Skip to content
Back to home

Legal

Privacy Policy

Updated October 7, 2026

This policy explains how MDpass handles personal health information and user data.

Who We Are

MDpass is a physician-first scheduling and referral management platform. Under the Nova Scotia Personal Health Information Act (PHIA), MDpass acts as an Agent on behalf of the physician or clinic, who remains the PHIA Custodian of the health records.

What We Collect

We collect the following information as directed by the Custodian:

Patient Health Information (PHI)
Name, HCN, DOB, postal code, and clinical notes.
User Account Data
Work email, credentials, and department.
Usage Data
Audit logs of all PHI access and interactions.
Public Site Analytics
Anonymous daily counts of how the public OPOR guide, home page and pricing page are used. See below.

How We Use Information

MDpass uses the collected data strictly for facilitating physician scheduling, managing clinical referrals, and ensuring PHIA compliance through immutable audit logging.

Public Site and Guide Analytics

The public OPOR guide at mdpass.ca/opor, the MDpass home page and the pricing page do not require an account. We count anonymous totals so we can see which guide answers help people, which pages are opened and which buttons are used. This is not used for advertising or to profile visitors.

What is counted
The date (UTC) and the type of action: viewing a guide page, choosing an option, opening a resource, searching, clicking the MDpass link in the guide footer, opening the home or pricing page, or clicking a listed button on those pages. For the guide, the page, option or resource involved is also counted.
Campaign source
If you arrive at the guide through a link with a utm_source tag, we count it only when it matches one of our approved campaign names; any other value is counted as unattributed. A tag shows how a link was shared. It does not show where you live, who you are or where you work.
Search
Only the number of results, in a range. What you type into the search box is never stored.
What is not stored
No account, name, email, IP address, device or browser details, visitor or session identifier, cookie, or free text, and no raw tag value. Each record is a running total for the day, not a visit, so we cannot follow one person from the guide to the home page.
Where and how long
In our Canadian database for 24 months, then deleted automatically.

Like any website, requests to mdpass.ca pass through our hosting provider, Vercel, which keeps standard request and error logs (which can include technical details such as IP address and browser type) for its own operation and security under its standard retention. We do not use those logs for guide analytics.

Subprocessors

All infrastructure is rigidly pinned to Canadian data centers (ca-central-1 and yul1) to ensure data residency compliance.

Vercel
Montréal (yul1)
Supabase / AWS
Canada (ca-central-1)
Ocean MD
Planned Integration

Data Retention

In accordance with PHIA s.52, clinical data and audit logs are retained for a minimum of 10 years. Database backups are retained securely for 7 days. Anonymous public guide analytics are retained for 24 months.

Patient Rights

Patients have the right to access PHI, request corrections, and inquire about record access. To exercise these rights:

View Patient Request Form

Privacy Officer Contact

For questions, please contact the Privacy Officer at your clinic.