Privacy Policy

Who we are

ClinicGem is clinic management software for allied health and wellness clinics (such as physiotherapy, chiropractic, massage therapy, acupuncture, naturopathy, and counselling) and for solo registered massage therapists (RMTs) in Canada. ClinicGem is operated by [ Insert Legal Entity Name ], a company registered in [ Insert Province of Registration ], with its office at [ Insert Business Mailing Address ] ("ClinicGem", "we", "us").

This policy explains how we handle personal information under Alberta's Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Where a clinic is subject to other laws, such as Alberta's Health Information Act, the clinic's own obligations also apply.

Our role: clinics and ClinicGem

There are two kinds of information in ClinicGem, and who is responsible for it differs.

• Clinic client records. When a clinic uses ClinicGem to book appointments, collect intake forms, write treatment (SOAP) notes, or take payments, the clinic is the organization responsible for that information. ClinicGem acts as the clinic's service provider: we store and process it only to provide the service to the clinic, under the clinic's instructions and our Terms of Service.
• ClinicGem account and website information. For information about clinic owners and team members who hold ClinicGem accounts, and visitors to clinicgem.com, ClinicGem is the responsible organization.

If you are a client of a clinic and have a question about your records, please contact your clinic first. We will help the clinic respond.

Information we collect

From clinic owners and team members

• Name, email address, phone number, profile photo, and professional details (such as practitioner credentials) you choose to add.
• Clinic business details: clinic name, address, business hours, services, and pricing.
• Subscription and billing details. Card details are collected and stored by our payment processor, Stripe; ClinicGem does not store full card numbers.
• Login and security information: sign-in times and security events.

On behalf of clinics, about their clients

• Contact and identity details: name, email address, phone number, date of birth, address, and emergency contact.
• Health information provided on intake and health-history forms, and treatment notes written by practitioners.
• Appointment history, invoices, receipts, payments, gift certificates, packages, and insurance details the clinic records.
• Uploaded files such as referral letters or photos the clinic attaches to a client record.
• Communication preferences, and the emails the clinic sends through ClinicGem.

From visitors to clinicgem.com

• Information you send us, for example when you email support.
• Essential technical information needed to run the site, such as your browser type and the pages you request. We do not use advertising or third-party analytics trackers.

How we use information

We use personal information only for purposes a reasonable person would consider appropriate:

• To provide, secure, and support the ClinicGem service.
• To create and manage accounts, and to verify the identity of people who sign in.
• To process subscription payments and send receipts and service notices.
• To send appointment confirmations, reminders, forms, and receipts on behalf of clinics.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To meet legal obligations.

We do not sell personal information. We do not use clinic client records for advertising or to train artificial intelligence models, and we do not look at clinic client records except when needed to provide support the clinic has asked for, to keep the service secure, or when required by law.

Consent

We collect, use, and disclose personal information with consent, or where PIPA or PIPEDA allow it without consent.

• Clinic client records: the clinic is responsible for obtaining its clients' consent. ClinicGem gives clinics tools such as consent fields on intake forms to help.
• Marketing emails: clinics may send newsletters and similar messages only to clients who have agreed to receive them, in line with Canada's Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link.
• Withdrawing consent: you may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawing consent may mean a clinic or ClinicGem can no longer provide some services, and a clinic may still need to keep health records for the period its professional standards require.

Service providers and storage outside Canada

We use a small number of trusted service providers to run ClinicGem. They may only use personal information to provide their service to us, and they must protect it.

When personal information is stored or processed outside Canada, it is subject to the laws of that country, and authorities there may be able to access it under those laws. You may request more information about our policies and practices for service providers outside Canada by contacting our Privacy Officer (see Contact us).

How we protect information

We use administrative, technical, and physical safeguards appropriate to the sensitivity of health information, including:

• An individual login for every person — no shared clinic accounts.
• Separation of each clinic's data at the database level, so one clinic cannot see another's records.
• Role-based permissions that let clinics control what each team member can see and do.
• Encryption of information in transit (HTTPS) and at rest by our hosting provider, plus additional encryption of payment-provider credentials.
• Tamper-resistant activity logs that record changes to client records.
• Private file storage with time-limited access links for uploaded documents.

No system is perfectly secure. You can see the current status of our privacy and security program on our Trust page [ Insert Trust Page Link ].

How long we keep information

• Clinic client records are kept for as long as the clinic keeps its ClinicGem account and directs us to keep them. Each clinic must follow the record-retention rules of its practitioners' regulatory colleges. These are often long — for example, massage therapy standards of practice in Alberta require clients' records to be kept for at least 10 years after the client's last visit (or 10 years after a minor client turns 18). ClinicGem is designed to support long retention periods like these.
• Activity (audit) logs are kept for at least 10 years.
• Billing records are kept as long as needed to meet tax and accounting laws.
• When a clinic closes its account, the clinic can export its records for [ Insert Export Window, e.g. 90 days ]. After that, we securely destroy or return the records as the clinic directs, unless the law requires us to keep them.

When information is no longer needed, we destroy it securely or make it anonymous.

Your rights

You have the right to:

• Access the personal information an organization holds about you.
• Ask for a correction if you believe it is inaccurate or incomplete.
• Withdraw consent, as described above.
• Complain about how your information has been handled.

For clinic client records, send your request to your clinic. Clinics must generally respond within 45 days under PIPA (30 days under PIPEDA). If you contact us instead, we will pass your request to the clinic and help it respond.

For ClinicGem account information, contact our Privacy Officer. We may ask you to verify your identity before we release information.

Privacy breaches

If a security incident affects personal information, we will investigate promptly and take steps to contain it. When clinic client records are involved, we will notify the affected clinic without unreasonable delay so it can meet its own obligations. Where there is a real risk of significant harm, we will notify the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada, and affected individuals, as the law requires.

Cookies

ClinicGem uses only essential cookies: cookies that keep you signed in, remember an online booking in progress, and protect against security threats. We do not use advertising or tracking cookies. Blocking essential cookies may prevent sign-in and booking from working.

Children

ClinicGem accounts are for adults. Clinics may keep records about minor clients, usually with the consent of a parent or guardian, and are responsible for handling those records appropriately.

Changes to this policy

We may update this policy as our service or the law changes. We will post the new version here with a new version number and "last updated" date, and we will notify clinic account owners of material changes before they take effect.

Contact us

Questions, requests, or complaints about privacy can be sent to our Privacy Officer:

• Privacy Officer: [ Insert Privacy Officer Name ], [ Insert Privacy Officer Title ]
• Email: privacy@clinicgem.com
• Mail: [ Insert Business Mailing Address ]

If you are not satisfied with our response, you may contact:

• Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• Office of the Privacy Commissioner of Canada — priv.gc.ca