Privacy Policy

ClinicTimeOS Inc. (“ClinicTimeOS”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices available to you.

1. Who we are #

ClinicTimeOS Inc. is a federal Canadian corporation. Our registered office is 6-2160 Highway 7, Suite 584, Concord, ON L4K 1W6, Canada.

We provide cloud practice-management software for rehabilitation and related clinics in Canada (other than Quebec), including physiotherapy, chiropractic, massage therapy, and similar practices. The software supports scheduling, online booking, client charts and SOAP notes, intake forms, billing, insurance claims, a client portal, and messaging (the “Services”).

Our marketing website is hosted on Cloudflare Pages. Contact and demo enquiries are currently handled by email. Any website contact or demo form we enable is protected by Cloudflare Turnstile.

2. Scope of this policy #

This policy applies to:

• Website visitors who use clinictimeos.com or any other site we operate to learn about us, request a demo, or contact us.
• Clinic customers and their authorized staff who create or use a ClinicTimeOS account (including practice owners, administrators, and practitioners).
• Patients and clients of clinics whose information a clinic enters into, or collects through, the Services (for example, through online booking, intake forms, charts, billing, claims, the client portal, or messaging).

This policy does not apply to a clinic’s own privacy practices outside the Services, or to third-party websites, payment processors, insurers, or messaging providers that a clinic chooses to use. Those organizations have their own policies.

We do not currently offer the Services to clinics or practitioners located in, or operating a practice in, Quebec. If you visit our website from Quebec, this policy still describes how we handle information collected through the website.

3. Our role and the clinic’s role #

Privacy law treats different kinds of information, and different relationships, in different ways.

Clinics are responsible for their patients’ and clients’ health information. Under the applicable provincial or territorial health privacy law, the clinic is the health information custodian, trustee, or equivalent (in this policy, a “custodian/trustee”). The clinic decides why that information is collected and how it is used in the course of care, administration, and billing. If you are a patient or client, your clinic is usually the organization you should contact first about your health record.

We act for the clinic when we process that health information. ClinicTimeOS provides the software the clinic uses to hold and work with personal health information. In that role we act as the clinic’s agent, electronic service provider, information manager, or equivalent under the applicable provincial or territorial health privacy law. We process personal health information only on the clinic’s instructions and only as needed to provide, maintain, secure, and support the Services. We do not use patient or client health information for our own marketing.

We are the organization responsible for some other personal information. For information we collect for our own business purposes — for example, from website visitors, demo or contact requests, and clinic account, billing, and support records — ClinicTimeOS is the organization responsible under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial private-sector privacy laws such as Alberta’s or British Columbia’s Personal Information Protection Act.

The health privacy law that applies to a clinic’s patient and client records is the law of the province or territory where the clinic operates. Depending on the clinic’s location, that may include, for example:

• Ontario: Personal Health Information Protection Act, 2004 (PHIPA)
• Alberta: Health Information Act (HIA)
• British Columbia: Personal Information Protection Act (PIPA)
• Manitoba: Personal Health Information Act (PHIA)
• Saskatchewan: Health Information Protection Act (HIPA)
• Nova Scotia: Personal Health Information Act (PHIA)
• New Brunswick: Personal Health Information Privacy and Access Act (PHIPAA)
• Newfoundland and Labrador: Personal Health Information Act (PHIA)
• Prince Edward Island: Health Information Act (HIA)
• the health privacy laws of Yukon, the Northwest Territories, and Nunavut, as applicable

This list is for convenience only. The current wording of the applicable statute or regulation governs. We refer throughout this policy to “applicable provincial or territorial health privacy laws” rather than to any one of these statutes alone.

4. Key terms #

Personal information means information about an identifiable individual. It can include a name, home address, telephone number, email address, payment details, and other information that identifies a person or can reasonably be used, alone or with other information, to identify a person. It does not usually include information that is publicly available from sources such as a public telephone or professional directory, or information that has been de-identified so that it can no longer reasonably identify anyone.

Personal health information (sometimes called health information under a particular statute) has the meaning given in the applicable provincial or territorial health privacy law. In general, it is identifying information about an individual’s physical or mental health, the health care provided to them, payments or eligibility for health care or coverage, a health number, or a substitute decision-maker, and other identifying information contained in a health record. If a summary in this policy differs from the statute that applies, the statute prevails.

Clinic data means the information a clinic or its users enter into, upload to, or collect through the Services, including personal information and personal health information about patients, clients, staff, and the clinic’s operations.

5. Personal information we collect #

We collect only what we need for the purposes described in this policy, and we collect it by fair and lawful means.

5.1 Website visitors #

If you browse our website, we may collect technical information such as your IP address, browser type, device type, general location derived from your IP address, pages viewed, referring URL, and the date and time of your visit. See section 15 on cookies and similar technologies.

If you complete a contact or demo form, or email or otherwise contact us, we collect the information you choose to provide. That typically includes your name, email address, telephone number, clinic or organization name, role, province or territory, and the content of your message.

If we enable a website contact or demo form, it uses Cloudflare Turnstile, which may process technical information used to distinguish people from automated traffic.

5.2 Clinic customers and staff users #

When a clinic opens or manages an account, and when staff sign in and use the Services, we may collect:

• account and profile details (name, role, professional designation or licence number if the clinic provides it, email, telephone number, and login identifiers)
• clinic business details (legal name, operating name, address, province or territory, and billing contacts)
• billing and payment information needed to charge subscription fees, including tax registration details where relevant (card details are typically handled by our payment processor, not stored in full by us)
• support communications and related records
• security and usage logs, such as sign-in events, permission changes, and features used

We require multi-factor authentication for staff password logins.

5.3 Patients and clients of clinics #

We do not collect personal health information from patients or clients for our own purposes. A clinic may collect and store in the Services information such as:

• identity and contact details, date of birth, emergency contacts, and substitute decision-maker information
• health history, intake answers, appointment records, clinical notes (including SOAP notes), treatment plans, and documents the clinic or the individual uploads
• billing, insurance, and claims information, including health numbers or policy numbers the clinic records
• portal and messaging activity between the individual and the clinic

The clinic determines what it collects and is responsible for collecting only what it is authorized to collect. Patients and clients who use online booking, intake forms, or a client portal do so at the clinic’s invitation and under the clinic’s direction.

5.4 Information from others #

We may receive information from the clinic that invited you to use the Services, from a payment processor about the status of a payment, or from a service the clinic directs us to connect (for example, an insurer or messaging provider). We may also receive information you make available when you correspond with us.

5.5 De-identified and aggregated information #

We may create de-identified or aggregated information that no longer reasonably identifies an individual (for example, feature-usage statistics). We may use and share that information to operate, secure, and improve the Services and to understand product trends. We will not attempt to re-identify it except as permitted or required by law (for example, to test our de-identification methods or investigate security incidents).

6. How we use personal information #

6.1 Information we are responsible for (website, accounts, and billing) #

We use personal information of website visitors, clinic customers, and staff users to:

• operate, secure, and improve our website and the Services
• respond to enquiries, demo requests, and support questions
• create and administer accounts, authenticate users, and enforce role-based permissions
• process subscription fees, issue invoices, and meet tax and accounting duties
• communicate about the account, service changes, security, and (where permitted) our products
• detect, investigate, and prevent fraud, abuse, and security incidents
• keep records and comply with applicable law

6.2 Clinic data, including personal health information #

We use clinic data, including personal health information, only to provide the Services to that clinic, and only on the clinic’s instructions. That includes:

• storing, displaying, and transmitting the information so authorized clinic staff and, where the clinic enables it, patients or clients can use scheduling, charts, intake, billing, claims, portal, and messaging features
• maintaining security, backups we may make as part of operating the Services, audit logs, and troubleshooting
• sending insurance or other claims to an insurer or claims network (including, if the clinic uses it, a service such as TELUS eClaims) only when the clinic directs us to do so
• sending emails or text messages the clinic initiates or configures (for example, appointment reminders), through service providers the clinic’s use of the feature requires
• assisting the clinic with access, correction, export, deletion, or breach-response requests as required by law or our agreement with the clinic

We do not sell personal information. We do not use personal health information to market our products to patients or clients.

7. Consent and other legal authority #

Where PIPEDA or applicable provincial private-sector privacy law requires consent for a collection, use, or disclosure we control, we will obtain it, or we will rely on implied consent where that is appropriate in the circumstances (for example, when you clearly volunteer information for a stated purpose). You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we may not be able to provide all or part of the website features or Services that depend on that information.

Clinics are responsible for obtaining the consents, or relying on the other legal authority, that applicable provincial or territorial health privacy laws require before they collect, use, or disclose personal health information, and before they instruct us to process it (including through online booking, intake, the client portal, messaging, or claims). By submitting clinic data to the Services, the clinic represents that it has the authority to do so.

We may also collect, use, or disclose personal information without consent where applicable law permits or requires it, including to investigate a breach of an agreement, to protect us or others from fraud or serious harm, or to comply with a court order, lawful demand, or statutory duty.

8. When we disclose personal information #

We disclose personal information only as described in this policy or as you (or, for clinic data, the clinic) direct.

At the clinic’s direction. Authorized clinic users can see clinic data in accordance with the permissions the clinic sets. If the clinic enables a client portal or messaging, patients or clients will see the information the clinic makes available to them. If the clinic directs a claim to an insurer or claims network, or sends a message through an email or SMS provider, the information in that claim or message is disclosed to that organization at the clinic’s direction. After that disclosure, the recipient’s own practices apply.

Service providers. We use other organizations to help us operate the website and the Services (see section 9). They may access personal information only as needed to perform work for us, and they are expected to protect it.

Legal and safety reasons. We may disclose information if we reasonably believe it is required by law, a court, a regulator, or a lawful demand, or if it is necessary to protect the rights, safety, or property of ClinicTimeOS, a clinic, an individual, or the public.

Business transactions. If we consider or complete a merger, corporate reorganization, financing, or sale of all or part of our business, personal information may be disclosed to advisors and prospective transferees under appropriate confidentiality arrangements, and transferred to a successor that continues to be bound by privacy obligations consistent with this policy and applicable law.

With consent. We may disclose information in other ways if we have the appropriate consent.

We do not sell, rent, or trade personal information.

9. Service providers and subprocessors #

We use service providers (sometimes called subprocessors) to host infrastructure, process payments, protect the website from automated abuse, deliver email or other messages, and provide similar operational support.

Our current subprocessors include Oracle Cloud Infrastructure, which hosts clinic data in Canada; Cloudflare, which provides website hosting, security, and DNS; and providers of email delivery, SMS, and payment processing. A current named list of these organizations is available on request at [email protected]. We will notify clinics of material changes to our subprocessors.

Our marketing website is hosted on Cloudflare Pages, and any enabled contact or demo form uses Cloudflare Turnstile. We do not use third-party analytics or advertising cookies. Cloudflare may use privacy-focused, cookieless aggregate analytics and strictly necessary security cookies.

A clinic may also choose to connect third-party tools, such as a payment processor, an insurer or claims network, or an SMS or email delivery provider. Those tools are not our service providers for the clinic’s use of them. The clinic is responsible for reviewing the third party’s terms and privacy practices before enabling the connection.

10. Where information is stored #

Clinic data, including personal health information held in the Services, is stored and processed in Canada, on Oracle Cloud Infrastructure in the Toronto (Canada) region.

We do not intend to store or process that clinic data outside Canada. If that ever has to change, we will update this policy and, where required, give affected clinics prior notice so they can meet their own legal duties.

The marketing website and any enabled contact or demo form use Cloudflare (Pages and Turnstile). Information collected or processed in the course of delivering and protecting that website, including technical and form-related information, may be processed outside Canada.

If personal information is processed outside the province or country where you live, it may be subject to the laws of the place where it is processed, including lawful access by courts, law enforcement, and national security authorities in that place.

11. How long we keep information #

We keep personal information only as long as it is needed for the purposes described in this policy, or as long as applicable law requires.

• Website enquiry records are kept for as long as needed to respond and for a reasonable period afterwards for follow-up, security, and record-keeping.
• Clinic account, billing, and support records we are responsible for are kept for the life of the account and for seven (7) years afterwards, for tax and legal requirements.
• Clinic data, including personal health information, is retained in the Services for as long as the clinic’s subscription remains active and the clinic chooses to keep it there. The clinic is responsible for its own retention rules under applicable provincial or territorial health privacy laws and professional standards.
• After a subscription ends, the clinic’s account owner may export clinic data in CSV and PDF formats for ninety (90) days, as described in our Terms of Service. After that window, or after the clinic asks us to delete the data sooner where we can lawfully do so, we will delete or irreversibly de-identify clinic data from production systems within thirty (30) days, and from backups within a further ninety (90) days, except where the law requires us to retain it.

When personal information is no longer required, we will destroy, erase, or de-identify it in a secure manner.

12. Safeguards #

We use administrative, technical, and physical safeguards that are reasonable in light of the sensitivity of the information, its amount, and the purposes for which it is used. Measures in place today include:

• multi-factor authentication required for staff password login
• role-based permissions, so a clinic can limit what each staff user can see and do
• server-side masking of contact details from staff who do not have permission to see them
• audit logs of staff reads of charts and client profiles; if the audit record cannot be written, the read is blocked
• encryption of information in transit

We do not claim any particular security certification (including SOC 2 or ISO 27001) and we do not describe ourselves as “certified” under any health privacy statute or insurer program.

No method of transmission or storage is completely secure. Clinics remain responsible for managing user access, choosing strong authentication practices for their staff, and using the permission and audit features we provide.

Access to personal information within ClinicTimeOS is limited to people who need it to perform their work, such as support, security, operations, or billing, and those people are subject to confidentiality obligations.

13. Privacy breaches #

A privacy breach includes the loss of, or unauthorized access to or disclosure of, personal information or personal health information.

Clinic data. If we become aware of a breach involving clinic data, we will notify the affected clinic at the first reasonable opportunity and, in any event, without unreasonable delay. We will provide information the clinic needs, to the extent we reasonably have it, so the clinic can meet its duties under applicable provincial or territorial health privacy laws. Those duties typically include assessing the incident, containing it, notifying affected individuals, and, where required, notifying the relevant provincial or territorial privacy commissioner or ombudsperson. We will cooperate with the clinic in good faith on investigation, containment, and required notices. The clinic, as custodian/trustee, remains responsible for deciding whether and how to notify individuals and the applicable commissioner, except where the law also places a direct duty on us.

Information we are responsible for. If a breach of our security safeguards involves personal information we hold as the organization responsible under PIPEDA (or applicable provincial private-sector privacy law), and the breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada (and any other authority the law requires) and notify affected individuals, as required by law.

We will keep a record of breaches of security safeguards as required by applicable law.

14. Your privacy rights #

Your rights depend on who holds the information and which law applies.

14.1 If you are a patient or client of a clinic #

Requests to access, correct, or learn more about personal health information in your clinic record should be made to your clinic first. The clinic is the custodian/trustee of that record. We do not independently decide whether to grant access to, or correct, a clinic’s health records.

If you contact us instead, we will explain this and, where appropriate, direct you to the clinic. We will assist the clinic as required by applicable law and by our agreement with the clinic.

14.2 If you are a website visitor, clinic customer, or staff user #

For personal information that ClinicTimeOS holds about you for its own purposes, you may ask us to:

• tell you whether we hold personal information about you, and provide access to it, subject to limited exceptions in applicable law
• explain how we have used it and to whom we have disclosed it, in general terms
• correct information that is inaccurate or incomplete
• withdraw consent where consent is the basis for our use, subject to legal or contractual restrictions and reasonable notice

We will need to verify your identity before fulfilling a request. We will respond as soon as we reasonably can and within the time applicable law allows. Under PIPEDA, that is generally 30 days, with a possible further 30 days in limited circumstances, in which case we will tell you of the extension and of your right to complain to the Office of the Privacy Commissioner of Canada.

Access is provided at minimal or no cost. If a fee may apply, we will tell you the approximate amount before we proceed. If we refuse a request, we will explain the reasons, subject to any legal limits on what we can say, and tell you about the complaint options in section 21.

You may also be able to review or update some account information by signing in to the Services.

14.3 Other rights #

Depending on the law that applies to you, you may have additional rights, such as the right to request deletion or to challenge our compliance with this policy. We will honour those rights to the extent they apply. We may retain information when we are legally required or permitted to do so (for example, billing records we must keep under tax law).

15. Cookies and similar technologies #

Our website and, where relevant, the Services may use cookies and similar technologies. A cookie is a small file stored on your device that helps a site function, remember preferences, or understand how the site is used.

We use cookies or similar technologies only as needed to operate and secure the website and the Services (for example, to keep you signed in and to support Cloudflare Turnstile). We do not use third-party analytics or advertising cookies. Cloudflare may use privacy-focused, cookieless aggregate analytics and strictly necessary security cookies.

You can usually set your browser to refuse cookies or to alert you when a cookie is set. If you block cookies, some features may not work properly.

16. Children and minors #

Our website and clinic accounts are intended for clinics and adult practitioners, not for children. We do not knowingly enter into a customer relationship with a person who is not old enough to agree to our Terms of Service.

Clinics may use the Services to care for, and keep records about, patients or clients who are minors. The clinic is responsible for ensuring that any collection, use, or disclosure of a minor’s personal information or personal health information is permitted under applicable law, including rules about consent, capacity, and substitute decision-makers. Those rules vary by province and territory and often depend on the individual’s capacity to understand the decision, not only on a fixed age.

If you believe a child has provided personal information to us through our website other than in the course of clinic care, please contact us and we will take appropriate steps.

17. Marketing messages and Canada’s anti-spam law #

We may send you commercial electronic messages (for example, email about our products or events) only with consent as required by Canada’s Anti-Spam Legislation (CASL), or where CASL otherwise permits the message (including certain messages to people with whom we have an existing business relationship).

Each commercial electronic message will identify us, provide a way to contact us, and include a working unsubscribe mechanism. We will honour an unsubscribe request without delay and no later than 10 business days after we receive it. Transactional or account messages (such as invoices, security alerts, or service notices) are not marketing and may still be sent as needed to provide the Services.

Clinics that send messages to their patients or clients through the Services are responsible for complying with CASL and any other law that applies to those messages.

18. Links to other sites #

Our website or the Services may contain links to third-party sites or services. We are not responsible for their privacy practices. We encourage you to read their policies before providing information to them.

19. Accuracy #

We take reasonable steps to keep the personal information we are responsible for as accurate, complete, and up to date as necessary for the purposes for which it is used. We rely on you and on clinics to provide accurate information and to tell us, or to update the account, when that information changes.

Clinics are responsible for the accuracy of clinic data they enter into the Services, and for correcting it when a patient, client, or applicable law requires a correction. If we have disclosed inaccurate personal information that we are responsible for, we will, where appropriate, notify the organizations that received it.

20. Changes to this policy #

We may update this policy from time to time to reflect changes in our practices, the Services, or the law. We will post the updated policy on our website and change the effective date. If we make a material change, we will provide additional notice that is reasonable in the circumstances, such as a notice on the website or an email to the clinic’s account contact.

The updated policy applies from the effective date. If you continue to use the website or the Services after that date, the revised policy applies to later collection, use, and disclosure. We encourage you to review this page periodically.

21. How to contact us and how to complain #

Questions, access or correction requests, and privacy complaints about ClinicTimeOS should be sent to our Privacy Officer:

Privacy Officer
Email: [email protected]
ClinicTimeOS Inc.
6-2160 Highway 7, Suite 584
Concord, ON L4K 1W6
Canada

Please include enough detail for us to understand and respond to your request. We have a process for receiving and responding to privacy questions and complaints, and we will describe it to anyone who asks.

If you are a patient or client and your concern is about a clinic’s health record or the clinic’s own privacy practices, please contact the clinic first. You may also have the right to complain to the privacy commissioner, ombudsperson, or other statutory authority in the province or territory where the clinic operates.

If you are not satisfied with our response, you may contact:

• the Office of the Privacy Commissioner of Canada, which oversees PIPEDA, at priv.gc.ca or 1-800-282-1376
• where a provincial private-sector or health privacy law applies, the privacy commissioner or ombudsperson for that province or territory (for example, the Information and Privacy Commissioner of Ontario, the Office of the Information and Privacy Commissioner of Alberta, or the Information and Privacy Commissioner for British Columbia)

You do not need to hire a lawyer or consultant to file a complaint with a privacy commissioner. Commissioners generally expect you to raise the issue with the organization first.

This policy is written in Canadian English. Nothing in this Privacy Policy creates contractual rights or contractual liability beyond our Terms of Service. Our contractual obligations, and the limits of our liability, for the website and the Services are set out in the Terms of Service. This sentence does not limit any right or duty that applicable privacy or health-information law creates and does not allow to be limited.