Privacy Policy

1. Introduction

DrTools ("we," "us," or "our") is committed to protecting the privacy and security of personal information and personal health information entrusted to us by healthcare professionals, clinics, and their patients. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our website (www.drtools.ca) and our software products and services.

DrTools is headquartered at:

2. Applicable Legislation

DrTools is designed to comply with all applicable Canadian federal and provincial privacy legislation governing the collection, use, disclosure, and protection of personal information and personal health information, including but not limited to:

Federal Legislation

• Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada's federal private-sector privacy law governing the collection, use, and disclosure of personal information in the course of commercial activities.
• Privacy Act — Governs federal government institutions' handling of personal information.

Provincial & Territorial Health Privacy Legislation

DrTools is built to respect and comply with the health information privacy requirements of every Canadian province and territory, including:

• Ontario — Personal Health Information Protection Act, 2004 (PHIPA)
• Alberta — Health Information Act (HIA)
• British Columbia — E-Health (Personal Health Information Access and Protection of Privacy) Act
• Saskatchewan — Health Information Protection Act (HIPA)
• Manitoba — Personal Health Information Act (PHIA)
• Quebec — Act respecting health and social services information and amending various legislative provisions (Bill 3); An Act to modernize legislative provisions as regards the protection of personal information (Law 25)
• New Brunswick — Personal Health Information Privacy and Access Act (PHIPAA)
• Nova Scotia — Personal Health Information Act (PHIA)
• Newfoundland and Labrador — Personal Health Information Act (PHIA) and Pharmacy Network Regulations
• Prince Edward Island — Health Information Act
• Northwest Territories — Health Information Act
• Yukon — Health Information Privacy and Management Act (HIPMA)
• Nunavut — Access to Information and Protection of Privacy Act (ATIPPA), with health-specific legislation in development

Provincial Private-Sector Privacy Legislation

• Alberta — Personal Information Protection Act (PIPA)
• British Columbia — Personal Information Protection Act (PIPA)
• Quebec — An Act respecting the protection of personal information in the private sector (Law 25, formerly Bill 64)

3. Canadian Data Sovereignty

All personal information and personal health information processed by DrTools products is stored and processed exclusively within Canada. Specifically:

• All servers, databases, and backup systems are located in Canadian data centers.
• No personal information or personal health information is transferred, stored, or processed outside of Canadian borders.
• No foreign jurisdiction has access to data held by DrTools.
• All data processing pipelines, including AI and machine learning workloads, execute within Canadian infrastructure.
• Sub-processors used by DrTools are contractually required to maintain data residency within Canada.

This commitment to Canadian data residency ensures compliance with federal and provincial requirements regarding the jurisdiction and storage of personal health information.

4. Information We Collect

Information you provide directly

• Name, email address, phone number, and professional credentials when you request a demo, ask us to set up an account, or contact us.
• Practice information, including clinic name, address, specialty, and provincial billing number.
• Payment information for subscription services (processed by Canadian-hosted payment processors; we do not store full credit card numbers).

Personal Health Information (PHI)

When healthcare professionals use DrTools products such as PocketEMR, AI-Transcriber, or FormsMD, the software may process personal health information on behalf of the healthcare provider (the "Health Information Custodian" under PHIPA or equivalent provincial legislation). In this capacity, DrTools acts as an agent or service provider to the custodian. The healthcare provider remains the custodian of the personal health information and is responsible for obtaining any necessary patient consents.

Information collected automatically

• Log data (IP address, browser type, pages visited, timestamps) when you visit our website.
• Usage analytics to improve our products (aggregated, de-identified where possible).

5. How We Use Your Information

We use personal information for the following purposes:

• To provide, maintain, and improve our products and services.
• To process account registration, demo requests, and customer support inquiries.
• To communicate with you about your account, product updates, and service notices.
• To comply with legal obligations, including audit and reporting requirements under applicable health privacy legislation.
• To protect the security and integrity of our systems and your data.

We do not sell, rent, or trade personal information or personal health information to third parties. We do not use personal health information for marketing purposes.

6. Data Security

DrTools implements comprehensive administrative, technical, and physical safeguards to protect personal information and personal health information, including:

• Encryption at rest and in transit (TLS 1.2+, AES-256).
• Role-based access controls with principle of least privilege.
• Multi-factor authentication for all administrative access.
• Comprehensive audit logging of all access to personal health information.
• Regular security assessments and vulnerability testing.
• Incident response procedures and breach notification protocols compliant with applicable legislation.
• Employee training on privacy and security obligations.

7. Data Retention

We retain personal information and personal health information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Healthcare providers using DrTools products control the retention periods for patient health information in accordance with their obligations under applicable health records legislation and the regulations of their governing professional colleges.

8. Your Rights

Under applicable Canadian privacy legislation, you have the right to:

• Access your personal information held by DrTools.
• Request correction of inaccurate personal information.
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions.
• File a complaint with the applicable privacy commissioner if you believe your rights have been violated.

Patients seeking access to their personal health information held within a healthcare provider's DrTools account should contact their healthcare provider directly, as the provider is the health information custodian.

9. Breach Notification

In the event of a privacy breach involving personal information or personal health information, DrTools will notify affected parties and applicable privacy commissioners in accordance with the timelines and requirements of all applicable federal and provincial legislation, including PIPEDA, PHIPA, and equivalent provincial statutes.

10. Cookies & Website Analytics

Our website may use cookies and similar technologies to improve your browsing experience and gather aggregate usage data. You can control cookie preferences through your browser settings. We do not use cookies to collect personal health information.

11. Third-Party Services

DrTools may use Canadian-hosted third-party services to provide certain functionality (such as payment processing, email delivery, and infrastructure hosting). All third-party service providers are contractually required to comply with applicable Canadian privacy legislation and to maintain data residency within Canada.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notification. The most current version will always be available at www.drtools.ca/privacy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a privacy concern, please contact our Privacy Officer:

You may also contact the Office of the Information and Privacy Commissioner of Ontario at 1-800-387-0073 or www.ipc.on.ca, or the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or www.priv.gc.ca.