Legal

Privacy Policy

Actuwell Health Application Inc. is committed to protecting the privacy, confidentiality, and security of the personal and personal health information (PHI) we collect and store, in compliance with Ontario's Personal Health Information Protection Act (PHIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Last updated May 19, 2026

1. Scope and Our Role Under PHIPA

This Privacy Policy applies to all users of our mobile application, Actuwell, and outlines how we collect, use, disclose, retain, and protect personal information and personal health information.

Our Role

Actuwell operates as an agent on behalf of participating healthcare providers who are Health Information Custodians (HICs) under Ontario's Personal Health Information Protection Act (PHIPA). We process PHI with the authorization of these healthcare providers and for their purposes, enabling patients to securely access their health information and communicate with their care providers.

The healthcare providers participating on the Actuwell platform remain the Health Information Custodians responsible for your PHI. Actuwell acts under their authority to facilitate secure storage, access, and transmission of your health information.

What this means for you:

Your doctors remain the custodians of your medical records
Actuwell facilitates secure access to your health information on their behalf
Your healthcare provider's privacy policies and retention schedules apply to your medical records
You maintain all rights under PHIPA to access, correct, and control your PHI

This policy also addresses personal information (non-health) collected under the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What Information We Collect

We collect the following categories of information directly from users or through their use of the app:

Personal Information (PI):

Full legal name, preferred name, date of birth, sex assigned at birth, and gender identity
Email address
Phone number (used for multi-factor authentication via SMS)
Province of residence
Health card information
Identity verification data (photo identification and selfie, processed through Entrust for verification purposes only — see Section 6 for important details)

Note on preferred name and gender identity

Your preferred name is used within the app to personalize your experience. Your gender identity is collected solely for the purpose of in-app personalization. Medical guidance, health recommendations, and clinical reference ranges provided through the app are based on your sex assigned at birth, which is collected separately, in accordance with Canadian clinical practice guidelines.

Personal Health Information (PHI):

Medical conditions and family medical history
Allergies
Prescription and supplement regimen
Vaccination history
Health habits
Primary care provider information
Medical appointments and procedure history
Medical tests and lab results
Height and weight
Medical documents synchronized from your healthcare provider's office
Medical documents uploaded by you for personal record-keeping

Technical Data and Analytics:

IP address and device identifiers
Device and app usage data (e.g., screen views, feature access)
Crash logs and error reports
Non-personally identifiable information (non-PII) and non-PHI user activity for analytics and debugging purposes

We do not knowingly collect information from minors under the age of 18.

3. Purpose of Collection and Use of Information

Your information is collected and used only for purposes necessary to operate and improve the app, including:

Enabling your health record organization and access features
Synchronizing medical documents directly from your healthcare provider's electronic medical records system
Using AI-assisted document classification to filter and categorize medical documents synchronized from your healthcare provider, ensuring only relevant records are stored and displayed in your account
Facilitating appointment scheduling with your healthcare provider
Generating reminders for vaccinations, tests, or follow-ups based on Canadian health guidelines
Providing educational lifestyle tips and recommendations based on Canadian clinical practice guidelines (for informational purposes only)
Allowing secure data export for personal use or to share with providers
Administering subscription services and billing
Providing technical support and monitoring platform performance
Meeting legal and regulatory obligations
Verifying user identity through SMS-based multi-factor authentication (MFA) and Entrust identity verification services
Personalizing your in-app experience using your preferred name and gender identity
Sending transactional communications necessary for the operation of your account, and where you have provided express consent, sending commercial communications in compliance with Canada's Anti-Spam Legislation (CASL)
Analyzing non-PII and non-PHI usage patterns to improve app functionality, user experience, and technical performance

We will not use PHI or PI for any unrelated secondary purpose without explicit consent.

5. Disclosure of Information

We will not sell or rent your data. Disclosure occurs only:

With your informed, voluntary consent (e.g., if you export your data to share)
To your healthcare provider's office for the purpose of appointment scheduling and medical document synchronization
When legally obligated (e.g., subpoena, health oversight authority)
As required to enforce our Terms of Service or protect rights/safety

In rare cases, we may disclose anonymized and aggregated usage data for system performance analysis or quality assurance.

6. Third-Party Service Providers

We use secure third-party service providers for cloud hosting, authentication, identity verification, subscription management, and analytics. These service providers act as our agents or subprocessors and are contractually obligated to protect your information and use it only for the purposes we specify.

Identity Verification Services

Provider Transition Notice

Actuwell transitioned its identity verification provider from Plaid to Entrust with the release of version 1.4.0 (May 19, 2026). Identity verification occurs once, at the time of account creation. The applicable provider and terms depend on when you completed your identity verification:

Verified on or after May 19, 2026: Your verification was processed through Entrust. The Entrust section below applies to you.
Verified before May 19, 2026: Your verification was processed through Plaid. The Plaid section below applies to you. Users verified through Plaid will not be asked to re-verify.
Account created but identity verification not yet completed: You will be prompted to verify through Entrust when you next progress through onboarding on version 1.4.0 or later.

Current Identity Verification Provider: Entrust (v1.4.0 and later)

For users who completed identity verification on or after May 19, 2026, we use Entrust Identity Verification services to verify user identity as part of our security and compliance protocols. The process requires you to provide a photo of your government-issued identification and a selfie for biometric matching.

What Actuwell Receives and Accesses

Actuwell receives only three pieces of information from Entrust: your verification result (passed/failed), your name as extracted from your identification document, and your date of birth as extracted from your identification document. These are used solely to complete your account onboarding.

By default, Actuwell does not access your identity documents, selfie photographs, or any biometric data held by Entrust. The only exception is where you explicitly contact Actuwell support and grant us permission to review your verification record in order to assist with an onboarding issue. This access is only possible within the 48-hour window before Entrust permanently deletes all verification data.

Data Retention and Deletion

Under our agreement with Entrust, all identity verification data — including your identification documents, selfie photographs, and biometric data — is permanently deleted from Entrust's systems within 48 hours of your verification being completed or abandoned. No identity verification data is retained by Entrust beyond this window.

Given this 48-hour automatic deletion policy, your identity verification data will have already been permanently deleted from Entrust's systems long before any account deletion request would be processed. No separate deletion request to Entrust is required when you delete your Actuwell account.

Data Processing Location

All identity verification data processed through Entrust is stored on AWS infrastructure located in Canada (Montreal region). Your identity verification data does not leave Canada. Entrust is contractually bound to comply with PIPEDA requirements and implements industry-standard security controls. Data is encrypted in transit (TLS/SSL) and at rest.

Previous Identity Verification Provider: Plaid (prior to v1.4.0)

For users who completed identity verification before May 19, 2026, identity verification was processed through Plaid Identity Verification services, a United States-based company.

Important: Cross-Border Data Transfer (Plaid)

Plaid Inc. is a United States-based company headquartered in San Francisco, California. When you completed identity verification through Plaid, your identification documents and selfie were transferred to and processed in the United States, stored on Plaid's servers located in the United States (AWS regions in the US). This constitutes a cross-border transfer of your personal information from Canada to the United States.

Safeguards implemented for this transfer: Plaid is contractually bound to comply with PIPEDA requirements for international data transfers; standard contractual clauses govern the transfer and processing of your data; Plaid maintains SOC 2 Type II certification and implements industry-standard security controls; data is encrypted in transit (TLS/SSL) and at rest.

AI-Assisted Document Processing (Anthropic)

We use Anthropic's Claude AI service to process and categorize medical documents synchronized from your healthcare provider's electronic medical records system. When medical documents are synchronized to your Actuwell account, their content — which may include your name, date of birth, and other personal health information contained within the document — is transmitted to Anthropic's Claude AI to determine whether each document is a relevant medical record and to categorize it appropriately for display within the app.

Data Protection and Zero Retention

Actuwell and Anthropic have executed a Business Associate Agreement (BAA) governing the handling of Protected Health Information (PHI) in connection with this service. Actuwell uses Anthropic's native API with Zero Data Retention enabled.

Document content transmitted to Anthropic is processed transiently and is not stored or retained by Anthropic or its subcontractors upon completion of processing
Your PHI is not used by Anthropic to train AI models
Anthropic is contractually bound under the BAA to use your PHI solely to perform the document processing service and for no other purpose
Anthropic employs appropriate administrative, technical, and physical safeguards to protect PHI during processing as required under HIPAA

Important: Cross-Border Data Transfer (Anthropic)

Anthropic, PBC is a United States-based company headquartered in San Francisco, California. When your medical documents are processed for categorization, document content is transmitted to and processed by Anthropic's systems in the United States. This constitutes a cross-border transfer of your personal health information from Canada to the United States.

Safeguards implemented: A Business Associate Agreement (BAA) between Actuwell and Anthropic governs the handling of PHI; Zero Data Retention is enabled, meaning no PHI persists on Anthropic's systems after processing completes; data is encrypted in transit (TLS/SSL). By using Actuwell's document synchronization features, you consent to this transient cross-border transfer to the United States for document classification purposes.

Authentication and Database Services (Supabase)

Any metadata that Supabase processes is fully de-identified and permanently anonymized before any use for internal platform optimization.
Supabase acts as our agent under PHIPA, and is contractually bound by confidentiality and strict information-handling practices.
No personal health information (PHI) is disclosed to or accessible by Supabase in identifiable form.
Supabase may use de-identified metadata solely for the limited purpose of improving their services under HIPAA 45 C.F.R. §§ 164.502(d), 164.514 and equivalent PHIPA requirements.

Subscription Management (RevenueCat)

RevenueCat processes subscription transaction data, including purchase history and subscription status.
RevenueCat does not have access to your personal health information.
RevenueCat acts as our service provider and is contractually obligated to protect your data.

Cloud Infrastructure (Amazon Web Services)

AWS Security Commitments

AWS acts as our service provider and is contractually bound to maintain PIPEDA compliance for all Canadian data, implement industry-standard security controls, process data only as instructed by Actuwell, and store all PHI exclusively in Canadian data centers (ca-central-1 region). All data stored on AWS infrastructure is encrypted at rest and in transit.

A full list of subprocessors can be provided upon request by contacting privacy@actuwell.ca.

7. Data Storage and International Transfers

All personal health information (PHI) is stored securely on cloud servers located in Canada (AWS ca-central-1 region). Data is encrypted both in transit and at rest using industry-standard protocols.

Cross-Border Data Transfers — there is one exception to Canadian data storage for current users:

AI document processing (Anthropic): Medical document content is transiently transmitted to Anthropic's systems in the United States for the sole purpose of automated classification and categorization. Zero Data Retention is enabled, meaning no PHI is stored on Anthropic's systems after processing completes. This transfer is governed by a Business Associate Agreement (BAA) between Actuwell and Anthropic.
Identity verification (Entrust — v1.4.0 and later): Identity verification data is processed entirely within Canada (AWS Montreal region) and does not leave Canada.
Identity verification (Plaid — prior to v1.4.0): For users who verified their identity before May 19, 2026, verification data was transferred to the United States as described in Section 6. This data remains subject to Plaid's retention and deletion policies.

We do not store or transfer PHI outside of Canada for any other purpose unless legally required or explicitly consented to by you.

8. Safeguards and Security

We have implemented administrative, technical, and physical safeguards in line with PHIPA requirements, including:

Encrypted databases and secure authentication protocols
Least-privilege internal access controls
Regular privacy and security training for staff
Security incident detection and response procedures
SOC 2 certification process underway to further validate our security controls

PHIPA-Specific Controls:

All access to personal health information is logged and subject to audit
Audit logs capture timestamps, user IDs, access types, and actions taken
Role-based access is reviewed regularly to ensure least-privilege principles
All employees are trained in PHIPA and bound by confidentiality agreements

9. Your Rights

You have the right to:

Access your personal and health data stored in the app
Correct or update inaccurate information
Delete your account and associated data (subject to healthcare provider retention policies and legal requirements)
Export your data in a structured, readable format
Request a list of our third-party service providers and subprocessors
Withdraw consent for data processing (by deleting your account)

Requests for data access, correction, or deletion can be initiated from within the app or via our contact channels. We will respond to all requests within 48 business hours.

10. Data Retention and Deletion

Active Account Data: Your personal and health information is retained for as long as your account is active. Your healthcare provider, as the Health Information Custodian, determines retention periods for medical records synchronized from their office.

When you request deletion of your Actuwell account, the following process occurs:

Immediate Actions (within 24 hours): Your account is deactivated and marked for deletion. We notify your healthcare provider(s) of your account deletion request. Where applicable, we submit deletion requests to third-party service providers.
Within 30 Days: All personal information and PHI are permanently deleted from Actuwell's active databases. All automated backup copies are purged from Actuwell's backup systems. Account deletion is confirmed to you via email.

Complete Data Purging from Actuwell Systems

Within 30 days of your deletion request, all of your data — including all backup copies stored in our automated backup systems — will be permanently purged from Actuwell's systems and rendered unrecoverable.

Identity Verification Data (Entrust — v1.4.0 and later): Your verification data will have already been automatically and permanently deleted by Entrust within 48 hours of your original verification. No deletion request to Entrust is required.
Identity Verification Data (Plaid — prior to v1.4.0): We will submit a deletion request to Plaid on your behalf. For direct inquiries, contact Plaid at privacy@plaid.com.
AI Document Processing (Anthropic): Anthropic does not retain your PHI after processing completes due to Zero Data Retention being enabled — no deletion request to Anthropic is required.

Certain data may be retained beyond 30 days only when required by law (e.g., financial records for tax purposes, typically 7 years), necessary for legal proceedings or regulatory compliance audits, or part of de-identified, aggregated data that cannot be linked back to you.

Please note that medical records maintained by your healthcare provider remain subject to their retention policies as Health Information Custodians under PHIPA. Deletion of your Actuwell account does not delete records held by your healthcare provider's office.

11. Children's Privacy

Actuwell is not intended for individuals under 18 years of age. We do not knowingly collect, use, or store personal data from minors.

12. Changes to this Policy

We may update this Privacy Policy to reflect legal changes or feature updates. If changes are material, we will provide a prominent in-app notice at least 30 days before the changes take effect. Your continued use of Actuwell after such updates constitutes acceptance of the changes.

13. Privacy Breach Protocol

In accordance with PHIPA, we have implemented a comprehensive privacy breach response protocol. In the event of unauthorized access, loss, or disclosure of personal health information, we will:

Immediately contain the breach and assess the risk to affected individuals
Notify affected individuals at the first reasonable opportunity (within 48 business hours of discovery) if there is a risk of significant harm
Notify the affected healthcare provider(s) who are the Health Information Custodians
Notify the Information and Privacy Commissioner of Ontario where required by law
Maintain a detailed log of all privacy breaches
Undertake thorough internal investigations and implement corrective actions
Report the breach to affected custodians as required under our agent obligations

14. Contact Us

If you have questions or wish to exercise your privacy rights under PHIPA or PIPEDA, please contact our designated Privacy Officer at privacy@actuwell.ca. Our address is 740 Dupont St, Toronto ON, M6G 0A9. We will respond to all inquiries within 48 business hours.

Questions about this document? Email contact@actuwell.ca.