Privacy Policy

1. Overview 

This section of our Privacy Policy describes how we collect, receive, use, store, share, transfer, and process customer Data on behalf of our customers as part of our Services.  

We process and use Customer Data under the direction and control of our customers. We retain no ownership of, nor do we have control over the origination or validity of the Personal Data we process on behalf of our customers. We do not request, nor do we maintain, direct relationships with individuals whose Personal Data we maintain in Customer Databases we host and manage as part of our Services to our Customers. We do not directly request nor collect consents nor instructions to access, correct, update or delete personal information, which requests should be made directly to our Customers. We will honor and support any instructions they provide us with respect to Personal Data maintained in our databases.  

Our Customers are responsible for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to transferring the Personal Data to AppmaxCare Platform.

2. Protecting Personal Information and Health-related Information 

AppmaxCare is a provider of Cloud hosted, electronic health record (EHR) solutions to its Customers who are health care providers and subject to laws and regulations governing the use and disclosure of Protected Health information or PHI.  In Canada, provincial laws govern the handling of PHI as below.

In the United States, HIPAA and HITECH, along with the regulations adopted under those statutes, and similar state laws govern the handling of PHI in the United States. Health care providers are considered to be Covered Entities under HIPAA and are subject to its rules regarding PHI. By setting up Business Associate or a BAA, AppmaxCare applies the same rigorous standards and practices for safeguarding the confidentiality, integrity and accessibility of PHI in all jurisdictions.

3. Security, Threats and Breach Notification 

AppmaxCare’s software platform and the Services we deliver have stringent security measures in place to protect against the loss, misuse, unauthorized access and alteration of data and Personal Information under our direct control.  When the Services are accessed using current browser technology, Secure Socket Layer or SSL technology protects information using both server authentication and data encryption to help ensure that data is safe, secure, and available only to each specific Customer. AppmaxCare also implements an security methodology based on dynamic data and encoded session identifications and hosts the Service in a secure server environment which uses firewalls and other advanced technology to prevent interference or access from outside intruders. Unique usernames and passwords are also required and must be entered each time a customer logs into the Service.  We are committed to educating our staff about the protection of Personal Information, and the importance of compliance with relevant privacy legislation and company policies.  All employees and contractors are required to sign confidentiality and NDA agreements.  

These safeguards help prevent unauthorized access, maintain data accuracy, and ensure the appropriate use of Personal Information; In the event that we detect a threat to security or any security vulnerability, we may attempt to contact our Customers to recommend protective measures. Additionally, incidents of suspected or actual unauthorized handling of Personal Information are always directed to AppmaxCare’s Legal and Compliance team, which is responsible for determining escalation and response procedures, depending on the severity and nature of the incident. If AppmaxCare determines that Personal Information has been misappropriated or otherwise wrongly acquired, it will promptly issue a report to each affected Customer. 

Customers who subscribe to third parties who provide any AppmaxCare connected services may have different procedures in place to protect Personal Information than the standards AppmaxCare has implemented. AppmaxCare cannot be responsible for their policies or their compliance with them, regardless of whether we have integrated their solutions into our Services and/or made them available to you.

4. Retention and Deletion 

AppmaxCare will retain Personal Information: as necessary for the purposes outlined in this Policy; 

as required to manage and administer the Services;  

as required to carry out any legal responsibilities;  

to resolve a dispute (including enforcement of a contract); or, 

as expressly communicated to a Customer at the time of collection.  

For as long as a Customer’s account remains active, and then until all applicable retention periods have expired, we will retain all Personal Information in a manner designed to ensure that it cannot be reconstructed or read. Following such periods, if it is not feasible for us to delete or destroy such retained Personal Information, we will continue using the same safeguards of protection and security outlined in this Policy. 

5. Collection of and Permitted Uses of Personal Information 

AppmaxCare may collect Personal Information from its Customers or from its Customers’ end users directly via the use of its software platform or via other interfaces with authorized healthcare information providers, including but not limited to the following Personal Information: 

Patient demographic information, Patient medical history and records, reports and data created by employees of our Customers during healthcare interventions (procedures) with their clients (patients), time and attendance data (including geolocation) related to visits to patients at their premises. 

We may also collect system information to diagnose and debug software issues. Such information may be linked with Personal Information contained in a Customer account, so it may be regarded as Personal Information. 

AppmaxCare does not use nor disclose Personal Information for purposes other than those for which it was collected, except with its Customers’ consent or as required by law. 

AppmaxCare will use Personal Information as required to optimize the Services we provide to our Customers, to provide updates for the Services and to provide support and maintenance services. We may also use aggregated usage information for statistical purposes, e.g. showing the total traffic through one of our servers. We may also use usage information to evaluate and improve the features and functionality of our Services. 

6. Information Sharing and Disclosure.

IN NO CASE WILL AppmaxCare SELL OR RENT PERSONAL INFORMATION TO THIRD PARTIES. AppmaxCare will only share Personal Information to the following: 

Service providers that facilitate our Services, provide any or all part of the Services on our behalf or help us improve the Services (for example, data storage, web analytics, and maintenance service). These services providers have access to Personal Information only for purposes of performing these tasks on our behalf; and 

Law enforcement officials, governmental agencies, or other legal authorities (i) in response to their request; (ii) when permitted or required by law; (iii) to establish our compliance with applicable laws, rules, regulations, or guidelines; or (iv) or to establish, protect, or exercise our legal rights or defend against legal claims or demands. 

Any other person whom you authorize the disclosure to pursuant your usage of the Applications. We may also share with third parties certain aggregated non-personal information about our users. 

7. Data Residency 

Unless otherwise specified, AppmaxCare hosts each Customer’s database in the Customer’s country of residence. AppmaxCare may provide support Services from its headquarters in Canada, and in such cases AppmaxCare may access a Customer’s data from Canada for purposes of, for example: responding to support requests; fixing software issues; or, providing services to a Customer that can only be performed on the “back end” of our software platform (e.g., correcting errors in specified Customer Data, adding/removing a Customer’s data or performing testing). Further information on data residency is set out here.