Privacy Policy

MyTCM is a product of NTL Learning Solution Inc. ("NTL", "we", "us"). This Privacy Policy explains how we collect, use, and protect information when you visit mytcm.ca (the "marketing site") and when your clinic uses the MyTCM application (the "Service").

1. Two kinds of data, two roles

Marketing site data. When you request a demo, start a free trial, or otherwise submit a form on mytcm.ca, we collect the information you provide, typically your name, clinic name, email, and phone number. For this data, NTL is the data controller.

Clinical and patient data. Once your clinic is set up on the Service, your clinic controls the patient, clinical, and payment information entered into it. For that data, your clinic is the data controller and NTL acts as a data processor / service provider, storing and processing it only as needed to provide the Service and on your clinic's instructions. Your clinic remains responsible for its own compliance with applicable health-information and privacy laws (including BC's Personal Information Protection Act and, where applicable, PIPEDA) for the patient data it collects and manages using the Service.

As part of onboarding, we provision your clinic's Service instance, including its hosting and database, under accounts that belong to your clinic, not to NTL. Your clinic's patient and clinical data lives in those accounts. To update and support the Service, NTL keeps technical credentials for each clinic's instance, which means NTL has the technical means to reach that data. NTL staff use AI assisted engineering tools with administrator access. Patient files, backups and messages are handled by the providers listed in section 4.

2. What we collect

• Contact details you submit through demo-request or free-trial forms.
• Clinical records, patient demographics, appointment and payment history, and consent records entered into the Service by your clinic's staff.
• Voice audio captured for dictation is transcribed in real time and is not stored after transcription; only the resulting text becomes part of the patient's chart.
• Files that clinic staff attach to a patient record (documents, photos and short videos), stored in Canada.
• Phone numbers, email addresses and message content used to send appointment confirmations and reminders by text and email, along with a record of text message consent and a list of email opt-outs.
• If a practitioner turns on calendar sync, appointment details are written to that practitioner's Google or Apple calendar. The event title is the patient's name, and the description can include the patient's email address and phone number.
• Basic technical data (IP address, browser type, pages visited) for the marketing site's operation and security.
• Where a clinic requests our Data Migration Service, the historical patient, appointment, and billing records it exports from a prior system (e.g. as a spreadsheet file) to transfer into the Service. We use these files only to perform the requested migration and delete them once it is complete; see the Data Processing Agreement for the terms that apply.

3. How we use it

We use marketing-site data to respond to your inquiry, follow up about a demo or trial, and improve the site. We process Service data solely to provide, secure, and support the Service for your clinic; we do not sell patient data, and we do not use it to train unrelated models or for advertising.

4. Where data is stored, and who else touches it

These providers handle data for the Service, each only as needed for its part:

• Supabase: the database, in a Canadian region (ca-central-1) by default.
• Cloudflare: hosting and content delivery, and Workers AI as a fallback for translation.
• AWS S3: patient files, stored in Montreal with a backup copy in Calgary.
• Square: card payments at the point of care, depending on your clinic's configuration.
• Deepgram (United States): voice dictation. MyTCM does not store the audio, and Deepgram states it does not retain it after transcription.
• DeepSeek and Cloudflare Workers AI: translation of clinical notes. Only free text is sent, and identifiers are removed first. Removing identifiers reduces risk but cannot guarantee that no identifying detail remains.
• Cloudflare (Email Routing and Workers) and Google (Gmail forwarding): insurer notices that a clinic forwards. Cloudflare's agreement gives no promise that this happens in Canada.
• Twilio (United States): text messages.
• Resend (a US company): email.
• Google (United States): calendar sync, and encrypted backup files in the clinic owner's own Google Drive.
• GitHub (United States): runs the nightly backup job.

Several of these providers are US companies or process information in the United States or on global networks. Information handled there may be subject to that country's laws, and its courts, law enforcement and national security authorities may be able to obtain it. We are confirming each provider's processing region and contract terms.

Notices from your insurer about your claim or treatment plan (such as your initials, claim and reference numbers, amounts and approval decisions) may pass through Cloudflare and Google systems in the United States. The details we read from them are stored in this clinic's database in Canada, and the original emails stay in the clinic's email account. Insurer notices are read by fixed rules in our own program, not by AI.

5. Security

We use industry-standard safeguards: encryption in transit, access controls, and row-level security scoping data to your clinic. But no system is perfectly secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

6. How long we keep it

Your clinic's patient records are kept for 16 years from the last clinical entry or the patient's age of majority, whichever is later. When a record is deleted, copies can remain in nightly backups for up to 6 months and in file storage history for 30 days.

If you contact us, request a trial or book a demo, we keep your name and contact details for 24 months after we last hear from you, then delete them. We do not send marketing email to someone who has not responded for 6 months unless they have opted in.

7. Your rights

If you're a website visitor or trial requester, you can ask us to access, correct, or delete the contact information we hold about you by emailing us. If you're a patient of a clinic using the Service, requests about your personal health information should go to that clinic directly, as they control that data; we will support the clinic in fulfilling such requests.

8. Cookies and website analytics

The marketing site uses minimal, functional cookies/local storage necessary for the site to work (for example, remembering your language preference). We do not use third-party advertising trackers.

Website analytics. With your consent, we use Google Analytics to count visits, see which pages and buttons visitors use, and learn which sources bring visitors. Google receives your device and browser details, your approximate location from your IP address, the pages you view and the buttons you click, and sets a cookie that identifies your browser without naming you. Google processes this information in the United States and other countries. We do not send Google your name, email address, phone number or anything you type into our forms, and we turned off Google's advertising features. Analytics loads only after you press Accept on the notice, and you can change your choice at any time with the button below. Without your consent, we use only Cloudflare's website statistics, which do not use cookies.Change analytics choice

If you start a purchase and a limited-time annual-billing offer is shown, we record when that offer was first shown to your email address so its deadline stays accurate even if you refresh the page, switch browsers or devices, or clear your browser's local storage. This uses your email address and a timestamp only, solely to enforce that offer's stated terms.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact us

Questions about this policy or your data can be sent to support@mytcm.ca.

Our privacy officer is Oscar Poon, reachable at support@mytcm.ca.