Privacy Policy

1. Introduction

Welcome to Zdrovia. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you.

2. The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

• Identity Data includes first name, last name, username or similar identifier.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Usage Data includes information about how you use our website, products and services.

3. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data to provide our services to you, to communicate with you, and to comply with a legal or regulatory obligation.

4. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Patient health information entered into Zdrovia is stored in Canadian data centres and handled in line with PIPEDA, encrypted with AES-256-GCM at rest and TLS in transit. Zdrovia is built for Canadian practices operating under PIPEDA and applicable provincial health privacy legislation. We are not certified under HIPAA and do not enter into Business Associate Agreements at this time.

5. Data Retention

We keep personal data only for as long as we need it for the purpose we collected it for, and for any period we are required to keep it by law. In practice that means:

• Website enquiries and contact form submissions are kept for up to 24 months after our last correspondence with you, then deleted.
• Beta waitlist sign-ups are kept until you ask to be removed or until the beta programme ends, whichever comes first.
• Website analytics data is retained in identifiable form for no more than 12 months.
• Patient records held in the Zdrovia application belong to the practice that created them. The practice is the custodian and decides how long records are kept, in line with the retention periods its regulatory college and provincial legislation require. We retain them for as long as the practice's account is active.
• After an account is closed, clinical data remains available for export for 30 days, after which it is deleted from our production systems. Encrypted backups containing that data are cycled out within a further 30 days.
• Billing and tax records are kept for 7 years, as Canadian tax law requires.

You can ask us to delete personal data we hold about you at any time by writing to the address below. Where we are legally required to keep something, we will tell you what we are keeping and why.

6. Third-Party Service Providers

We use a small number of service providers to run Zdrovia. They process data on our instructions only, under contract, and are not permitted to use it for their own purposes. Our current providers are:

• Cloudflare — hosting, content delivery, and database storage for this website and the Zdrovia application. Patient data is held in Canadian data centres.
• Stripe — payment processing for practices that take payments through Zdrovia. Card details are entered directly into Stripe and are never stored on our systems. Payments settle into a Stripe account belonging to the practice, and Stripe acts as an independent controller of that data under its own privacy policy.
• PostHog — product and website analytics. Analytics events are processed on infrastructure located in the United States.
• Amazon Simple Email Service (Amazon SES) — delivery of transactional email such as appointment reminders, form links, and replies to enquiries.

Where a provider processes data outside Canada, that data is subject to the laws of the country it is processed in, and we rely on contractual protections to keep it safe. We will update this list when our providers change. We do not sell personal data, and we do not share it with third parties for their own marketing.

7. Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at privacy@zdrovia.ca.