Privacy Policy

1. About This Policy

Hilthealth (“we,” “us,” “our”) provides AI-powered patient pre-screening software for healthcare clinics. This policy explains how we collect, use, disclose, and protect your personal information and personal health information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).

Hilthealth is operated from Toronto, Ontario, Canada. If you have questions about this policy, contact our Privacy Officer:

Privacy Officer
Hilthealth
Toronto, Ontario, Canada
privacy@hilthealth.com

2. Definitions

• Personal Information (PI) — Information about an identifiable individual, such as name, email, phone number, and clinic affiliation.
• Personal Health Information (PHI) — Information about an individual’s physical or mental health, health care history, or information collected during the provision of health care, as defined by PHIPA Section 4.
• Health Information Custodian (HIC) — The clinic or healthcare provider that uses Hilthealth and is responsible for the patient’s PHI under PHIPA.
• De-identified Information — Information from which all identifying details have been removed such that it cannot reasonably be used to identify an individual.

3. Our Role

Hilthealth provides technology services to healthcare clinics (Health Information Custodians) under PHIPA. Depending on the arrangement with each clinic, Hilthealth operates as either an electronic service provider (PHIPA Section 10(4)) or an agent of the HIC (PHIPA Section 17). In either role, we process PHI only as authorized by the clinic and in accordance with PHIPA.

The clinic remains the custodian of all patient health information. Hilthealth does not independently make health care decisions — the AI assists with information gathering only. All clinical decisions are made by the treating physician.

4. Information We Collect

A. Patient Health Information (collected on behalf of clinics)

• Symptoms and health concerns described during AI pre-screening conversations
• Full transcript of the AI conversation
• AI-generated pre-screening summaries
• Date and time of the pre-screening session
• Device and browser information used during the session

B. Clinic & Prospect Information

• Clinic name, contact person name, email address, phone number, and city
• Account credentials (for clinic dashboard access)
• Usage data and analytics

C. Technical Information (collected automatically)

• IP address, browser type, and operating system
• Pages viewed and interactions on our website
• Access logs for security and audit purposes

5. How We Use Your Information

Patient Health Information

• Conducting AI-powered conversational pre-screening on behalf of the clinic
• Generating pre-screening summaries for the treating physician
• Providing the full conversation transcript to the clinic

We do not use PHI for marketing, advertising, or any purpose unrelated to the clinical pre-screening service. We do not use PHI to train or fine-tune AI models.

Clinic & Prospect Information

• Setting up and managing clinic accounts
• Communicating about our services
• Processing payments and billing
• Improving our platform and user experience

6. Consent

Patient Consent

Patient consent for the collection and use of PHI through Hilthealth is obtained by the clinic (the Health Information Custodian) in accordance with PHIPA Section 18. Clinics are responsible for ensuring patients provide informed, express consent before using Hilthealth’s pre-screening service. This includes informing patients that:

• An AI system will ask questions about their symptoms
• Their conversation will be shared with the treating physician
• Their data is processed by a third-party AI service (see Section 8)
• They may decline to use the AI pre-screening without affecting their care

Withdrawal of Consent

Patients may withdraw consent at any time by informing the clinic. Withdrawal applies prospectively — it does not affect data already lawfully collected and used (PHIPA Section 21). Consequences of withdrawal (such as inability to use AI pre-screening) will be explained at the time of withdrawal.

Clinic Consent

Clinics consent to the collection and use of their business information when they register for Hilthealth or submit a contact form on our website. Clinics may withdraw consent by contacting us at privacy@hilthealth.com.

7. AI Processing

Hilthealth uses artificial intelligence to conduct patient pre-screening conversations. It is important to understand:

• The AI gathers information only. It does not diagnose, recommend treatment, or make clinical decisions. All medical decisions are made by the treating physician.
• AI provider: Patient conversations are processed through a third-party large language model API. Conversation data is transmitted to the AI provider’s servers for processing and is not retained by the AI provider for model training or improvement (per our contractual terms).
• Cross-border processing: AI processing may occur on servers located in the United States. This means patient data is subject to U.S. laws, including potential access under the USA PATRIOT Act and CLOUD Act. See Section 8 for details.
• Human review: The physician reviews all AI-generated summaries with the patient before relying on them for clinical decisions.
• Limitations: AI pre-screening is not a substitute for professional medical assessment. The AI may produce inaccurate or incomplete information.

8. Third-Party Service Providers

We share information with the following third-party providers, each of which is bound by data processing agreements:

We require all third-party providers to protect information with safeguards appropriate to its sensitivity and to use it only for the purposes specified in our agreements (PIPEDA Principle 4.1.3).

Cross-Border Data Transfers

Some of our service providers operate in the United States. When personal information or PHI is transferred outside Canada, it may be subject to the laws of that jurisdiction, including lawful access by foreign courts, law enforcement, or government authorities. We ensure contractual protections are in place and disclose this to you as required by PHIPA and PIPEDA.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies for the following purposes:

• Essential cookies: Required for basic site functionality such as page navigation and form submission. These cannot be disabled.
• Analytics: We may use analytics tools to understand how visitors interact with our website. This data is aggregated and does not identify individual users.

We do not use cookies for advertising or cross-site tracking. We do not sell or share cookie data with third parties for their own marketing purposes.

10. Communications and CASL Compliance

When you submit a contact or trial request form, you expressly consent to receiving commercial electronic messages from Hilthealth about our services, in compliance with Canada’s Anti-Spam Legislation (CASL, S.C. 2010, c. 23).

• Every commercial message we send will identify Hilthealth as the sender and include our contact information
• Every message will contain a functional unsubscribe mechanism
• Unsubscribe requests will be processed within 10 business days as required by CASL s.11
• We will never send messages to addresses that have unsubscribed

You may withdraw your consent to receive commercial messages at any time by clicking the unsubscribe link in any email or by contacting us at privacy@hilthealth.com. Withdrawal of marketing consent does not affect transactional or service-related communications.

11. Data Security

We implement security safeguards appropriate to the sensitivity of the information we handle, as required by PIPEDA Principle 4.7 and PHIPA:

• Encryption: All data is encrypted in transit (TLS) and at rest (AES-256)
• Access controls: Role-based access ensures only authorized personnel can access PHI
• Audit logging: All access to PHI is logged and monitored
• Authentication: Secure authentication is required for all clinic dashboard access
• Regular review: Security measures are reviewed and updated on an ongoing basis

12. Data Retention

We retain information only as long as necessary to fulfill the purposes for which it was collected, subject to legal minimum retention periods:

After the applicable retention period, information is securely destroyed or de-identified.

13. Your Rights

Access and Correction

You have the right to request access to the personal information or PHI we hold about you. You may also request corrections if the information is inaccurate or incomplete. We will respond to access requests within 30 days (PIPEDA; PHIPA s.54(7)). A reasonable fee may apply for access to PHI records (PHIPA s.54(9)).

Deletion

You may request deletion of your personal information, subject to any legal obligation we have to retain it (such as minimum retention periods under PHIPA). For PHI, deletion requests should be directed to the clinic that collected your information.

Lock-Box (PHIPA s.23)

Patients have the right to restrict access to their PHI by certain custodians. If you wish to place a lock-box on your information, contact the clinic directly.

To exercise any of these rights, contact us at privacy@hilthealth.com.

14. Data Breach Notification

In the event of a breach of security safeguards involving personal information or PHI, we will:

• Assess whether there is a real risk of significant harm (RROSH) to affected individuals
• Report the breach to the Office of the Privacy Commissioner of Canada (OPC) if RROSH exists (PIPEDA s.10.1)
• Report the breach to the Information and Privacy Commissioner of Ontario (IPC) if it involves PHI (PHIPA and O. Reg. 329/04)
• Notify affected individuals as soon as feasible, including a description of the breach, what information was involved, steps we are taking, and steps they can take to protect themselves
• Notify the relevant clinic (HIC) immediately
• Maintain records of all breaches for a minimum of 24 months (PIPEDA s.10.3)

15. Children’s Privacy

Hilthealth’s patient pre-screening is used in clinical settings where patients of all ages may be seen. When a patient under the age of 16 uses Hilthealth, the clinic is responsible for obtaining consent from a parent or guardian (substitute decision-maker) in accordance with PHIPA Section 20 and the Health Care Consent Act, 1996.

Our website and contact forms are not directed at individuals under 16. We do not knowingly collect personal information from children through our website.

16. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify affected clinics by email and update the “Last updated” date at the top of this page. Continued use of Hilthealth after changes constitutes acceptance of the updated policy.

17. Complaints

If you have concerns about how we handle your information, you may:

• Contact our Privacy Officer at privacy@hilthealth.com
• File a complaint with the Office of the Privacy Commissioner of Canada (for PIPEDA matters) at priv.gc.ca
• File a complaint with the Information and Privacy Commissioner of Ontario (for PHIPA matters) at ipc.on.ca

18. Governing Law

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.