Privacy Policy

We are a private-sector organization based in British Columbia. We provide software that medical and legal professionals use to organise clinical records and build case chronologies. We handle personal information, including personal health information, in accordance with the Personal Information Protection Act (British Columbia) ("BC PIPA") and, where we process health information on behalf of a health information custodian in Ontario or a custodian in Alberta, with the Personal Health Information Protection Act (Ontario) or the Health Information Act (Alberta) as applicable. We also comply with PIPEDA where it applies, including cross-border and interprovincial transfers. Quebec users have the protections of the private-sector law as amended by Law 25, including confidentiality by default, a designated privacy officer and a privacy impact assessment before any transfer outside Quebec.

On United States health privacy law: it is United States federal legislation applying to US covered entities and their business associates. It does not apply to our Canadian operations and we do not describe our services as compliant with it. If we ever contract directly with a US covered entity we will enter into a business associate agreement for that engagement.

Our designated Privacy Officer is Andrew Mai, MD, responsible for compliance with this policy and applicable privacy law, and the contact for access requests, corrections, consent withdrawals and complaints. Email info@amhealth.ca with "Privacy Request" in the subject line.

Where a lawyer, clinic, physician or other custodian uses AM Health Legal, that organization remains the custodian of the records and decides what is collected, used and disclosed. We act as its service provider or agent and process the information only on its documented instructions, for the purpose of providing the service. We do not use case records for our own purposes, for marketing, or to train general-purpose models. We do not sell personal information. Where an individual's information is held in the app, requests for access or correction should be directed to the custodian; we will assist the custodian in responding.

Professional account information (name, professional email, organization, role, authentication data); records and documents uploaded for a matter, including clinical notes, reports, imaging, billing and correspondence; matter and chronology metadata; audit logs of access to records; technical and usage information. We do not collect more than the professional user chooses to upload.

To provide the service, including storing records, extracting dates and building chronologies; to let the professional user organise, search and export material; to maintain access logs and integrity records; to support the professional user and secure the service. We do not use the information for any purpose of our own.

Professional users are responsible for ensuring they have the authority or consent required to upload records, and for providing any notice required by their regulator or by law. Where we process health information on behalf of a custodian, the custodian is responsible for obtaining consent and for responding to access requests; we support it in doing so. We ask professional users to confirm their authority before uploading a matter. Minors' records are handled under the same authority framework as adult records, with the custodian determining capacity and substitute decision-making.

Material in a matter may be subject to solicitor-client privilege or litigation privilege. We treat all matter content as privileged and confidential, restrict access to the professional users authorised on that matter, and do not review, mine or disclose content except as needed to operate the service, to fix a technical problem at the user's request, or as required by law. We will notify the account administrator of any legal demand for matter content unless prohibited by law.

We use encryption in transit and at rest, per-matter access control and user roles, multi-factor authentication for administrative accounts, audit logging of access to records, secure development practices, vendor security review and a documented incident response process. No system is perfectly secure. If a breach occurs we investigate, contain it, notify the affected account administrator promptly, and notify affected individuals and the Office of the Information and Privacy Commissioner for British Columbia where the breach creates a real risk of significant harm.

We are based in British Columbia, but some service providers, including cloud hosting and AI providers, may store or process information outside Canada, including in the United States and the European Union. Where information is transferred outside Canada we remain accountable for it and use contractual protections, access controls and, where required, privacy impact assessments. Professional users who require data residency in Canada should contact the Privacy Officer before uploading records.

Some features use machine learning or large language models to extract dates, summarise records or draft a chronology. Where we use AI: we tell the user when output is AI-generated; we disclose the categories of service providers involved and the countries in which they process information; we configure providers so matter content is not used to train their general-purpose models and require that contractually; output is a drafting aid and must be verified by the professional user, who remains responsible for its accuracy and for any filing.

Matter content is kept for as long as the account is active and then for the retention period the custodian instructs, or as required by law. Backups are retained on a rolling cycle and securely destroyed. On written instruction we return or destroy matter content, subject to legal hold.

Individuals whose information is held in the app should contact the custodian first. We will assist the custodian. You may also contact our Privacy Officer, and you may complain to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca or 250-387-5629, or, for Ontario health information, the Information and Privacy Commissioner of Ontario at ipc.on.ca. If your complaint concerns an activity subject to PIPEDA, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca. We respond to requests within 30 business days and tell you if an extension is required.

We use cookies necessary for the service and to maintain secure sessions. We do not use third-party advertising cookies.

We review this policy at least annually and whenever we introduce a new use, provider or AI feature. Material changes are posted with a new effective date and, where required, we ask for consent again.

Privacy Officer Andrew Mai, MD, info@amhealth.ca, subject line "Privacy Request".