Privacy Impact Assessment
Prepared by: NTL Learning Solution Inc. (“NTL”), operator of MyTCM
Last updated: October 14, 2026. This version corrects the August 31, 2026 edition: the list of sub-processors is now complete, and the statements about NTL’s access to clinic systems have been corrected.
1. Purpose and scope
This Privacy Impact Assessment (PIA) assesses the privacy risks of MyTCM, a clinic-management application built for Traditional Chinese Medicine (TCM) and acupuncture practitioners, initially serving clinics in British Columbia. It covers:
- The MyTCM clinic application (clinical charting, patient records, patient files, payments, consent capture, voice dictation, text and email messages to patients, calendar sync, and AI-assisted translation of clinical notes).
- The mytcm.ca marketing site (lead capture only: demo requests, free-trial signups).
- The vendor command center (NTL’s internal tenant-management console).
It does not separately assess third-party platforms (the providers listed in Section 6) beyond describing NTL’s due-diligence basis for relying on them as sub-processors/infrastructure providers.
2. Applicable legal framework
- British Columbia’s Personal Information Protection Act (PIPA): the governing private-sector privacy statute for BC clinics using the Service. CCHPBC’s own Professional Standard: Record-Keeping explicitly defers to PIPA for security and breach-notification obligations (§2.2, §2.3, §2.9).
- CCHPBC Professional Standard: Record-Keeping (in effect April 1, 2026): governs what BC TCM/acupuncture licensees must document, retain, and secure.
- Health Professions and Occupations Act (HPOA) and the Complementary Health Professionals Regulation (B.C. Reg. 130/2025): the current regulatory framework for CCHPBC and its licensees.
- PIPEDA may apply to NTL directly for cross-provincial or federally-regulated activity; PIPA is treated as substantially similar legislation for BC-based commercial activity.
Not yet assessed: privacy statutes of other provinces. This PIA will be supplemented before onboarding clinics outside BC.
3. Data flows and roles
MyTCM’s architecture is a dedicated-instance model, not a shared multi-tenant database: each clinic’s Service instance runs on its own Supabase (database) and Cloudflare (hosting) accounts, which the clinic owns. NTL provisions this infrastructure on the clinic’s behalf during onboarding.
This has a privacy consequence worth stating plainly. Although each clinic owns its accounts, NTL keeps technical credentials for each clinic’s instance in its own administration system (the Command Center), which it uses to provision, update, migrate and support the service. NTL therefore has the technical means to reach a clinic’s systems after onboarding. Access is limited to named administrator accounts, and sign-in uses a passkey or an emailed one-time code. NTL stores these credentials encrypted, in a database that web browsers cannot read directly. Administrative actions such as updates, repairs and set-up, and each time a stored credential is revealed, are recorded in an action log. The log does not record every access. NTL staff use AI assisted engineering tools with administrator access.
| Data | Controller | Processor / infrastructure holder | Where it lives |
|---|---|---|---|
| Marketing site leads (demo requests, trial signups) | NTL | NTL (via NTL’s own Supabase project) | NTL’s tcmcrm-marketing Supabase project (Canadian region) |
| Patient/clinical/payment records | The clinic | The clinic (own Supabase project, provisioned by NTL) | Clinic’s own Supabase project, Canadian region by default |
| Voice dictation audio | The clinic | Deepgram (transient, sub-processor) | Not persisted; see Section 4 |
| Card payments | The clinic | Square (sub-processor) | Square’s own systems; MyTCM stores the resulting payment record, not card data |
| Patient files (documents, photos, short videos) | The clinic | AWS S3 (sub-processor) | Canada: Montreal, with a backup copy in Calgary |
| Appointment confirmations and reminders | The clinic | Twilio (SMS) and Resend (email), sub-processors | Provider systems; see Section 6 |
| Clinical note text sent for translation | The clinic | DeepSeek, or Cloudflare Workers AI as a fallback (sub-processors) | Provider systems; see Section 6 |
| Calendar sync and nightly backup | The clinic | Google, Apple (optional calendar sync) and GitHub (sub-processors) | Provider systems; see Section 6 |
4. Personal information collected, by category
Per CCHPBC’s Record-Keeping Standard §1.2 (which defines the minimum a licensee must document; MyTCM’s structured charting schema was built to satisfy this):
- Patient identifying information: full name, sex/gender, date of birth, contact information, emergency contact.
- Clinical data: medical history, allergies, medications, risk factors, current health conditions, clinical assessments, working diagnoses (including TCM pattern differentiation), treatment plans and treatment provided (including acupuncture points used), response to treatment, follow-up recommendations.
- Appointment/visit dates and a daily appointment log.
- Billing records and receipts: patient name, date, service, fees, practitioner name/licence number.
- Consent records: informed consent captured before initial treatment, consistent with CCHPBC’s Professional Standard: Informed Consent, which explicitly permits electronic consent.
- Referring-practitioner information and inter-practitioner communications.
- Voice dictation audio: captured client-side, sent to Deepgram’s Nova-3 API for transcription, and not stored by MyTCM: no audio is written to any database or storage bucket. Deepgram’s stated behaviour is that audio is not retained after transcription. Only the resulting text becomes part of the patient record.
- Patient files: documents, photos and short videos (up to 25 MB each) that clinic staff attach to a patient record. Files are stored in Canada (Montreal, with a backup copy in Calgary), encrypted at rest, kept private and opened only through short-lived links. Every upload, view, download and deletion is logged.
- Messages to patients: phone numbers and text message content sent by SMS, and email addresses and email content, for appointment confirmations and reminders. MyTCM also keeps a log of SMS consent and a list of email opt-outs, and provides an unsubscribe page.
- Calendar sync: if a practitioner turns it on, appointment details are written to that practitioner’s Google or Apple calendar. The event title is the patient’s name, and the description can include the patient’s email address and phone number.
- Clinical note text for translation: free text only, with identifiers removed before it is sent (see Section 6).
5. Retention
CCHPBC’s Record-Keeping Standard sets the controlling retention period for BC licensees: patient health care records, appointment logs, billing records, and receipts must be retained for a minimum of 16 years from either the date of the last entry, or from the patient’s age of majority, whichever is later.
MyTCM keeps records for 16 years for every clinic. When a record is deleted, copies can remain in nightly backups for up to 6 months and in file storage history for 30 days.
Product implication: MyTCM does not silently delete patient records. Staff can delete a contact only if it has no clinical record or payment (for example a duplicate or mistaken entry). Records with history cannot be deleted inside the retention period.
6. Sub-processors and third parties
| Sub-processor | Role | Data touched | Where |
|---|---|---|---|
| Supabase | Database, auth, and edge functions (clinics’ own projects, and NTL’s own projects for marketing leads and the Command Center) | All clinical and patient data, in the clinic’s own project | Canada (ca-central-1) by default. Supabase is a US company |
| Cloudflare | Static hosting, CDN, DNS, and Workers AI as a fallback for translation | No patient data at rest. Clinical note text, with identifiers removed, when the translation fallback is used | Global network. US company |
| AWS S3 | Patient file storage | Files attached to patient records | Montreal, with a backup copy in Calgary. US company, Canadian regions |
| Square | Point-of-sale card payment processing | Card payment amounts and status; card numbers never touch MyTCM’s own systems | Square is PCI-DSS compliant as a payment processor in its own right |
| Deepgram | Voice-to-text transcription | Transient audio only; the provider states it does not retain it (see Section 4) | United States |
| DeepSeek | AI translation of clinical notes | Clinical note text, free text only, with identifiers removed | Location and terms are being verified |
| Twilio | SMS appointment confirmations and reminders | Patient phone numbers and message text | United States |
| Resend | Email confirmations, reminders, receipts and staff alerts | Recipient email addresses and email content | US company. Processing region is being confirmed |
| Calendar sync (practitioner’s own Google account) and encrypted nightly backup files in the clinic owner’s own Google Drive | Appointment details; an encrypted backup file | United States | |
| Cloudflare (Email Routing and Workers) | Receives the insurer emails a clinic forwards, reads fixed fields from them and passes those fields to the clinic’s database | Insurer notices about claims and treatment plans: initials, claim and reference numbers, amounts and approval decisions. The email is handled in memory and is not stored by NTL | Cloudflare’s global network, so Canada is not guaranteed. Cloudflare’s Data Processing Addendum gives no promise of Canadian data location. US company |
| Google (Gmail forwarding) | The clinic’s own Gmail holds the original insurer email and forwards matching emails to NTL’s address | The insurer email, as it was before forwarding | United States |
| Apple (iCloud Calendar) | Optional calendar sync for practitioners who use it | Appointment details | United States |
| GitHub | Runs the nightly backup job, which holds the database dump while it encrypts it before upload | A full copy of the clinic database, for the length of the job | United States |
Processing outside Canada. Several of the providers above are US companies or process information in the United States or on global networks. Information handled there may be subject to the laws of that country, and its courts, law enforcement and national security authorities may be able to obtain it. The clinic database and patient files are stored in Canada. Encrypted backups are kept in the clinic owner’s Google Drive, whose location is set by that Google account, and a temporary copy exists on GitHub’s US servers while the nightly backup runs. NTL is confirming each provider’s processing region and contract terms; where a region is not stated above, it has not yet been confirmed.
Insurer notices. Notices from your insurer about your claim or treatment plan (such as your initials, claim and reference numbers, amounts and approval decisions) may pass through Cloudflare and Google systems in the United States. The details we read from them are stored in this clinic’s database in Canada, and the original emails stay in the clinic’s email account. Insurer notices are read by fixed rules in our own program, not by AI.
AI translation. Before clinical note text is sent for translation, identifiers (full name, date of birth, health number and practitioner name) are removed. Only free text is sent, never attachments. Cloudflare Workers AI is used only when the doctor chooses the free backup option. What was sent is recorded in an audit log so the removal can be checked. Removing identifiers reduces risk but cannot guarantee that no identifying detail remains.
7. Risks identified and how they’re managed
- Onboarding credential handling. During setup, NTL creates or receives account credentials on a clinic’s behalf. NTL keeps service credentials for each clinic’s instance (see Section 3), and NTL recommends that clinics rotate any password NTL set up on their behalf.
- Sub-processor data residency. Every BC clinic’s database project defaults to a Canadian region at provisioning time.
- Access to live instances. NTL’s access to a clinic’s live instance is described in Section 3.
- Breach notification. NTL follows a written breach-response procedure (detection, containment, risk assessment, notification to the affected clinic and, where required, the Privacy Commissioner of Canada under PIPEDA; notice to the BC Commissioner is voluntary under PIPA) since NTL is the technical operator during an incident even though the clinic is the legal data controller.
- Multi-province expansion. This PIA is BC-specific and will be reassessed, not simply relabelled, before onboarding clinics in any other province, since provincial privacy statutes and health-college recordkeeping rules are not uniform across Canada.
Questions about this assessment
This PIA is reviewed and updated as the product and its regulatory environment evolve. Questions can be sent to support@mytcm.ca.
Privacy officer: Oscar Poon, support@mytcm.ca.