Privacy Policy

1. Introduction

Simplify Health Inc. ("we", "us", "our") operates the Simplify Health dental referral management platform. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy legislation.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

2. Accountability

We are responsible for all personal information under our control. We have designated a Privacy Officer who is accountable for compliance with this policy. Our Privacy Officer can be reached at:

Privacy Officer
Email: privacy@simplifyhealth.ca

3. Information We Collect

3.1 Patient Information

When a dental referral is submitted on your behalf, we may collect:

• Full name
• Email address
• Phone number
• Date of birth
• Dental referral documents (PDFs, images)
• Treatment notes provided by the referring dentist

3.2 Dental Professional Information

When you register as a referral partner, we collect:

• Full name
• Email address
• Clinic/practice name
• Organization affiliation

3.3 Communications

We collect SMS messages and email communications between the platform and patients regarding referrals and appointment booking.

4. Purposes of Collection

We collect and use your personal information for the following purposes:

• Referral processing: To create and manage dental referrals between referring dentists and specialist practices
• Patient record creation: To create patient records in our HIPAA-compliant practice management system (NexHealth)
• Communication: To send SMS and email notifications about referral status and appointment booking
• AI extraction: To process submitted documents using artificial intelligence to extract patient contact information
• Account management: To manage dental professional accounts and access credentials
• Service improvement: To improve our platform functionality and user experience
• Legal compliance: To meet regulatory and legal requirements applicable to dental practice management

5. AI Processing Disclosure

We use artificial intelligence (AI) technology powered by Groq, a US-based service provider, to process referral documents and email content. Specifically:

• AI extracts patient names, email addresses, and phone numbers from referral documents and emails
• AI processes SMS conversation content to facilitate appointment booking
• AI processing involves transmitting personal information to servers located in the United States

By submitting a referral through our platform, the referring dental professional confirms they have obtained the patient's consent for this processing.

6. Third-Party Service Providers

We use the following third-party service providers who may process your personal information:

• Supabase (United States) — Database hosting and authentication services
• NexHealth (United States) — HIPAA-compliant patient record and document storage
• Groq (United States) — AI processing for contact extraction and conversation handling
• Resend (United States) — Email delivery and webhook processing
• Twilio / Telnyx (United States) — SMS messaging services

All service providers are contractually obligated to protect your personal information in accordance with applicable privacy laws.

7. Cross-Border Data Transfers

Your personal information is stored on servers located in the United States. When your information is transferred across borders, it may be subject to the laws of the jurisdiction to which it is transferred. We ensure that appropriate safeguards are in place for all cross-border transfers, including contractual protections with our service providers that meet PIPEDA requirements.

8. Consent

We obtain consent before collecting, using, or disclosing your personal information, except where otherwise permitted or required by law. For health information, we require express consent.

Referring dental professionals confirm they have obtained patient consent before submitting referral information through our platform. Patients can withdraw consent at any time by contacting our Privacy Officer.

9. Data Retention

We retain personal information for the following periods:

• Referral records: 7 years after last activity (aligned with dental record retention requirements)
• SMS and email communications: 2 years
• Audit logs: 7 years
• Referral documents (PDFs): 7 years
• Conversation state: 24 hours (ephemeral)

When the retention period expires, we securely delete or anonymize the information.

10. Your Rights

Under PIPEDA, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Erasure: Request deletion of your personal information, subject to legal retention requirements
• Withdraw consent: Withdraw consent for the collection, use, or disclosure of your information
• Complaint: File a complaint with our Privacy Officer or the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact our Privacy Officer at privacy@simplifyhealth.ca.

11. Safeguards

We protect your personal information using appropriate safeguards, including:

• Encrypted data transmission (HTTPS/TLS)
• Row-level security on all database tables
• Authentication required for all data access endpoints
• JWT-based session authentication via Supabase Auth
• Webhook signature verification
• Access controls limiting data visibility to authorized personnel

12. Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

13. Contact Information

For questions about this Privacy Policy or to exercise your privacy rights, please contact:

Simplify Health Inc.
Privacy Officer
Email: privacy@simplifyhealth.ca

To file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
1-800-282-1376
www.priv.gc.ca