PIPEDA & Canadian Health Privacy Compliance
ArdenMD is designed from the ground up for Canadian physicians and operates under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial health privacy statutes including PHIPA (Ontario), HIA (Alberta), PHIA (Manitoba, NL, NS), and the Québec Act respecting the protection of personal information in the private sector (as amended by Law 25).
The ten PIPEDA fair information principles
1. Accountability
9937790 Canada Incorporated is the accountable organization. Our Privacy Officer oversees compliance and can be reached at privacy@ardenmd.ca.
2. Identifying purposes
We collect account and billing information to deliver the subscription service, and de-identified clinical information to provide decision support. These purposes are described in the Privacy Policy and on the sign-up screen before collection.
3. Consent
You provide express consent at sign-up by agreeing to our Terms and Privacy Policy. You may withdraw consent at any time by deleting your account, subject to legal retention obligations.
4. Limiting collection
We collect only what we need. Crucially, we do not collect identifiable patient health information. Automated PHI detection at the API boundary blocks common identifiers (phone numbers, emails, SIN, health card patterns) before they reach our clinical tools.
5. Limiting use, disclosure, and retention
- Clinical inputs are used only to generate the requested decision support output;
- We do not sell personal information;
- We do not use your data to train AI models;
- Data is retained only as long as necessary or as required by law.
6. Accuracy
You can update your profile and subscription information at any time from /settings. For corrections to other fields, contact support.
7. Safeguards
- TLS 1.3 in transit, AES-256 at rest
- Supabase Canadian region (
ca-central-1, Montréal) - Row-level security on every tenant table
- Audit logs of all clinical decision actions
- Principle of least privilege for staff access
- Point-in-time backups and disaster recovery testing
- Sub-processor agreements with all third parties
8. Openness
Our Privacy Policy, Terms of Service, and this PIPEDA statement are freely accessible. A list of sub-processors is maintained in the Privacy Policy and updated when it changes.
9. Individual access
Email privacy@ardenmd.ca to request a copy of the personal information we hold about you. We will respond within 30 days as required by PIPEDA.
10. Challenging compliance
If you believe ArdenMD has not handled your personal information in accordance with this statement, contact our Privacy Officer. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.
Data residency
Primary user data is stored in Canada. Some sub-processors (Stripe, Anthropic, Sentry, Resend, Vercel) operate in the United States. We have signed data processing agreements with each provider that include the Standard Contractual Clauses or equivalent safeguards. By using ArdenMD you consent to this cross-border processing.
Breach notification
In the event of a breach of security safeguards involving personal information that poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA’s mandatory breach reporting provisions.
Your responsibilities as a physician custodian
Under provincial health privacy law, you remain the health information custodian for any patient information you manage. ArdenMD is a tool you use in your practice. You must:
- De-identify any clinical information before entering it into ArdenMD, as required by our Terms of Service;
- Verify every clinical recommendation against your own clinical judgment and current guidelines;
- Maintain your own patient records in accordance with provincial law;
- Report any suspected privacy breach involving ArdenMD to us immediately.
Contact
Privacy Officer
ArdenMD / 9937790 Canada Incorporated
Email: privacy@ardenmd.ca