Security and sub-processors

Your clinic's database lives in Montreal, Canada, in accounts that belong to your clinic. MyTCM is designed to the ten principles of PIPEDA and BC PIPA. We do not hold a privacy certification and we do not claim one.

Who handles data for us

• Supabase

  Your clinic's database.

  Montreal, Canada (ca-central-1). Supabase is a US company.

• Amazon Web Services (S3)

  Patient files you attach.

  Montreal, with a backup copy in Calgary. Encrypted at rest. AWS is a US company.

• Cloudflare

  Hosting, Email Routing and Workers.

  A US company with a global network. Cloudflare does not promise Canadian data location.

• Deepgram

  Voice dictation.

  United States.

• Twilio

  Text message reminders and confirmations.

  United States.

• Google

  Calendar sync, Gmail forwarding and the encrypted nightly backup in your clinic's own Drive.

  United States.

• Resend

  Email reminders, receipts and staff alerts.

  A US company. We are confirming the processing region.

The full list, including payments, translation, calendar and backup providers, is in thePrivacy Impact Assessment.

What the vendors publish

Cloudflare publishes its own security certifications, such as SOC 2 Type II and ISO 27001, on itsTrust Hub, and itsData Processing Addendum. Those are Cloudflare's certifications, not MyTCM's.

How we protect data

• Data is encrypted in transit, and patient files are encrypted at rest.
• Each clinic has its own database. Clinics do not share one.
• Insurer notices are read by fixed rules in our own program, not by AI.
• NTL keeps the technical credentials it needs to run each clinic. They are stored encrypted, and administrative actions such as updates and repairs are recorded in an action log.
• The terms are in the Data Processing Agreement.

What a CIPP/C is, and why we mention it

CIPP/C stands for Certified Information Privacy Professional / Canada. It is a credential from the IAPP (International Association of Privacy Professionals), an independent professional body. The Canada version covers Canadian privacy law, including PIPEDA, BC PIPA and the other provincial privacy laws, and how organizations are expected to handle personal information in practice, including health information.

Oscar Poon, MyTCM's founder, is working toward this certification. He has not passed the exam yet, so MyTCM does not hold it and does not claim it.

What it means for your clinic. The person who designs and runs how MyTCM handles your patients' information is formally learning Canadian privacy law instead of guessing at it. It does not make MyTCM compliant, certified or approved by any regulator, and it is not a guarantee against breaches. Your clinic remains responsible under the law for its own patient consent and records.

Why it matters who handles the data. The law does not require a software company to hold this credential. It does require accountability: someone who answers for how personal information is handled, and a duty to report serious breaches. People who handle patient information without understanding those rules can cause real harm, such as records going to the wrong person, information kept longer than it should be, or a breach that is not reported in time. That harm lands on patients first and on your clinic second.

Holding the credential is not the same as being the only person with access. Anyone acting for NTL on your clinic's systems does so under the Data Processing Agreement, and administrative actions are recorded in an action log.

Questions: support@mytcm.ca.