Legal

The documents behind the service

Your clinic is a health information custodian. Before you hand any part of that responsibility to a vendor, you are entitled to read exactly what the vendor is agreeing to. Everything is here, in plain language, without requiring a sales call first.

Draft — not yet in force

This document has not been finalised and does not create binding obligations. It still needs company details that only we can supply, and review by Canadian privacy counsel. Anything shown as [[LIKE THIS]] is a blank, not a value.

Outstanding: entityName, entityJurisdiction, registeredAddress, privacyOfficerEmail, securityEmail, supportEmail, generalEmail, governingProvince, effectiveDate.

Privacy PolicyWhat we collect, why, where it is stored, who else touches it, and how to get it back or have it deleted.
Terms of ServiceThe subscription agreement — billing and renewal, each side’s responsibilities, acceptable use, and the limits of what a security service can promise.
Cookie PolicyA short list, because we do not run analytics or advertising. Essential cookies only, plus one embed you can decline.
Data Processing AddendumThe contract terms your clinic’s regulator will ask about: our role as your service provider, breach notification timing, sub-processing, audit and deletion.
Sub-processorsWho else touches your information, what for, and where they are — including which parts leave Canada.
Vulnerability Disclosure PolicyFound a flaw in our systems? Here is how to tell us, what we promise back, and why you will not be sued for it.
Accessibility StatementThe standard we build to, what we have done, what we know is still wrong, and how to get help or give feedback.

How we actually protect your information

The policies say what we commit to. The Security page says what we do — access control, encryption, where data lives, and what happens when something goes wrong.