Privacy Policy

TCM CRM is a product of NTL Learning Solution Inc. ("NTL", "we", "us"). This Privacy Policy explains how we collect, use, and protect information when you visit tcmcrm.ca (the "marketing site") and when your clinic uses the TCM CRM application (the "Service").

1. Two kinds of data, two roles

Marketing site data. When you request a demo, start a free trial, or otherwise submit a form on tcmcrm.ca, we collect the information you provide — typically your name, clinic name, email, and phone number. For this data, NTL is the data controller.

Clinical and patient data. Once your clinic is set up on the Service, your clinic controls the patient, clinical, and payment information entered into it. For that data, your clinic is the data controller and NTL acts as a data processor / service provider, storing and processing it only as needed to provide the Service and on your clinic's instructions. Your clinic remains responsible for its own compliance with applicable health-information and privacy laws (including BC's Personal Information Protection Act and, where applicable, PIPEDA) for the patient data it collects and manages using the Service.

As part of onboarding, we provision your clinic's Service instance — including its hosting and database — under accounts that belong to your clinic, not to NTL, and hand you those credentials directly. This means your clinic's patient and clinical data lives in infrastructure your clinic controls; NTL does not separately hold or own a copy of your clinical data outside of that instance.

2. What we collect

• Contact details you submit through demo-request or free-trial forms.
• Clinical records, patient demographics, appointment and payment history, and consent records entered into the Service by your clinic's staff.
• Voice audio captured for dictation is transcribed in real time and is not stored after transcription — only the resulting text becomes part of the patient's chart.
• Basic technical data (IP address, browser type, pages visited) for the marketing site's operation and security.

3. How we use it

We use marketing-site data to respond to your inquiry, follow up about a demo or trial, and improve the site. We process Service data solely to provide, secure, and support the Service for your clinic — we do not sell patient data, and we do not use it to train unrelated models or for advertising.

4. Where data is stored, and who else touches it

Data is hosted with Supabase (PostgreSQL database, Canadian data region) and served via Cloudflare. Payment processing at the point of care may involve Square, depending on your clinic's configuration. Voice dictation is transcribed using a third-party speech-to-text provider (Groq); as noted above, the audio itself is not retained after transcription. Each of these providers processes data only as necessary to deliver their part of the Service.

5. Security

We use industry-standard safeguards — encryption in transit, access controls, and row-level security scoping data to your clinic — but no system is perfectly secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

6. Your rights

If you're a website visitor or trial requester, you can ask us to access, correct, or delete the contact information we hold about you by emailing us. If you're a patient of a clinic using the Service, requests about your personal health information should go to that clinic directly, as they control that data; we will support the clinic in fulfilling such requests.

7. Cookies

The marketing site uses minimal, functional cookies/local storage necessary for the site to work (for example, remembering your language preference). We do not use third-party advertising trackers.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact us

Questions about this policy or your data can be sent to support@tcmcrm.ca.