Canadian Privacy & Electronic Service Provider Addendum
The short version
- For providers practising in Canada. You sign it in setup step 4, Agreements.
- You control your clinical records. Where you're a regulated health professional, you're their custodian.
- Materia+ is your electronic service provider. It hosts your records and has no right to use them for anything else.
- Your patients' health information stays in Canada, in AWS's Montreal region. Quebec data stays in Quebec.
- We tell you about any breach at the first reasonable opportunity.
- When you leave, you can export everything for 90 days, and then it's deleted.
1.Parties and roles
You control the records. Materia+ is your electronic service provider.
This addendum is between you (the "Provider") and Homeopathic Healing Inc., operating as Materia+ ("Materia+"). It forms part of the Provider Terms and applies automatically to Providers who choose Canada at registration.
The Provider controls their clinical records and remains the organization responsible for them. Where the Provider is a regulated health professional, they are the health information custodian or trustee of those records under the health privacy law of their province (for example, Ontario's Personal Health Information Protection Act, 2004 (PHIPA) or Alberta's Health Information Act (HIA)).
Materia+ acts only as the Provider's electronic service provider and processor under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial laws that apply, including PHIPA, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the HIA and British Columbia's Personal Information Protection Act (PIPA).
2.Our role is technical only
We provide the technology. We have no right to use your records.
Materia+ is a technology service provider to the Provider. It has no independent right to view, access, change or use the Provider's records, except as needed for the technical operation of the software, to support the Provider when asked, or as the law requires.
3.No commercial use
No analytics, marketing, profiling or AI training.
Materia+ doesn't view, change or use the Provider's clinical notes, formulation logs or client records for analytics, marketing, profiling, artificial intelligence training or any other commercial purpose, and never sells them.
4.Data stays in Canada
Stored in Montreal. Quebec information stays in Quebec.
Personal health information under this addendum is stored and processed in Canada, on Amazon Web Services infrastructure in its Canada (Central) region in Montreal, Quebec (ca-central-1). For Providers in Quebec, this means the information stays in Quebec, so it doesn't need the privacy impact assessment Law 25 requires before personal information is communicated outside the province.
Video visits also run on AWS in Montreal, using the Amazon Chime SDK. Our email service may process limited information, such as names and email addresses, outside Canada, as the Privacy Policy describes. We list them on "Companies that help us" and require each to protect information at least as well as this addendum does.
5.Safeguards
Administrative, physical and technical safeguards.
Materia+ keeps reasonable administrative, physical and technical safeguards, including:
- two-step sign-in for all staff access to servers and administrative tools, limited to people who need it and logged
- encryption in transit (TLS) and at rest (AES-256), with an additional layer for the most sensitive fields
- a database that isn't reachable from the internet
- daily encrypted backups, kept for 14 days and tested for restore
- a written incident response plan
Materia+ makes sure its employees and any company that helps it with personal health information agree to protect it, and keeps a record of staff access to it.
6.Breaches
We tell you at the first reasonable opportunity.
Materia+ notifies the Provider, at their account email and at the first reasonable opportunity, if personal health information is stolen or lost, or is accessed, used or disclosed without authority. The notice includes the information Materia+ has, so the Provider can meet their own duty to notify patients and their privacy commissioner. Materia+ cooperates with the Provider's response.
7.Patients' requests
Requests about records go to you.
If a patient asks Materia+ to see, correct, export or delete their clinical records, Materia+ passes the request to the Provider and helps them carry out their decision.
8.Ending the addendum
Export for 90 days, then deletion.
This addendum lasts as long as Materia+ holds personal health information for the Provider. When the Provider's plan ends, Provider Terms section 15 applies: records stay available read-only for 90 days so the Provider can export them (or longer on the archive plan). After that, Materia+ securely deletes them, and copies in backups are replaced within 14 days. Keeping records for as long as the law and their college require is the Provider's responsibility.
9.How you sign this addendum
In setup step 4, Agreements, with your typed legal name.
Canadian providers sign this addendum in setup step 4 (Agreements) by ticking this box and typing their full legal name:
"By checking this box, I execute the Materia+ Canadian Privacy & Electronic Service Provider Addendum and appoint Materia+ as my electronic service provider. Materia+ agrees to meet its obligations as an electronic service provider, maintain administrative, physical and technical safeguards, and store and process all personal health information in Canada, in AWS's Montreal region (ca-central-1), in line with PIPEDA and the provincial privacy laws that apply (including Quebec's Law 25, PHIPA, PIPA and HIA)."
We record your name, the practice you're signing for, the version of this addendum, the date and time (UTC), and your browser and IP address.