets (7)

data/tenants.ndjson
data/organizations.ndjson
data/members.ndjson
data/users.ndjson
data/invitations.ndjson
data/sites.ndjson
data/site_sections.ndjson

Documented boundaries

The archive includes portable clinic records and tenant assets while withholding credentials and service-integrity state. Provider-only histories that Clinilo cannot supply through this export are listed separately.

Excluded service-security datasets

sessions
Live bearer tokens, IP addresses and user agents are service-security state.
accounts
Password hashes and upstream access, refresh and identity tokens are credentials.
verifications
Single-use authentication and recovery values are time-limited security secrets.
rate_limits
Raw caller-IP buckets are short-lived abuse-prevention and service-integrity state.
stripe_events
The global webhook idempotency and claim ledger is provider-integrity state. Tenant payment records and local provider references remain in their listed datasets.

External-provider boundary

Full mode includes Clinilo database rows, local provider references and every current tenant-prefixed storage object. Ordinary-data mode includes non-clinical tenant objects only after its clinical-object checks pass.

Stripe provider object bodies and Stripe dashboard history are not available through the Clinilo tenant export.
GatewayAPI delivery-portal history beyond Clinilo message_log is not available through the Clinilo tenant export.
Resend provider history beyond Clinilo message_log is not available through the Clinilo tenant export.
Sentry events and Inngest execution history are not available through the Clinilo tenant export.
R2 account-level logs, object versions and provider configuration are not available through the Clinilo tenant export. Current tenant-prefixed objects are included.

These provider-only histories are outside this export; the manifest repeats the same boundary in machine-readable form.