Legal Hub

This Privacy Policy explains how Homeopathic Healing Inc., operating as Materia+ ("Materia+", "we", "us"), handles personal information on materiaplus.com and in the Materia+ services (the "Platform"). It applies to patients, caregivers, providers and visitors.

Materia+ does two things. It is a directory where people find and book natural and holistic health providers, and it is practice software those providers use to run their practice. Providers are independent professionals. They are not employees or agents of Materia+.

Your health records. Your provider is responsible for the records they keep about your care, such as their notes, care plans, check-ins, messages and documents about you ("clinical records"). Where your provider is a regulated health professional, they are the custodian or controller of those records under the health privacy law where they practise.

Materia+ hosts clinical records on your provider's behalf as their service provider. Depending on where your provider practises, that makes us an electronic service provider (Ontario), a business associate (United States, under HIPAA) or a processor (United Kingdom and European Union, under the UK GDPR and the EU GDPR). We don't read, change, sell or analyze clinical records, and we don't use them to train artificial intelligence. Our staff access them only when that is needed to keep the service running, for example to fix a technical fault, or when the law requires it.

Your account. Materia+ is responsible for your account information, the directory, our website and our own messages to you.

If you're a patient or caregiver:

• your name, email address and password
• your phone number, if you give it
• your year of birth (we don't ask for your full date of birth)
• your country and time zone, and your gender if you choose to share it
• your bookings and visit history
• the consents you give, such as consent to video visits
• if you add a dependent, their name and year of birth

If you're a provider:

• your name, practice name, practice address, phone number and email address
• the credentials, registrations and memberships you submit for review
• your profile, photos, services, prices and availability
• your plan and billing details (your card details are held by our payment processor, not by us)
• the agreements you sign with us

When you use the Platform: device and browser information, IP address and the pages you visit, so we can keep the Platform secure and working. Cookies are covered in our Cookie Policy.

When you agree to something: a record of what you agreed to, when, which version of the document, and the browser and IP address you used. This lets us show what was agreed.

When you contact us: what you send us and our replies.

What we don't collect: Materia+ doesn't collect completed intake forms or medical history questionnaires. If your provider asks you to fill one in, you send it to them directly, the way they tell you to, and their own privacy practices apply.

We use personal information to:

• create and secure your account
• show the directory and let you book visits
• send booking confirmations, receipts and security alerts, and reminders you can turn off in your account settings
• run video visits
• review provider credentials before a profile goes live
• bill providers for their plan
• answer your questions
• keep the Platform secure, prevent fraud and fix problems
• meet our legal obligations
• send our newsletter and publication, only if you opted in

We use clinical records only to show them to you and your provider.

For people in the United Kingdom and the European Union: we rely on our contract with you (to run your account and bookings), our legitimate interests (security and fixing problems), your consent (marketing and non-essential cookies) and our legal obligations. Your provider decides the legal basis for clinical records.

• Your provider sees your account details and your bookings with them. A provider sees only their own patients.
• Caregivers you approve see only what you allow.
• Companies that help us run Materia+ host the Platform and carry video visits (Amazon Web Services), deliver email, and process payments (Square and Stripe). They may use your information only to provide that service to us, under written agreements. See "Companies that help us" for the current list.
• Authorities, when the law requires it, for example under a court order. We disclose only what the order requires and, where we're allowed to, we tell the people affected.
• A new owner, if Materia+ is sold or merged. The new owner must keep protecting your information under this policy.

We never sell personal information, and we never share it with advertisers.

Payments for visits go from patient to provider. Each provider connects either Square or Stripe, and card payments are processed by that company and go to the provider's own Square or Stripe account. Providers pay their Materia+ plan through Square. Your card details go straight to Square or Stripe, and Materia+ never sees or stores your full card number. We keep a record of each payment (amount, date and the last four digits of the card) for receipts and accounting. Materia+ doesn't charge a booking fee and doesn't handle insurance claims. Square's or Stripe's own privacy policy applies to the information it handles.

We store and process Platform data with Amazon Web Services in its Canada (Central) region in Montreal, Quebec. Because the data stays in Canada, health information from Quebec stays in Quebec, and information from the rest of Canada stays in the country.

If you live outside Canada, your information is transferred to Canada. For people in the United Kingdom and the European Union, these transfers rely on the UK's and the European Commission's decisions that Canada provides adequate protection. United States providers sign a Business Associate Agreement with us.

Video visits also run on AWS in Montreal, using the Amazon Chime SDK.

One service works outside Canada: our email delivery service may process your name, email address and the content of our emails in other countries. Card payments are handled by Square or Stripe under their own privacy policies (section 6). When a company that helps us processes information outside Canada, we require protection equal to this policy.

• Account information: kept while your account is open, and deleted within 30 days after you close it, except what we must keep for the reasons below.
• Consent and agreement records: kept as long as we need them to show what was agreed.
• Billing records: kept as long as tax law requires, usually six years in Canada.
• Clinical records: your provider decides how long these are kept, under the record-keeping rules that apply to them. If a provider leaves Materia+, their records stay available read-only for 90 days so they can export them. We remind them before that period ends, and we don't delete records while a complaint or legal matter is open. Providers can also choose an archive plan to keep their records on Materia+ for their full retention period.
• Backups: deleted information can remain in our encrypted backups for up to 14 days before they are replaced.

You must be 18 or older to create an account. A parent or legal guardian can add a child or other dependent to their account and book care for them, if they have the legal authority to consent to that care. The adult manages the dependent's bookings and messages. If we learn that someone under 18 opened an account themselves, we close it.

Search results in the directory are ordered using information you choose, such as location, type of practice and available times. We don't use automated decision-making that has legal or similarly significant effects on you, and we don't build profiles of patients for advertising.

We use essential cookies to keep you signed in, keep the Platform secure and remember your booking choices. Analytics and marketing cookies stay off until you say yes, and you can change your choice at any time. We never use analytics or marketing trackers inside your account, on booking pages, during video visits or anywhere near clinical records. Our Cookie Policy has the details.

Video visits run on the Amazon Chime SDK, part of Amazon Web Services, with call media handled in AWS's Canada (Central) region in Montreal. Video and audio travel encrypted between you and your provider. Materia+ doesn't record visits and keeps no video or audio after a visit ends. We keep basic technical details about each call, such as start and end times and connection quality, to run the service and fix problems. A provider may not record a visit without your agreement, and must follow the law where both of you are.

• Encryption: data is encrypted when stored (AES-256) and when sent (HTTPS). The most sensitive details, such as notes, messages and phone numbers, are encrypted a second time inside our database.
• Access: staff access to our servers and administrative tools requires two-step sign-in, is limited to people who need it, is covered by confidentiality agreements, and is logged.
• Network: our database isn't reachable from the internet. Only our own application can connect to it.
• Backups: we take encrypted backups every day, keep them for 14 days, and regularly test that they can be restored.

No system is perfectly secure. Keep your password private, and tell us right away if you think someone has used your account.

If a security incident affects personal information, we follow our incident response plan to contain it and limit the harm.

• Clinical records: we notify the provider responsible without undue delay, and for United States providers no later than 30 days after we discover it, so they can meet their own duty to notify patients and regulators.
• Information we're responsible for: we notify you and the privacy regulator when the law requires it.

Depending on where you live, you can:

• see the personal information we hold about you and get a copy
• correct it
• ask us to delete it
• withdraw your consent, for example to marketing emails, at any time
• get your information in a portable format
• object to or ask us to limit some uses of it
• complain to a privacy regulator

How to ask: use your account settings, or write to our Privacy Officer. We'll confirm who you are, then respond within 30 days. If we need more time and the law allows it, we'll tell you why.

Requests about clinical records: because your provider controls your clinical records, we pass these requests to your provider. They decide what the law lets them release, change or delete, and we help them carry it out.

Complaints: please contact us first so we can try to fix it. You can also complain to the Office of the Privacy Commissioner of Canada, to your provincial privacy commissioner (for example, the Information and Privacy Commissioner of Ontario or Quebec's Commission d'accès à l'information), to the UK's Information Commissioner's Office, to Ireland's Data Protection Commission, or to the privacy regulator where you live.

The current version of this policy is always on this page, with its effective date. If we make a significant change, we tell account holders by email or on the Platform before it takes effect. To get a copy of the version you agreed to, ask our Privacy Officer.

Raoul Oppenheim, Privacy Officer
Homeopathic Healing Inc. (Materia+)
privacy@materiaplus.com
35A Fraser Rd, Nipissing, ON P0H 1W0, Canada