forMaD — Privacy Policy

Privacy at a glance

• What we collect. Information about the physicians and staff who use forMaD (account, profile, billing, usage), and health information that physicians enter to prepare forms, which we handle only on their behalf (sections 2 and 3).

• Clinical notes pass through our servers to our AI provider, Anthropic, which processes them only in the United States under a zero-data-retention arrangement. We do not store them, and they are never used to train AI (section 4).

• Patient Details are used only to fill your PDF on our servers in Canada, and never reach the AI provider. Our servers do not keep them unless you save a Draft containing them (section 4.3).

• What we keep: Drafts, for up to 45 days after they were last saved or finished; Quality Records, for up to 12 months and only if the physician authorizes it; and account and billing records (sections 4 and 7).

• Where it goes. Our servers and database are in Canada (Montréal). The AI provider, our email service and some payment processing are in the United States (section 6).

• Risks to know about. The identifier check can miss identifiers. Anything identifying left in clinical notes is processed by our AI provider in the United States, where U.S. authorities may be able to access it under U.S. law. Anything in a saved Draft is visible to every Delegate on the account. Physicians reduce these risks by removing identifiers before pasting notes.

• What we never do. Sell personal information, show ads, or use tracking cookies (sections 5 and 11).

• Your choices. Access, correction, withdrawal of consent and complaints: write to hello@formad.ca (sections 9 and 12). Patients should contact their physician (section 10).

Back to top

1. Who we are and what this policy covers

forMaD Health Inc. ("forMaD", "we", "us") makes software that helps physicians in Canada and their staff prepare medical, insurance, government and patient-support-program forms. This policy covers our website (formad.ca), our app (app.formad.health), our emails and our support. Capitalized terms not defined here have the meaning given in our Terms of Service.

Back to top

2. Our two roles

We handle information in two different capacities, and the rules differ.

When the information is about you as a user, such as your account, Profile, Delegates, plan, payments, usage and messages, forMaD is the organization responsible for it under Canadian privacy law. This policy explains how we handle it.

When the information is health information that a physician enters about a patient, the physician (or their practice or institution) is the custodian responsible for it, and we act only on the physician's behalf: as their agent, electronic service provider, information manager or service provider, depending on the province. We use that information only to provide the Service to that physician, as Schedule A of our Terms of Service sets out. The physician's own privacy practices also apply, and patients should direct requests to their physician (section 10).

The drafting step is designed for de-identified information: physicians are required to remove patient identifiers before entering clinical notes. Because no check is perfect, we protect everything that reaches us as if it were identifiable health information.

Back to top

3. What we collect

We collect two kinds of information: information about the physicians, Delegates and prospective users who deal with us, and health information that physicians enter to prepare their documents. We collect only what we need for the purposes in section 5.

3.1 About physicians, Delegates and prospective users

Scroll sideways to see every column →

3.2 Health information we handle for physicians

Scroll sideways to see every column →

Back to top

4. How AI drafting handles clinical information

Clinical notes pass through our servers to our AI provider and are not stored by us. Patient Details are used only to fill your PDF and never reach the AI provider.

Patient Details travel a separate path from clinical notes: they are added only after review, and only the PDF step receives them.

4.1 Drafting

• Identifier check. Before notes leave your browser, the Service checks the notes box (not other fields) for common identifier patterns, such as names after a title or label, health card and chart numbers, phone numbers, email and street addresses, and postal codes. It warns you and offers to remove what it finds, but it does not block you, and it can miss identifiers.

• AI provider. Your notes and form inputs then pass through our servers to Anthropic, our AI provider. For a single form they may be sent several times: to draft the form, to propose supporting literature (using the opening part of your notes), and to flag fields for your review. For some forms, the text of a single field is sent again to shorten it.

• Reference checks. Suggested references are checked against PubMed and Crossref using titles, author names and reference numbers, not your notes.

• No account details. We do not send your name, email address or account identifiers to Anthropic with these requests.

4.2 What we keep from drafting

We do not store the notes you paste. We do store:

• Drafts, only if you save one. A Draft is deleted 45 days after it was last saved or finished, and every Delegate on the account can see it.

• Quality Records, only if the physician authorizes them (section 4.4).

Both can contain passages of the draft that quote or summarize your notes, so we protect them as health information.

4.3 Patient Details and the final step

Patient Details are added after review. When you download the form, they are sent with it to our servers, written into the PDF in memory, and discarded once the PDF is returned to you. They are not sent to the AI provider, and our servers are designed not to store or log them. For visa letters, visitors' passport details are entered in the letter itself: they are never sent to the AI provider, are kept only in a Draft you save, and are not kept in Quality Records. Passport images are read on your device and never uploaded.

4.4 Quality Records and De-identified Data

Quality Records are optional. We keep them only if the physician authorizes it, and a physician may decline or withdraw that authorization at any time, by writing to hello@formad.ca, without affecting their use of the Service. They are not currently available for Saskatchewan accounts.

• What a Quality Record is. When you finish reviewing a form, we record the form, drug, specialty and province, the AI's first draft and your reviewed version, after dropping fields meant for personal details and removing text that matches identifier patterns. Records of letters keep no letter content.

• How we use it, on the physician's behalf. To check the accuracy and safety of drafts prepared for that physician and tell them about errors. Quality Records are health information: we keep them in Canada, only named staff who need them can see them, every access is logged, and we delete them after 12 months at most, or within 30 days after the account closes or authorization is withdrawn.

• De-identified Data. We use information for our own purposes, improving the Service and producing aggregate statistics, only after it has been de-identified by a documented method that removes direct identifiers and identifying free text, has been assessed by a qualified person as presenting a very low risk of re-identification, and is reassessed at least annually.

• Aggregate statistics. We may publish aggregate statistics, or share them with researchers, program sponsors, insurers or manufacturers, only at the national or provincial level. They contain no free text, are never broken down by physician or practice, and every figure reflects at least 10 forms from at least 5 physicians.

• What we never do. We never attempt to re-identify anyone, link this data with other data to identify anyone, or sell it, and we never use Quality Records or De-identified Data to train or fine-tune AI models.

Back to top

5. Why we use information, and your consent

Scroll sideways to see every column →

We do not use personal information for advertising, and we do not sell it or build marketing profiles from it.

Consent. When you enroll, we explain these purposes and ask you to confirm that you have read this policy. We ask separately for the physician's authorization to keep Quality Records and create De-identified Data (section 4.4). We will ask for your consent before using personal information for a new purpose, unless the law permits otherwise. You may withdraw consent at any time on reasonable notice, subject to legal or contractual restrictions, and we will explain the consequences. We handle health information only on the physician's behalf and on the physician's instructions. Where the physician authorizes it, we de-identify it on the physician's behalf, and only information that meets the standard in section 4.4 is then used for our own purposes, which are improving the Service and producing aggregate statistics.

Back to top

6. Who we share information with, and where it goes

We do not sell personal information or health information. We share it only with the service providers below, who act on our instructions under written agreements requiring them to protect it, and in the limited cases listed after the table.

Scroll sideways to see every column →

Other disclosures. We disclose personal information only: (a) with your consent or at your direction, for example to the Delegates you authorize; (b) where the law requires or permits, such as under a court order or to a regulator with authority to require it; (c) to our professional advisers, and to the few contractors who help us administer the Service, all under written duties of confidentiality; or (d) to a prospective buyer or successor in a merger, acquisition or financing, under an agreement to use it only for that transaction and to protect it; health information about patients is never disclosed to a prospective buyer or financing party before a transaction closes. Health Information is disclosed only as Schedule A of our Terms allows.

Outside Canada. Some of our providers store or process information in the United States, so it may be accessible to courts, law enforcement and national-security authorities there under U.S. law. Before we use a provider outside Canada, we assess the privacy risks and rely on written agreements that protect the information. You can ask us for more information about our providers' locations and safeguards (section 12).

Back to top

7. How long we keep information

We keep information only as long as we need it for the purposes in section 5 or as the law requires, then delete it or de-identify it. Deleted information can remain in encrypted backups until they are overwritten on our providers' normal cycle.

Scroll sideways to see every column →

Back to top

8. How we protect information, and what happens if something goes wrong

Safeguards. We use administrative, technical and physical safeguards suited to the sensitivity of health information, including:

• sign-in by single-use codes that expire after 10 minutes and lock after repeated wrong attempts; an optional second sign-in step with an authenticator app, required once Quality Records or online payments are turned on (existing accounts may postpone setting it up once, for 7 days; its secret is stored encrypted and its recovery codes in hashed form); codes and session tokens stored only in hashed form; session cookies that scripts cannot read and that travel only over encrypted connections;

• encryption in transit for all connections, and encryption at rest by our database provider;

• a database locked so that only our servers' credentials can read or write it, with every request checked against the account's permissions and any Delegate authorization;

• an identifier check on the notes box before clinical notes are sent for drafting, and automated removal of identifiers before Quality Records are kept;

• servers designed not to store or log clinical notes or Patient Details passing through them;

• an in-app administrative console limited to named forMaD staff and contractors bound by confidentiality, who see account, verification and usage information, feedback, form requests with their uploaded blank forms, and, for forMaD's fees, each invoice's amount, dates and status, but not Draft contents, Quality Records, or patient or payer details. At a Physician's request, staff can set up their account, correct their profile details (each correction is logged and the Physician is emailed), and reset their two-step sign-in after confirming who they are;

• technical access to our database, hosting and payment accounts limited to a small number of named staff for operations, with access to Drafts and Quality Records restricted and logged;

• confidentiality obligations and privacy training for everyone who works for us; and

• written agreements with service providers requiring them to protect information.

No system is perfectly secure. You also play a part: protect your email account and devices, and sign out of shared computers.

If there is a privacy breach. If information we handle for a physician is stolen, lost, or used or disclosed without authority, we will notify that physician within 72 hours of becoming aware of it and help them meet their own duty to notify patients and their regulator. If a breach of security safeguards involves information we are responsible for, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals where it creates a real risk of significant harm, notify other regulators where their law requires, and keep a record of every breach of security safeguards for at least 24 months.

Back to top

9. Your rights

If you are a physician, a Delegate or a prospective user, you can ask us to:

• tell you what personal information we hold about you, how we use it and who we have shared it with, and give you a copy;

• correct information that is inaccurate or incomplete;

• withdraw consent to a use that relies on consent, subject to legal or contractual restrictions (if consent is needed to provide the Service, withdrawing it may mean we cannot continue to serve you);

• give you, or a person you name, computerized personal information you provided in a structured, commonly used technological format; and

• explain how we handle information outside Canada.

We do not make decisions about you based only on automated processing. Account approval and Profile verification are done by people.

Write to our Privacy Officer (section 12). We will verify your identity before releasing information, reply within 30 days unless the law allows an extension (we will tell you if we need one), and explain any refusal and how to challenge it. Requests are free unless the law allows a reasonable fee for copying, and we will tell you the fee in advance.

Delegates' information is also visible to the Physician who authorized them, and Physicians' Profile details are visible to their Delegates.

Back to top

10. If you are a patient

Your physician decides what information is used to prepare your forms, and remains responsible for it. forMaD handles health information only on your physician's behalf and on their instructions.

• To see or correct your health information, or to complain about how it was used, contact your physician or clinic. They hold your record; forMaD does not keep completed forms.

• If you contact us, we will refer you to your physician and help them respond. We usually cannot find information about you ourselves, because we do not store patient names or other identifying details, and any Quality Records have identifying fields removed and are deleted within 12 months.

• If you paid a physician's invoice online, the payment was processed by Stripe for your physician. Questions about the charge go to your physician; Stripe's privacy policy covers the card details it collected.

You can also complain to the privacy regulator for your province (section 12).

Back to top

11. Cookies, browser storage and communications

We use no advertising, analytics or tracking cookies, pixels or session-recording tools, on our website or in the app.

Scroll sideways to see every column →

The app and our website serve their own fonts, so loading a page does not send your IP address to Google or another font provider. When you pay or set up payments, Stripe's own pages may set Stripe's cookies under Stripe's privacy policy.

On shared computers, sign out when you finish and clear the browser's stored data, because file references stay on the device.

Emails. We send service emails: sign-in codes; Delegate invitations, and account invitations when you ask us to set up your account, that identify forMaD and the inviting Physician; forMaD fee statements and payment notices; notices of corrections we made to your details at your request; requests to confirm a Delegate we prepared at your request; and confirmation when a closed account's data has been deleted. Stripe sends plan receipts and invoices. We do not send marketing emails. If we start, we will ask for your consent first, and every message will include a way to unsubscribe, as Canada's anti-spam law requires.

Back to top

12. Changes, contact and complaints

Changes to this policy. We will post any change here with a new effective date. If a change is material, for example a new purpose, a new category of service provider receiving health information, or a new country where information is stored, we will tell you by email or in the app at least 30 days before it takes effect, and ask for your consent again where the law requires.

Privacy Officer. Our Privacy Officer is accountable for our compliance with this policy and with privacy law.

• Alejandro Berlin, Founder

• hello@formad.ca, with "Attention: Privacy Officer" in the subject

• forMaD Health Inc., Toronto, Ontario (mailing address on request)

Our privacy governance. Our Privacy Officer approves our privacy policies and practices, including our retention schedule (section 7), our privacy impact assessments and our breach register.

How to complain to us. Write to hello@formad.ca and describe your concern. We will acknowledge it within 5 business days, investigate, and reply in writing within 30 days, explaining any measures taken and your right to complain to the regulator listed below.

Complaints. Please contact us first so we can try to resolve your concern. You may also complain to the regulator that oversees the information involved:

Scroll sideways to see every column →

Back to top