Skip to content
Back to home

Legal

Privacy Policy

Updated October 7, 2026

This policy explains how MDpass handles personal health information and user data.

Who We Are

MDpass is a physician-first scheduling and referral management platform. Under the Nova Scotia Personal Health Information Act (PHIA), MDpass acts as an Agent on behalf of the physician or clinic, who remains the PHIA Custodian of the health records.

What We Collect

We collect the following information as directed by the Custodian:

Patient Health Information (PHI)
Name, HCN, DOB, postal code, and clinical notes.
User Account Data
Work email, credentials, and department.
Usage Data
Audit logs of all PHI access and interactions.
Public Guide Analytics
Anonymous daily counts of how the public OPOR guide is used. See below.

How We Use Information

MDpass uses the collected data strictly for facilitating physician scheduling, managing clinical referrals, and ensuring PHIA compliance through immutable audit logging.

Public OPOR Guide Analytics

The public OPOR guide at mdpass.ca/opor does not require an account. We count how the guide is used so we can see which questions and answers help people and which need improving. This is not used for advertising or to profile visitors.

What is counted
The date (UTC), the type of action (such as viewing a page of the guide, choosing an option, opening a resource, or searching), and the guide page, option or resource involved.
Search
Only the number of results, in a range. What you type into the search box is never stored.
What is not stored
No account, name, email, IP address, device or browser details, visitor or session identifier, or free text. Each record is a running total for the day, not a visit.
Where and how long
In our Canadian database for 24 months, then deleted automatically.

Like any website, requests to mdpass.ca pass through our hosting provider, Vercel, which keeps standard request and error logs (which can include technical details such as IP address and browser type) for its own operation and security under its standard retention. We do not use those logs for guide analytics.

Subprocessors

All infrastructure is rigidly pinned to Canadian data centers (ca-central-1 and yul1) to ensure data residency compliance.

Vercel
Montréal (yul1)
Supabase / AWS
Canada (ca-central-1)
Ocean MD
Planned Integration

Data Retention

In accordance with PHIA s.52, clinical data and audit logs are retained for a minimum of 10 years. Database backups are retained securely for 7 days. Anonymous public guide analytics are retained for 24 months.

Patient Rights

Patients have the right to access PHI, request corrections, and inquire about record access. To exercise these rights:

View Patient Request Form

Privacy Officer Contact

For questions, please contact the Privacy Officer at your clinic.