Legal
Privacy policy
A working draft prepared for legal counsel to finalize before launch.
Placeholder policy text. Final wording must be reviewed and approved by legal counsel and a designated privacy officer before public launch.
What we collect
- Account details for saved providers, Care Lists and saved search preferences.
- Care-search request details: provider type, location, preferred language, accessibility needs, availability preference, whether new patients are required, contact details and your consent to route the request.
- Privacy-conscious product analytics events.
What we deliberately do not collect
We do not collect medical history, diagnoses, symptoms, medication lists or insurance identifiers. Do not include private medical details. This service helps locate providers and does not provide diagnosis, emergency care, or medical advice.
Analytics events never contain patient names, transcript text, diagnoses or other sensitive medical information.
Future clinical documentation (Visit Notes)
Visit Notes currently operates in demonstration mode with synthetic, fictional encounters only. Live patient recording is disabled by default and cannot be enabled unless platform administrators record completed legal, privacy, security, data-residency, subprocessor and penetration-test reviews and set production authorization.
The architecture is prepared for encryption in transit and at rest, tenant isolation, role-based access control, MFA, immutable audit events, configurable audio and transcript retention, secure deletion, data export, a subprocessor registry, breach response, Canadian data residency configuration, U.S. deployment separation, business associate agreement tracking, and privacy, security and penetration-test records.
The existence of these controls does not mean the platform is PHIPA compliant, HIPAA compliant, or regulator approved.
Retention
- Raw audio is deleted after successful processing unless a clinic explicitly selects an approved retention policy.
- Transcript retention is configurable by clinic policy.
- Generated notes are retained only for a clinic-approved purpose and configuration.
Real-estate and advisor information
Property-interest responses are private, are not publicly exposed, and are not sold or broadly distributed. An approved advisor may contact a professional only with explicit permission. Real-estate advisory participation is optional, private, and permission-based.
Contact
privacy@healthconnectcentre.ca · FirstPoint Care