How we govern personal information

Who is responsible

Bryan Pachal, our Privacy Officer, is the person in charge of the protection of personal information at Effect Wellness, Inc. He can be reached at privacy@effectwellness.com.

That role carries the final responsibility for everything on this page. It is not a shared duty and it is not a committee.

Who does what, day to day

We are a small company, and this page describes what we actually do rather than what a large one would.

• Everyone who works on the platform operates under least-privilege access: nobody holds access to production client data because of their job title. A small number of operational credentials can reach production data directly, for maintenance and recovery. Those are held by named individuals, kept to the fewest the work requires, and every use of them is recorded.
• Engineering builds the access rules into the database itself, so that a clinical record is reachable only by a practitioner in a care relationship with that client. This is enforced structurally rather than by a screen or a policy reminder.
• The person in charge reviews any change that would widen who can see personal information, decides classification questions, and owns the incident process below.
• Our providers — the companies whose infrastructure we run on — are engaged under contract and may use information only to provide their service to us. They are listed on our providers page.

No individual at our company reads a practice's clinical records in the ordinary course of business. Where support work would require it, it needs the practice's involvement, and the access is recorded as part of the action.

How long we keep information, and how we destroy it

Client clinical records belong to the practice, not to us. They are kept for as long as the professional and legal retention rules that apply to that practice require — often many years, and longer for records about minors. We do not delete them on request, because the practice may have a duty to keep them.

Practitioner account information is kept while the account is open, and afterwards only for as long as we need it for billing records, tax and accounting obligations, and resolving disputes.

Website measurement information is kept for no more than thirteen months.

Records of security incidents are kept for at least twenty-four months, including incidents we determine do not need to be reported.

When information reaches the end of its life, it is deleted from the systems that hold it, including backups as those backups age out on their own schedule.

That includes the two stores people most often ask about: telehealth session recordings and transcripts held by our telehealth provider, and files in our storage layer. Each follows its own automatic deletion schedule, and a deletion request is honoured against both.

How we handle a complaint

If you think we have mishandled personal information, we want to hear about it directly rather than have you go somewhere else first.

1. Write to privacy@effectwellness.com. Tell us what happened, in your own words. You do not need to cite a law or use any particular form.
2. We acknowledge it. You will get a reply confirming we have it and who is looking at it.
3. The person in charge reviews it. Complaints about the protection of personal information go to them, not to general support.
4. We tell you what we found and what we did about it — including when the answer is that we got it wrong.
5. If you are not satisfied, you can escalate. In Quebec, to the Commission d'accès à l'information. Elsewhere in Canada, to the Office of the Privacy Commissioner of Canada or your provincial commissioner. In the United States, to your state Attorney General. We will not treat you any differently for doing so.

We keep a record of every complaint and what came of it.

If there is a security incident

We maintain a documented process. If something goes wrong we investigate it, we assess whether it presents a risk of serious harm, and we notify the people affected and the relevant regulators when the law requires it.

We keep a record of every incident, including the ones we determine are not notifiable — that record is itself a legal requirement, and keeping it is not conditional on the answer coming out badly.

Assessing new work before we build it

Before we build or substantially change a system that handles personal information, we assess the privacy impact of doing so, and the person in charge is involved from the start rather than shown the result. The depth of that assessment is proportionate to how sensitive the information is and how much of it there is.

Changes to this page

We will post any change here and update the date at the top.