Privacy Policy

This Privacy Policy explains how Local Health collects, uses, discloses, retains, and protects personal information when people use localhealthcare.ca, patient accounts, family features, provider accounts, clinic and provider profiles, appointment tools, messaging, virtual-care features, provider onboarding, billing, support, and related services.

This Policy applies to information handled by Local Health in its own capacity. Healthcare providers and practices may have separate privacy obligations and notices that apply to information under their custody or control.

Local Health is designed to operate in accordance with applicable Canadian privacy law, which may include the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial private-sector privacy laws.

Depending on the province, the type of information, and Local Health's relationship with a healthcare provider, additional health-information privacy laws may apply. In Ontario, for example, healthcare providers and other health information custodians may be subject to the Personal Health Information Protection Act, 2004 (PHIPA), and Local Health may in some circumstances act as a service provider, agent, electronic service provider, or information manager under an applicable arrangement.

The exact legal role can depend on the service, provider relationship, and information involved. Where Local Health processes information on behalf of a healthcare provider, those responsibilities may also be set out in a separate agreement with that provider.

Local Health applies privacy principles that include accountability, identifying purposes, meaningful consent where required, limiting collection, limiting use and disclosure, appropriate retention, accuracy, safeguards, openness, individual access, and a process for privacy questions or complaints.

Because health, identity, and financial information can be sensitive, Local Health aims to collect only information that is reasonably necessary for the feature being used and to apply safeguards proportionate to the sensitivity of that information.

Where identity verification is enabled, Local Health may use a specialized verification provider to collect and verify government-issued identification. Local Health's preferred design is to receive and retain the verification result, provider reference, and limited audit information rather than keeping raw identity-document images.

If a manual verification process is offered, Local Health will identify what information is required and why. Manual verification information will be limited to what is reasonably necessary for the review.

Appointment details, provider messages, insurance information, virtual-care information, and other information connected to a person's care can reveal sensitive health-related information even when they are not part of a formal clinical record.

Local Health uses this information only for the purposes reasonably necessary to provide, secure, support, or administer the relevant healthcare marketplace or appointment feature, or as otherwise permitted or required by law.

Local Health is not intended to replace a healthcare provider's clinical record system. Providers remain responsible for maintaining clinical records where required by their professional and legal obligations.

Local Health identifies the purposes for collecting personal information at or before collection and seeks consent where consent is required. The form of consent may depend on the sensitivity of the information, the user's reasonable expectations, and applicable law.

Sensitive information may require express consent in circumstances where applicable law requires it. Local Health will not rely on consent to justify collecting information that is not reasonably necessary or appropriate for the stated purpose.

Users may withdraw consent for optional uses, subject to legal, contractual, or operational restrictions. Withdrawing consent may affect features that depend on the information concerned.

Local Health does not assume that a family relationship automatically authorizes access to another person's information. Family access may require a separate invitation, direct consent, proof of authority, or manual review.

The account holder cannot approve their own request on behalf of the invited person. Access may be restricted where confidentiality, capacity, substitute-decision-making, or other legal issues require a different process.

Local Health may use information a user submits in search or care-navigation tools to identify relevant professions, provider profiles, filters, or appointment options.

Where an AI-assisted search feature is used, Local Health will limit the information sent to the feature to what is reasonably necessary for the request and will not treat the output as a diagnosis or clinical decision.

Local Health does not use patient appointment details, provider messages, family information, or insurance-policy details to train public advertising profiles.

Local Health may use third parties for cloud hosting, databases, email delivery, identity verification, authentication, payment processing, analytics, scheduling integrations, and other operational services.

When a third party processes personal information on Local Health's behalf, Local Health remains responsible for selecting appropriate providers and using reasonable contractual, administrative, and technical safeguards for the information under Local Health's control.

Third-party healthcare providers and independent external websites may also collect information for their own purposes. Their own privacy notices apply to that independent collection.

Provider payment information is processed through a third-party payment processor. Local Health does not intend to store full payment-card numbers or card security codes in its own application database.

Local Health may retain billing records such as customer or subscription identifiers, transaction status, provider count, invoice information, plan information, billing email, and related audit records where needed for subscription administration, accounting, support, and legal obligations.

Necessary technologies may be used for sessions, account security, fraud prevention, load balancing, and privacy preferences.

Optional analytics or marketing technologies should be controlled separately from technologies needed for core account functions. More information is available in the Cookie Policy.

Local Health does not sell personal health information and does not intend to disclose appointment details, symptoms, family-account information, provider messages, virtual-care links, or insurance-policy details to advertising networks for behavioural advertising.

If Local Health sends commercial electronic messages, it will do so in accordance with applicable Canadian anti-spam requirements, including consent and unsubscribe requirements where they apply. Transactional messages needed to provide an account, appointment, security, support, or billing service are handled separately from optional promotional communications.

Some cloud or technology providers may process information outside the user's province and, depending on the provider and service, outside Canada. Information processed in another jurisdiction may be subject to lawful access by authorities in that jurisdiction.

Local Health will assess cross-border processing requirements under applicable law and use contractual and other safeguards appropriate to the information involved. Where Quebec law applies, required privacy impact assessments and written arrangements will be used for qualifying transfers or processing outside Quebec.

Local Health retains personal information only for as long as reasonably needed for the purpose for which it was collected, to provide and secure the service, meet legal or regulatory requirements, maintain accounting and audit records, resolve disputes, or enforce agreements.

Different records may have different retention periods. For example, an account may be deleted while certain billing, fraud-prevention, security, consent, verification, or legal records are retained for a longer period where necessary.

When information is no longer required, Local Health will securely delete, destroy, or de-identify it as appropriate and as permitted by applicable law.

Local Health uses administrative, technical, and organizational safeguards appropriate to the sensitivity of the information it handles. These may include encryption in transit, encryption of selected sensitive database fields, access controls, least-privilege permissions, multi-factor authentication, rate limiting, secure session management, input validation, audit logging, backups, vulnerability management, and incident-response procedures.

No online service can guarantee absolute security. Users are responsible for protecting their credentials and should notify Local Health promptly if they believe their account has been compromised.

Local Health maintains procedures to assess and respond to suspected privacy or security incidents. Where applicable law requires notification to affected individuals, privacy regulators, healthcare providers, or other parties, Local Health will provide that notification in accordance with the applicable requirements.

Local Health may preserve relevant records of a privacy or security incident as required for investigation, legal compliance, insurance, audit, or security purposes.

Local Health takes reasonable steps to keep personal information accurate, complete, and up to date where accuracy is important to the purpose for which the information is used.

Users and providers can help by keeping account, profile, contact, insurance, availability, and credential information current and by notifying Local Health of material errors.

Subject to applicable law, an individual may request access to personal information Local Health holds about them, request correction of inaccurate information, ask how information has been used or disclosed, withdraw consent where consent is the legal basis for an optional use, or ask questions about Local Health's privacy practices.

Some information may be unavailable for access or deletion where an exception applies, where Local Health must protect another person's information, or where retention is legally required.

Local Health may verify identity before acting on a privacy request so that personal information is not disclosed or changed for the wrong person.

Where Quebec private-sector privacy law applies, Local Health will account for requirements concerning privacy governance, consent, privacy impact assessments, cross-border processing, privacy-by-default settings, access, correction, and portability where applicable.

Where Alberta's Personal Information Protection Act or British Columbia's Personal Information Protection Act applies, Local Health will handle personal information in accordance with the applicable provincial private-sector requirements.

These provincial requirements may apply instead of or alongside federal requirements depending on the organization, information, activity, and jurisdiction involved.

Local Health does not assume that a single age threshold determines privacy or healthcare decision-making authority across Canada.

Where a young person's information is involved, Local Health may require additional consent, authority, or manual review depending on applicable provincial law, the person's capacity, the sensitivity of the information, and the feature being used.

Local Health has designated responsibility for privacy compliance. Privacy questions, access or correction requests, and privacy complaints can be sent to support@localhealthcare.ca with the subject line 'Privacy Request'.

Local Health will investigate privacy complaints and take appropriate corrective action where a complaint is justified.

Individuals may also have the right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

Local Health may update this Privacy Policy as features, vendors, legal requirements, or information practices change. The effective date will be updated when changes are posted.

Material changes will be communicated in a reasonable manner. Where a new use of sensitive information requires fresh consent, Local Health will seek that consent before using the information for the new purpose.