Privacy isn’t the fine print.

Data residency

Clinic data, including personal health information, is stored and processed in Canada, in a Toronto data centre. Some website and form-related information may be processed outside Canada.

Access control & sign-in

Staff password logins require multi-factor authentication. Role-based permissions let clinics limit what each staff member can see and do. Contact details are hidden from staff who do not have permission to see them.

Encryption

Information is encrypted in transit. No method of transmission or storage is completely secure. Clinics remain responsible for managing user access and authentication practices.

Audit logs of chart and profile reads

Staff reads of charts and client profiles are logged. Clinics remain responsible for their own record-retention duties under applicable laws and professional standards.

Signed means read-only

Once a clinical note is signed, it is read-only. Corrections are added as addenda, so the original stays intact. For a short window set by the clinic, the author can reopen their own note. The signed version is kept and the change is recorded in the audit log.

Backups

Encrypted backups stored in Canada.

Your data & export

After a subscription ends, the clinic’s account owner may request clinic data in CSV and PDF formats for 90 days. We provide reasonable assistance so the clinic can retrieve records needed for its legal and professional duties.

Responsible disclosure

If you notice a possible security issue, email [email protected]. Describe what you found and how to reproduce it. Please leave patient information out of the report.

Policies

Read our Privacy Policy and Terms of Service, effective October 17, 2026, for our privacy practices, subscription terms and clinic responsibilities.

• Privacy Policy
• Terms of Service