Privacy Policy

1. Overview

CareChain handles personal and health information with care, and aligns its practices with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25. This policy explains what we collect, how we use it, when we share it, and the choices you have. It applies to patients, providers, and partners who use the service.

2. What we collect

We collect information you provide and information generated as you use the service:

• Account and contact details: your name, email, and the role you use CareChain in.
• Health information: the clinical details relevant to your assessment and care plan, provided by you or your provider.
• Usage data: how the service is used, to keep it secure, reliable, and improving.

We collect only what is needed for the purposes described below.

3. How we use information

We use information to deliver and coordinate care: to schedule and conduct assessments, to support providers' clinical decisions, to route referrals and return outcomes to your referring physician, to process payments and eClaims, and to answer your enquiries. We also use de-identified information to measure and improve outcomes. We do not sell personal information.

4. Personal health information

Your personal health information is held to a higher standard. Access is restricted to the providers involved in your care and the staff who support the service, on a need-to-know basis, with access controls and audit logging. We act as a custodian or processor of health information in line with applicable health-information law, and we use it only for your care and the purposes you would reasonably expect.

5. When we share information

We share information only as needed to provide the service or as required by law:

• with the allied health providers and specialists involved in your care;
• with your referring physician, so the loop is closed;
• with service providers (for example, payment and infrastructure partners) under contracts that require comparable protection;
• where required by law, regulation, or a valid legal request.

We do not share your information for advertising.

6. Data residency

Personal and health information of Canadian users is stored within Canada, and our partners are held to comparable protection and Canadian residency requirements. This keeps your information subject to Canadian privacy law and the safeguards described in this policy.

7. Your rights and choices

You have the right to access the personal information we hold about you, to ask us to correct it, and to request its deletion where the law allows. Quebec residents have additional rights under Law 25, including rights around automated decision-making and data portability. You can exercise these rights through the contact below, and we will respond within the timelines the law requires.

8. Retention and security

We keep information only as long as needed for the purposes in this policy or as required by law, and then delete or de-identify it. We protect information with encryption in transit, access controls, audit logging, and regular security review. No system is perfectly secure, but we work to safeguard your information and to notify you and the relevant authorities if a breach affecting you occurs.

9. Contact us

Questions, requests, or concerns about your privacy can be sent to our privacy officer at privacy@carechain.ca. If you are not satisfied with our response, you may escalate to your provincial privacy regulator or to the Office of the Privacy Commissioner of Canada.