Clinic
Directory

Privacy Policy

Last Updated: August 2026

1. Introduction

Welcome to Clinic Directory ("we", "our", or "us"). We are a directory and referral-routing platform that helps people find health clinics across Canada. We handle your personal information in accordance with:

  • The Personal Information Protection and Electronic Documents Act (PIPEDA) — Canada's federal private-sector privacy law, which applies to our activities generally;
  • The Personal Information Protection Act (PIPA) — Alberta, for our activities in Alberta;
  • The Personal Information Protection Act (PIPA) — British Columbia, for our activities in British Columbia.

We are not a healthcare provider and not a custodian under provincial health-information statutes (such as Alberta's Health Information Act). Clinics listed in the directory that receive your information create and manage their own clinical records under their own legal obligations, which may include custodian duties under those statutes.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services.

2. Information We Collect

We may collect the following types of information when you interact with our platform:

  • Contact Information: Your name, email address, and phone number.
  • Health Preferences (Intake): Your primary condition, symptoms, and any specific preferences you specify when looking for a clinic. This is sensitive information; we collect it only with your express consent, for the routing described in Section 3.
  • Location Information: Your city and province, used to match you with local healthcare providers.
  • Account Activity: Clinics and practitioners you save to your profile, communication preferences, and event/class interests.
  • Usage Data: Information about how you navigate and interact with our website, including search queries and page views. Usage analytics tied to a persistent identifier run only if you accept cookies — see Section 9 and our Cookie Policy.

3. How We Use and Share Your Data (Intake Process)

Important Information Regarding the Intake Routing Form:

Clinic Directory functions as a directory and referral-routing engine. When you submit information via our Intake form to find a matched healthcare provider, you consent to the following:

  • Targeted Routing: We transmit your contact details and specified health concerns only to the local clinic(s) you have selected or those matched by our system based on your needs, as disclosed on the intake form.
  • No Medical File Retention: We are a directory and referral platform, not a medical provider. We do not create, maintain, or permanently store medical records or patient files.
  • Practitioner Contact: The matched clinic receives your information in order to contact you directly for scheduling and further clinical assessment. From that point, the clinic handles your information under its own privacy and health-records obligations.

4. Retention and Anonymization of Intake Data

We believe your health journey is personal. Our system is designed to connect you to care, and then remove who you are from what it keeps:

  • Intake Data Anonymization: Personal identifiers on intake records (name, email, phone, and the specific condition text you entered) are cleared by an automated daily process once 30 days have passed since submission. The identity fields are permanently removed from the record.
  • Analytics Anonymization: Before anonymization, records are aggregated into de-identified data (names, contact details, and precise locations removed; broad condition category, general area, and record dates retained — e.g., "a search occurred in a postal region for a broad condition category on a given date"). By submitting an intake form, you consent to this de-identified data being used to improve our network and for market research.
  • Account Data: Retained for the duration of your active account. You may request deletion at any time; we action deletion requests promptly, and in any event within 30 days (see Section 11).

5. Web Crawlers & Public Directory Data

To provide a comprehensive directory of clinics across Canada, we aggregate publicly available business information about healthcare clinics (such as from public websites, open data sources, and public web directories).

  • This data is limited to public business contact information and does not involve any patient-level data collection.
  • If you are a clinic owner, we provide mechanisms to "Claim" your profile, allowing you to control and update the information displayed. Alternatively, you may contact our support team to have your indexed profile removed entirely.

6. Data Security

We implement industry-standard security measures, including encryption at rest for our databases and secure connections (HTTPS), to protect your personal information. Our production infrastructure isolates our public-facing frontend from our backend routing engine. Where your data physically resides and which providers process it is set out in Sections 7 and 8.

7. Where Your Data Is Processed

Our primary database — where intake submissions, accounts, and clinic records live — is hosted in Canada (AWS Canada Central region, via Supabase). Some processing, however, happens outside Canada:

  • Application servers (the backend that receives and routes your requests) run on Render in the United States (Ohio).
  • Email (including intake-related notifications to clinics) is delivered via Google (Gmail/Google Workspace) infrastructure in the United States.
  • Payments for clinic subscriptions are processed by Stripe in the United States.
  • Website delivery and error monitoring use Vercel and Sentry, which operate in the United States and on global networks.

Notice for Alberta residents (PIPA s. 13.1): We use service providers outside Canada to collect, use, store, or disclose personal information for the purposes described in this policy. While outside Canada, your information is subject to the laws of those jurisdictions, including lawful access by their courts, law enforcement, and national-security authorities. You may contact our Privacy Officer at privacy@clinicdirectory.ca, who can answer questions about the collection, use, disclosure, or storage of personal information by our service providers outside Canada.

8. Third-Party Service Providers

We work with the following providers, who process data on our behalf under data-processing terms and their own privacy policies:

  • Supabase — database hosting (Canada)
  • Render — backend API hosting (United States)
  • Vercel — website hosting and delivery
  • Google — analytics (Google Analytics 4) and advertising (AdSense), both only after you accept cookies; AI content generation (Gemini); mapping services; and email delivery (Gmail/Google Workspace)
  • Stripe — payment processing for clinic subscriptions
  • Meta Platforms — advertising measurement. The Meta Pixel runs only after you accept cookies; a server-side conversions integration exists in our configuration but is not active, and would operate subject to the same consent
  • Sentry — application error monitoring
  • Twilio — call-tracking telephone numbers offered to premium clinics (configured; not currently active)
  • ScrapingAnt / BrightData — proxy and web parsing services used exclusively for aggregating public business data (Section 5)

We do not sell your personal data to these or any other third parties. If we add a service provider that processes personal information, we will update this list.

9. Cookies & Tracking Technologies

Non-essential cookies and tracking identifiers — including our own first-party analytics identifier — are off by default and run only if you choose Accept in our cookie banner. You can change or withdraw that choice at any time via the "Cookie settings" link in the footer of every page. For the full list of what runs before and after consent, see our Cookie Policy.

10. AI-Generated Content Disclosure

Some educational and informational content on our platform, including service guides, blog articles, and study summaries, is generated or assisted by artificial intelligence (Google Gemini). This content is reviewed for accuracy but does not constitute medical advice. Always consult a qualified healthcare professional for medical decisions.

11. Your Rights

Under Canadian privacy law, you have the right to:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate personal information.
  • Deletion: Request deletion of your personal data from our systems. We action deletion requests promptly, and in any event within 30 days (independent of, and typically faster than, the automatic intake anonymization in Section 4).
  • Withdraw Consent: Withdraw consent for marketing communications at any time, and withdraw cookie consent at any time via "Cookie settings" in the footer.

To exercise these rights, contact us at privacy@clinicdirectory.ca. We will respond within 14-30 days. Note that if your intake data has already been routed to a clinic, you will need to contact that clinic directly regarding records within their own systems.

12. Breach Notification

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify affected individuals and report to the relevant privacy commissioner(s) as required by PIPEDA and, where applicable, Alberta's Personal Information Protection Act. Notification will be provided as soon as feasible.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Officer at privacy@clinicdirectory.ca.

For complaints, you may also contact the Office of the Privacy Commissioner of Canada, or your provincial Information and Privacy Commissioner (including the Office of the Information and Privacy Commissioner of Alberta or of British Columbia).

Return to Home