Privacy Policy | Physicare

1Scope

This Privacy Policy explains how Physicare.ai collects, uses, discloses, transfers, retains and protects personal information and personal data in connection with the Services.

This Privacy Policy applies to:

website visitors;
professional users, clinic administrators and organizational customers;
patients invited to use certain features enabled by a customer;
prospective customers, partners and business contacts.

This Privacy Policy does not replace a separate Data Processing Agreement, master agreement, order form or customer-specific notice where such a document applies.

2Privacy roles

For Customer Data processed on behalf of a clinic, practice, employer or regulated health professional in the course of providing care or related operations, the relevant customer generally acts as the controller, custodian, trustee or equivalent primary decision-maker under applicable law.

With respect to such Customer Data, Physicare.ai acts as a processor, service provider, agent, affiliate, information manager or equivalent service role, depending on applicable law and the contractual arrangement in place.

Physicare.ai acts as an independent controller only for the Business Data it processes for its own legitimate purposes, including account administration, billing, authentication, security, fraud prevention, legal compliance, support and service communications.

If you are a patient whose health professional uses Physicare.ai, that professional or clinic remains the primary point of contact for any request relating to your clinical record, except where applicable law requires Physicare.ai to respond directly.

This policy does not in any way limit the professional obligations of the health professional, including those relating to professional secrecy and to informing their clients of the circumstances that may lead to it being lifted, which remain entirely the responsibility of the professional and the clinic.

3Categories of information processed

Physicare.ai may process the following categories of information:

Account and business information

name; business email address; phone number; organization name; professional role; account credentials; subscription and billing information; support and communication records.

Customer clinical data

patient names and identifiers when submitted by the customer; appointment information; clinical notes; transcripts; assessment content; exercise or treatment program content; questionnaires; communications and workflow content entered into the Services; other health-related information processed according to the customer’s instructions.

Usage and technical data

IP address; browser type; device information; operating system; session data; system logs; authentication events; audit events; performance and error data.

Payment data

limited billing and transaction information from payment providers. Physicare.ai does not store full payment card numbers.

Cookie and web analytics data

information collected through cookies, analytics tools and similar technologies, subject to applicable consent requirements.

4Sources of information

Physicare.ai collects information:

directly from users and customers;
from customers who submit information about patients, staff members or other authorized users;
automatically from the devices, browsers and systems that interact with the Services;
from service providers such as payment processors, hosting providers, analytics providers and support tools;
from business contacts and prospective customers in the course of business dealings.

5Purposes of processing

Physicare.ai processes information for the following purposes:

to provide, host, operate, maintain and support the Services;
to authenticate users and manage accounts;
to provide transcription, documentation, workflow and AI assistance features according to the customer’s instructions;
to manage subscriptions, billing, payments and collections;
to monitor security, detect fraud, prevent abuse and investigate incidents;
to maintain logs, backups and service reliability;
to communicate with customers and users about the service, support, product updates or legal notices;
to comply with legal, regulatory, contractual and governance obligations;
to carry out limited analytics and product improvement activities;
to carry out optional uses where consent is required and has been obtained.

6Legal basis and nature of the information processed

Where Physicare.ai processes personal information subject to Quebec law, it does so in accordance with the Act respecting the protection of personal information in the private sector (LPRPSP), as amended by the Act to modernize legislative provisions as regards the protection of personal information (commonly known as “Law 25”), and, where applicable, the Act respecting health and social services information (LRSSS).

Health information processed through the Services is sensitive information within the meaning of these laws. Where Physicare.ai is responsible for it, its processing is based on manifest, free, informed and express consent, or on an exception provided by law. Where Physicare.ai acts as a processor on behalf of a customer, that customer remains responsible for obtaining the required consent or relying on an applicable legal basis.

For its technology projects involving personal information, Physicare.ai conducts privacy impact assessments (PIAs) in accordance with its legal obligations. Such an assessment is being carried out as of the date of this policy.

Where the GDPR applies and Physicare.ai acts as an independent controller, Physicare.ai also relies on one or more of the following legal bases:

performance of a contract;
compliance with a legal obligation;
legitimate interests, including service security, fraud prevention, support, internal administration and proportionate service improvement;
consent, where required, including for optional cookies or certain optional product improvement initiatives.

Where special category data within the meaning of the GDPR is processed through the Services on behalf of a healthcare customer, the relevant customer remains responsible for establishing an applicable condition under Article 9. Physicare.ai processes such data only on documented instructions, unless otherwise required by law.

7AI-assisted features

The Services may include AI-assisted features that generate transcripts, summaries, draft notes, structured outputs, documentation suggestions, administrative suggestions or other assistive content.

AI-generated outputs are for assistance only. They may be incomplete, inaccurate, outdated, biased or unsuitable for a given patient, context or jurisdiction.

Physicare.ai does not, through the Services, make any decision based exclusively on automated processing of personal information within the meaning of Law 25 and any equivalent applicable law, including any decision producing legal effects or similarly significant effects within the meaning of the GDPR, where applicable.

Unless expressly stated otherwise in a separate written agreement or as part of a lawful program, Physicare.ai does not use identifiable Customer Data to train generalized third-party AI models.

Where Physicare.ai uses de-identified or anonymized data for analytics, product improvement or research purposes, it does so only where permitted by applicable law and subject to appropriate safeguards.

8Google user dataGoogle Calendar

If you connect a Google account to Physicare.ai through the Google Calendar integration, Physicare.ai accesses certain Google user data solely to provide that integration. This section applies to that data and prevails over any other section of this Privacy Policy that is inconsistent with it.

Google data we access

your Google account email address and identifier (openid, email), to identify the connected account;
the list of your Google calendars and your access level to each (calendar.calendarlist.readonly), so you can choose which calendars block your availability;
free/busy information and the times and titles of events in the calendars you choose (calendar.freebusy, calendar.events.readonly), to mark those times as unavailable; event titles are visible only to you;
a secondary calendar named “Physicare” that Physicare.ai creates in your Google account, and the events Physicare.ai adds to it (calendar.app.created), to display your Physicare.ai appointments in Google Calendar; this permission does not allow Physicare.ai to read or modify calendars it did not create;
the access and refresh tokens issued by Google to keep the integration connected.

How we use Google data

Google user data is used solely to provide the calendar features you enable: preventing online booking and flagging manual entries during your busy times, and displaying your appointments in the “Physicare” calendar.

The titles and descriptions of events in your Google calendars are never shown to other users. Other members of your workspace can see your busy times, without any details, unless you choose to keep them private.

By default, no patient information is sent to Google. Patient initials are added to exported events only if you turn on this option.

Sharing of Google data

Physicare.ai does not sell Google user data and does not share, transfer or disclose it to third parties, except to hosting and infrastructure providers that are strictly necessary to operate the integration and bound by confidentiality, where required by applicable law, or as part of a merger, acquisition or sale of assets with your prior consent. Google user data is not sent to AI providers and is not used by the AI-assisted features described in Section 7.

Limited Use

Physicare.ai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Physicare.ai does not use Google user data to serve advertising, including personalized, retargeting or interest-based advertising; does not sell it or transfer it to data brokers or information resellers; does not use it to determine creditworthiness or for lending purposes; and does not use it to develop, improve or train generalized or non-personalized AI or machine learning models. The analytics, product improvement and research uses described in Sections 5 and 7 do not apply to Google user data.

Physicare.ai staff do not view Google user data, except with your explicit consent, when necessary for security purposes such as investigating abuse, or when required by applicable law.

Protection of Google data

Google user data is transmitted over encrypted connections and stored encrypted at rest, with the measures described in Section 11. Access to Google tokens is limited to the systems that perform synchronization.

Retention and deletion

Physicare.ai retains Google user data until you disconnect Google Calendar in Physicare.ai. Only busy times for the next 90 days are stored; they are replaced at each synchronization, so past busy times are not retained.

When you disconnect Google Calendar in Physicare.ai, the “Physicare” calendar and the events exported to it are deleted from your Google account, Physicare.ai’s access is revoked and the Google user data stored by Physicare.ai is deleted, unless the law requires it to be retained.

If you remove Physicare.ai’s access from your Google Account permissions page (myaccount.google.com/permissions), synchronization stops and busy times are deleted. Your Google account email address and your settings are kept to allow reconnection, until you disconnect Google Calendar in Physicare.ai or request their deletion by writing to privacy@physicare.ai.

9Disclosure of information

Physicare.ai may disclose information:

to processors and service providers that support hosting, infrastructure, payments, analytics, authentication, security, support and AI-enabled features;
to the relevant customer organization and its authorized users;
where required by law, regulation, court order, legal process or a competent authority;
where necessary to protect the rights, safety, integrity or interests of Physicare.ai, its users, its customers or third parties;
in connection with a merger, financing, acquisition, restructuring, sale of assets or similar corporate transaction, subject to appropriate confidentiality safeguards.

Physicare.ai does not sell personal information.

10Processors and international transfers

Physicare.ai may use processors and third-party service providers, including one or more artificial intelligence model providers, to support the delivery of the Services. These providers may change from time to time, in particular because of the rapid evolution of artificial intelligence technologies.

Physicare.ai primarily hosts production data in Canada. Some service providers, potentially including artificial intelligence model providers, may process limited categories of information outside Quebec or Canada, including in the United States.

Where required, Physicare.ai puts appropriate safeguards in place for such transfers, which may include:

contractual protections;
transfer risk assessments;
standard contractual clauses;
additional technical and organizational measures.

Information processed in another jurisdiction may be subject to lawful access requests by the courts, regulators, law enforcement or national security authorities of that jurisdiction.

Physicare.ai maintains a list of its key processors, including the artificial intelligence model provider(s) used and their processing jurisdiction. This list is available on request at privacy@physicare.ai and may be provided to customers to support their own privacy impact assessment or their register of technological products and services, where required by the Act respecting health and social services information (LRSSS).

Given the rapid evolution of artificial intelligence technology providers, this list may be updated more frequently than this policy.

11Security measures

Physicare.ai maintains administrative, technical and physical measures designed to protect information in proportion to its sensitivity and the nature of the Services.

These measures may include:

encryption in transit and at rest;
role-based access controls;
least-privilege access management;
authentication controls;
system monitoring and logging;
secure hosting practices;
backup and recovery processes;
confidentiality obligations for employees;
internal access restrictions;
security review and incident response procedures.

No system or method of transmission can be guaranteed to be completely secure.

12Data retention

Physicare.ai retains information only for as long as necessary for the purposes described in this Privacy Policy, in accordance with contractual requirements and as required or permitted by applicable law.

Customer Data is retained in accordance with the applicable customer agreement, the customer’s instructions, legal obligations and backup or deletion schedules.

Account, billing, audit, security and legal compliance records may be retained longer where reasonably necessary for tax, accounting, dispute resolution, enforcement, fraud prevention, security investigation or legal compliance purposes.

Where Physicare.ai acts solely as a processor or service provider with respect to Customer Data, the return, export, retention, deletion and destruction of that data are primarily governed by the applicable customer agreement and the customer’s legitimate instructions.

13Your rights

Depending on applicable law, you may have rights regarding your personal information, including:

access and rectification;
withdrawal of consent, where processing is based on consent;
deletion or erasure, in the cases provided by law;
portability of your computerized information;
objection to certain processing or restriction of processing, where these rights are provided by applicable law (including the GDPR);
in Quebec, the right of restriction — the right to request that a named provider or a category of providers not have access to one or more specific pieces of information in your record — and the right of refusal — the right to refuse that certain persons (for example relatives or researchers) have access to your record or to certain information in it, in accordance with the Act respecting health and social services information (LRSSS);
the right to file a complaint with a competent authority, including, in Quebec, the Commission d’accès à l’information (CAI).

Where your information is controlled by a clinic, practice, employer or other Physicare.ai customer, these rights — including the right of restriction and the right of refusal — are generally exercised with that customer, which remains responsible for your record.

Where Physicare.ai processes information on behalf of a clinic, practice, employer or other customer, Physicare.ai may redirect the request to that customer or require that it be submitted to them first.

Physicare.ai will assist its customers in responding to legitimate requests to the extent required by law or contract.

To submit a request about information for which Physicare.ai acts as controller, please write to privacy@physicare.ai. Physicare.ai may require reasonable identity verification before responding.

14Incident and breach response

Physicare.ai maintains processes to identify, investigate, document and address security and privacy incidents.

Where Physicare.ai acts on behalf of a customer and becomes aware of a breach affecting Customer Data, Physicare.ai will notify the customer as soon as possible and provide the information reasonably necessary to support its legal and regulatory obligations.

Where Physicare.ai is itself required under applicable law to notify individuals, regulators or other authorities, it will do so in accordance with that law.

15Cookies and web analytics

Physicare.ai uses cookies that are strictly necessary for the operation and security of the website and the Services.

Physicare.ai may also use optional analytics cookies or similar technologies where permitted by law and, where required, only with prior consent.

Users can manage their cookie preferences using the website’s consent tools where available.

16Children and minors

The Services are not intended for children as independent users, except where a healthcare customer uses the Services in the course of caring for minors.

In such a case, the relevant customer remains responsible for obtaining any authority, notice or consent required by applicable law.

17EEA and UK addendum

Where the GDPR or the UK GDPR applies:

Physicare.ai processes personal data only on a valid legal basis;
where Physicare.ai acts as a processor, the customer remains responsible for the legal bases under Articles 6 and 9 and the related transparency obligations;
transfers of personal data outside the EEA or the United Kingdom are subject to an appropriate transfer mechanism, which may include the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, together with supplementary measures where required;
where Article 27 of the GDPR requires it, Physicare.ai will appoint a representative in the European Union or document why this requirement does not apply.

18Changes to this Privacy Policy

Physicare.ai may amend this Privacy Policy from time to time.

If a change materially affects applicable rights or obligations, Physicare.ai will provide reasonable notice by email, through the Services or by any other appropriate means.

The date shown at the top of this Privacy Policy is the date of the last revision.

19Contact and complaints

Privacy contact: privacy@physicare.ai
Support contact: support@physicare.ai
Mailing address: #300 - 307 Rue Notre-Dame
Repentigny, Quebec J6A 2R9

Individuals may also file a complaint with the competent privacy or data protection authority in their jurisdiction, including, in Quebec, the Commission d’accès à l’information (CAI — cai.gouv.qc.ca).