1) Introduction
This Privacy Policy explains how PatientQ Inc. (“PatientQ”, “we”, “us”) collects, uses, discloses, and protects personal information—including Personal Health Information (PHI)—when you use our Services. We support compliance with HIPAA (USA) and PHIPA (Ontario, Canada), with hosting in North America.
If any portion of this Policy conflicts with a signed agreement (e.g., a Business Associate Agreement), that agreement will control to the extent of the conflict.
2) Key Roles & Definitions
- Clinic (Controller/HIC/Covered Entity): determines purposes of processing; owns PHI.
- PatientQ (Processor/Agent/Business Associate): processes data on behalf of Clinics under contract.
- Personal Information (PI): info related to an identifiable individual.
- PHI: health/medical info tied to care, treatment, or payment.
- Subprocessor: third-party provider under contract to support the Services.
3) Information We Collect
- Clinic & Staff: account details, roles, settings.
- PHI: demographics, clinical notes, consents, appointments, billing, files, images.
- Usage & Device: performance metrics, logs, IP, browser/OS.
- Cookies: essential, performance, optional analytics (configurable).
4) How We Use Information
- Deliver core EMR functions and support services.
- Operate, secure, and improve PatientQ.
- Comply with HIPAA/PHIPA and legal obligations.
- Provide service announcements and product updates.
We do not sell personal information or PHI.
5) Legal Bases & Compliance (HIPAA + PHIPA)
- HIPAA: Business Associate to Clinics; BAA required; Security & Privacy Rule safeguards.
- PHIPA: Agent/Service Provider to HICs; safeguards, logging, and Clinic direction required.
6) Data Ownership & Control
Clinics own and control their PHI and content. PatientQ does not claim ownership. Clinics manage access, retention, export, and deletion subject to law.
8) International Transfers & Hosting
Data is hosted and processed in North America. Contractual and technical safeguards apply to any cross-border support operations.
9) Security Safeguards
- Encryption in transit (TLS) and at rest (e.g., AES-256 storage layers).
- Role-based access control, least-privilege, audit logs.
- Backups, redundancy, disaster recovery.
- Secure development, monitoring, incident response.
10) Retention & Deletion
Clinics define PHI retention. PatientQ retains data during subscription and for legally required periods. Upon request or termination, PatientQ deletes or returns data within a commercially reasonable period, subject to backup cycles and legal duties.
11) Your Rights
- Access and corrections (typically via your Clinic).
- Exports and portability (Clinic-initiated).
- Restriction/objection to non-essential uses.
- Complaints to regulators (e.g., HHS OCR, Ontario IPC).
12) Children’s Privacy
PatientQ is not marketed to children. Clinics may process minors’ data where lawful; guardians’ rights and consents are managed by the Clinic.
13) Communications, Email & SMS
- Operational messages (security, maintenance).
- Patient notifications at Clinic direction (appointments, consents).
- Opt out of non-essential marketing at any time.
15) Subprocessors
PatientQ engages vetted subprocessors under confidentiality and security obligations. We can provide a current list upon request from Clinics and notify of material changes where contractually required.
16) Third-Party Links & Integrations
Integrations used at a Clinic’s direction are governed by those third parties’ terms. Clinics must ensure appropriate notices and consents.
17) Do Not Track
We do not respond to browser DNT signals; we honor applicable consent and opt-out mechanisms as required by law.
18) Data Breach & Incident Notification
If a breach or impermissible disclosure occurs that triggers notification duties, we will notify Clinics without undue delay, consistent with HIPAA/PHIPA.
19) Changes to this Policy
We may update this Policy from time to time. Material changes will be communicated appropriately. Continued use after changes indicates acceptance.
20) Contact Us
PatientQ Inc.
Toronto, Canada
support@patientQ.com