Your health information.
Used for your care, not for sales.

Version 0.9 · Draft for review by Canadian health-law counsel and the responsible physician · Demonstration environment

Who is responsible

The custodian or trustee of your clinical record is [physician or clinic name — to be confirmed for each jurisdiction]. The platform is operated by [Operating entity legal name], [Business address], which acts on the custodian’s behalf as an agent or service provider under a written agreement. Our Privacy Officer is [Privacy Officer name], who can be reached at [privacy@doctorsnote.ca].

Which laws apply

Health privacy law in Canada depends on where care is provided and who provides it. The laws below are those we expect to review; counsel must confirm which apply to each physician, clinic and service before launch.

What we collect

• Identity details: name, date of birth, sex or gender as you choose to provide it, and identification used to verify you.
• Contact details: email, telephone number, mailing address and your preferred pharmacy.
• Your physical location at the time of each visit, to confirm the physician is authorized to treat you there.
• Provincial or territorial health card number, only where a service is billed to a public plan.
• Intake questionnaire answers, symptoms, medical history, medications and allergies.
• Clinical notes, assessments, prescriptions, referrals, requisitions and documents prepared for you.
• Messages exchanged with the care team, and records of consent.
• Payment metadata such as amount, date, status and the last four digits of a card. Full card numbers are handled only by our payment processor and are never stored by us.
• Technical information needed for security, such as sign-in times, device type and IP address, kept in access logs.

Why we use it

• To assess, treat and follow up with you, and to coordinate care with other providers you choose.
• To verify your identity, location and eligibility for insured services.
• To bill a public plan or, where a service is uninsured, to charge the fee you agreed to.
• To meet legal, regulatory and professional obligations, including record-keeping and quality review.
• To keep the service secure and investigate misuse.

When we disclose it

We disclose personal health information only with your consent, or where the law permits or requires it. Typical disclosures are:

• To the pharmacy you choose, so a prescription can be dispensed.
• To your provincial or territorial health plan, when billing an insured service.
• To an employer, school, insurer or other recipient only when you ask us to send a document, and only the information you agreed to include.
• To your regular health-care provider, when you consent to a visit summary being sent.
• Where required by law, such as mandatory reporting, a court order, or to prevent serious harm, and to professional regulators as the law requires.

What we never do

• We do not sell personal information or personal health information.
• We do not use personal health information for marketing or advertising.
• We do not send clinical information to marketing or sales customer-relationship-management (CRM) systems.
• We do not share clinical information with an employer, school or insurer unless you instruct us to.

Service providers

We rely on service providers for hosting, video and telephone, secure messaging, email delivery and payment processing. Each one is bound by a written agreement that limits its use of information to providing the service, requires appropriate safeguards and requires it to report security incidents to us.

Storage location: [Canadian data residency to be confirmed]. Some laws restrict or require notice of storage or access outside a province or outside Canada; any such arrangement will be described here before launch.

How long we keep records

Medical records are retained for the period required by the applicable medical regulator and law, which differs by province and territory. Many Canadian regulators require at least ten years from the last entry for adults, and longer for minors, often counted from the age of majority; some recommend longer. The exact period for each jurisdiction will be confirmed and stated here. Records are then securely destroyed, and a record of destruction is kept.

Your rights

• You may ask to see or receive a copy of your record. We will respond within the time set by the applicable law.
• You may ask us to correct information you believe is inaccurate or incomplete. If we do not agree, you may add a statement of disagreement.
• You may withdraw consent to certain uses or disclosures, subject to legal limits and to information already disclosed.
• You may ask who has accessed your record.

Some laws allow a reasonable fee for copies. In Quebec, physicians may not charge for access to a medical record, including its transcription, reproduction or transmission, or for preliminary review or sorting for an access request. An access request will never be relabelled as a paid summary.

Security, audit logging and breaches

We use encryption in transit and at rest, role-based access, multi-factor authentication for staff and physicians, and audit logs that record who viewed or changed a record and when. Logs are reviewed for inappropriate access.

If personal health information is stolen, lost, or accessed or disclosed without authorization, we will contain the incident, notify affected individuals and report to the privacy commissioner or other authority as the applicable law requires.

Contact and complaints

Questions, access requests and complaints can be sent to [Privacy Officer name], Privacy Officer, at [privacy@doctorsnote.ca] or [Business address]. If you are not satisfied, you may complain to the privacy commissioner in your jurisdiction, including:

• Information and Privacy Commissioner of Ontario
• Office of the Information and Privacy Commissioner of Alberta
• Office of the Information and Privacy Commissioner for British Columbia
• Commission d’accès à l’information du Québec
• Office of the Privacy Commissioner of Canada

Other provinces and territories have their own information and privacy commissioners or ombudspersons.

Related policies

• Informed consent to virtual care
• Webinars and recordings
• Complaints and concerns