Privacy policy

MedAssistant Inc. operates a software platform intended for individuals receiving services, as well as the professionals and organizations providing those services. Depending on the features enabled, the platform may, among other things, collect information through questionnaires, capture a person’s voice during a consultation to produce a transcript and a draft note using an artificial intelligence (AI) scribe, and transmit the results to authorized persons. This privacy policy (the “Policy”) explains how MedAssistant collects, uses, discloses, retains, destroys, anonymizes, and protects personal information processed through the platform. When MedAssistant provides the platform to an organization, that organization generally determines the purposes of the collection and the authorized access rights, while MedAssistant processes the information to provide the agreed-upon services. Personal Information We May Collect The exact nature of the information depends on the questionnaire, the feature being used, and the organization’s instructions. Only information necessary for the stated purposes should be requested. The categories may include: - Identification and contact information: last name, first name, date of birth, sex assigned at birth, address, city, postal code, email address, telephone number, and preferred language of communication. - Information provided in questionnaires: answers, symptoms, medical history, treatments, medications, and any other information requested by the organization for the delivery of the service. - Consent-related information: choices, authorizations, refusals, and the date and time of consent, when required by law or by the context. - Social Insurance Number: MedAssistant does not collect it for its own purposes, and this information is not collected as part of deployments within the public healthcare system. It may be configured only for certain private clients that expressly request it, provided that they establish its necessity, legal authority, and purposes, and clearly inform the individual concerned. - Health- or identity-related information: health insurance number, card expiry date, the first and last name of a legal guardian, photograph, or electronic identity certificate, only when required for the service being provided. - Audio and derived data: voice, audio recording, transcript, draft note produced by the AI scribe, and corrections made by the user. - Driver’s licence number or another government-issued identification number: not collected by default; collected only when the client organization expressly requests it, establishes its necessity, and informs the individual concerned. MedAssistant does not automatically verify the accuracy or validity of these numbers. - Technical and security data: IP address, session identifiers, activity logs, device type, and information required for authentication and incident prevention. Disclosure of Personal Information Personal information is disclosed only to professionals and authorized persons within the organization providing the service, based on the configured access rights and the purposes communicated to the individual concerned. In the context of a healthcare consultation, professionals remain subject to their professional confidentiality obligations. MedAssistant may also disclose the information required by service providers acting on its behalf, including providers of hosting, authentication, payment, security, messaging, transcription, and AI processing services. These providers are bound by agreements limiting the use, retention, and disclosure of the information. Disclosure may also occur when permitted or required by law. MedAssistant does not sell or rent personal information. Consent This Policy is intended to provide information and does not, by itself, constitute consent. When consent is required, particularly to collect, use, or disclose sensitive information, it is obtained separately, in a clear, free, and informed manner, for specific purposes. Completing or submitting a questionnaire is not treated as acceptance of the Policy. Hosting and Transfers Information retained by MedAssistant is hosted in data centres located in Canada. MedAssistant’s practices are governed by the applicable privacy laws of Québec. Any disclosure or processing of information outside Québec is preceded by a privacy impact assessment and is governed by appropriate contractual and security measures. Security Measures MedAssistant implements administrative, physical, and technological security measures appropriate to the sensitivity of the information, including encryption during storage and transmission, access controls, logging, backups, and incident management mechanisms. Retention, Destruction, and Anonymization MedAssistant retains personal information only for as long as necessary to fulfill the purposes for which it was collected or used, or to comply with its legal, contractual, and regulatory obligations. Once those purposes have been fulfilled, the information is securely destroyed or, only when it is to be used for serious and legitimate purposes, anonymized. When it anonymizes information, MedAssistant applies the Regulation respecting the anonymization of personal information. The process is carried out under the supervision of a qualified person, for purposes established in advance, using techniques consistent with best practices, measures intended to reduce the risk of re-identification, and periodic analysis and reassessment of that risk. As a default measure, audio recordings used by the scribe are deleted within a maximum of 48 hours after processing. They may be retained for more than 48 hours only if the client organization explicitly requests it, subject to applicable legal and contractual obligations. Other retention periods are established according to the nature of the information, the organization’s instructions, and the applicable obligations. Cookies and Similar Technologies This section concerns cookies and similar technologies used on the public website and in the platform interfaces. Essential cookies are used for operation, security, and authentication. Consent is requested before non-essential cookies are enabled, and preferences may be changed through the cookie management interface. The main categories of cookies and technologies used are as follows: - MedAssistant: maintaining preferences, sessions, and the organization’s subscription status. - Auth0: secure authentication and session maintenance; IP addresses may be recorded in security logs. - reCAPTCHA: detecting automated submissions and protecting forms. - Google: audience measurement and, only when consent is provided, advertising functions on the public website. - Stripe: processing and securing online payments; MedAssistant does not retain the full payment card number. - Cloudflare: security, performance optimization, and technical session management. Aggregated browsing data, or data that cannot reasonably identify an individual, such as approximate location, time spent on a page, or traffic source, may be collected through Vercel Analytics. This browsing data does not include the clinical content of questionnaires, transcripts, or notes. Use of Artificial Intelligence AI systems may process questionnaire answers, voice or audio recordings, transcripts, and instructions provided by the user in order to produce a summary or a draft note. Data collected through cookies is not used to produce clinical content. MedAssistant selects AI providers that maintain recognized security controls, including SOC 2 certification, and enters into agreements providing that information is used only to perform the requested processing, is not used to train models, and is not retained by the provider when zero data retention mode applies. Generated results must be reviewed by the professional or authorized user; AI does not replace clinical judgment. Upon request, MedAssistant may provide additional information about the categories of technology providers used and the contractual measures governing them. By using the platform, you acknowledge that you have reviewed this Policy. Use of the services is also governed by the Terms of Use, which must be accepted when required. Acknowledging this Policy does not replace any specific consent required for the collection, use, or disclosure of personal information. Access, Correction, and Questions Platform users: please contact your organization’s manager or privacy officer. Patients and respondents: please contact the healthcare professional or organization for which the questionnaire or consultation is intended. For questions concerning MedAssistant’s own practices, or to contact its privacy officer: [email protected] Last updated: July 1, 2026