Privacy Policy

Effective date: April 9, 2026 · Last updated: April 9, 2026

ArdenMD (operated by 9937790 Canada Incorporated) is committed to protecting the privacy of the Canadian physicians who use our clinical decision support service. This Policy explains what we collect, how we use it, who we share it with, and the rights you have under PIPEDA and provincial health privacy legislation.

1. Information we collect

Account information

Full name, email address, and password (hashed)
Province of practice and professional role
Language preference (EN / FR)
Medical licence details when you choose to verify

Billing information

Subscription tier, status, trial end date, renewal date
Stripe customer and subscription identifiers
We do not store credit card numbers. Card data is handled entirely by Stripe under PCI-DSS Level 1.

Clinical usage data

De-identified case notes, symptoms, labs, medications, and differential diagnosis outputs you generate;
Drug interaction queries and billing suggestion inputs;
Audit logs of every AI-generated recommendation you save.

We never ask for and do not want identifiable patient data. You are contractually required (see Terms §5) to de-identify any clinical information before input.

Technical data

IP address, browser, device type, timestamps
Error logs and performance metrics via Sentry
Locale cookie (for EN/FR preference)

2. How we use your information

To operate the service, authenticate you, and deliver clinical decision support;
To process payments and manage subscriptions via Stripe;
To send transactional email (welcome, password reset, trial expiry, invoices);
To generate AI differential diagnoses via Anthropic’s API;
To maintain audit logs for CMPA / medico-legal documentation;
To debug errors and improve the product in aggregate.

We do not sell your data, and we do not use your clinical inputs to train machine learning models.

3. Service providers and data location

All primary user data is stored in Canada using Supabase (PostgreSQL) in the ca-central-1 region (Montréal). We use the following sub-processors:

Supabase - hosting, database, authentication (Canada)
Vercel - application hosting and edge delivery (USA/global with Canadian edge)
Stripe - payment processing (USA, PCI-DSS Level 1)
Anthropic - AI inference (USA). Inputs are de-identified before being sent. Anthropic’s commercial terms prohibit using API inputs to train models.
Sentry - error monitoring (USA)
Resend - transactional email (USA)

Some processing may occur outside Canada. By using ArdenMD you consent to cross-border processing subject to the contractual safeguards we have in place with each provider.

4. Security

TLS 1.3 in transit; AES-256 at rest
Row-level security on every Supabase table
Audit logging of clinical actions
Principle of least privilege for operational access
PHI-detection regex blocks at the API boundary
Point-in-time backups (Supabase PITR)

5. Retention

Account and clinical usage data are retained for the life of your subscription plus seven years to meet Canadian medical record retention expectations. You may request earlier deletion (see §6). Billing records are retained for seven years as required by the Income Tax Act.

6. Your rights

Under PIPEDA and provincial health privacy law, you have the right to:

Access the personal information we hold about you;
Request correction of inaccurate information;
Withdraw consent and request deletion of your account;
Export your data in a machine-readable format;
File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email privacy@ardenmd.ca. We will respond within 30 days.

7. Cookies

We use essential cookies only:

sb-* - Supabase authentication session
ardenmd-locale - your EN/FR language preference

We do not use advertising or cross-site tracking cookies.

8. Changes to this Policy

We will notify active subscribers by email at least 30 days before any material change. Continued use after the effective date of a change constitutes acceptance.

9. Contact

Privacy Officer
ArdenMD / 9937790 Canada Incorporated
Email: privacy@ardenmd.ca