Can EHR · Toronto, Ontario, Canada
Privacy Policy
Effective 13 September 2026. Can EHR is a proudly Canadian, Ontario-based electronic health record at canehr.ca. This policy explains how we handle personal information under PIPEDA and, for health information in Ontario, PHIPA.
1. Who we are
We are a group of professionals in counselling, psychotherapy, psychology, couple therapy, and family therapy, working together with IT-oriented team members. With the help of that IT team we build Can EHR: specific, proudly Ontario-based software for mental health service providers in Ontario. We are based in Toronto. The clinician or clinic that opens an account is the health information custodian for their clients’ records. Can EHR is the service provider that hosts the software. More: canehr.ca/about.
2. Information we collect
- Account information: name, credentials, profession, clinic name, phone, address, city, province, postal code, email, and sign-in details (email/password or Google, Microsoft, or Apple if you connect them).
- Clinic records you enter: client charts, appointments, notes, medications, files, groups, invoices, and messages.
- Session tools: if you use dictation, recording, or telehealth scribing, we process audio and transcripts you create in order to generate notes. You control whether a note is visible to a client.
- Billing for Can EHR: subscription plan and payment status. Card payments are processed by Stripe. We do not store full card numbers.
- Technical data: browser type, language, and basic logs needed to keep the service running and secure.
3. How we use information
We use information to provide the EHR, isolate each clinic’s data, send booking and session join notices you request, process Can EHR subscriptions (CAD, Ontario HST where applicable), improve reliability, and meet Canadian law. We do not sell personal information. We do not use client health records for advertising.
4. Legal bases and health records
PIPEDA applies to our commercial operation of Can EHR. PHIPA applies to health information in Ontario that a custodian collects in the course of care. The clinic is responsible for consent, access requests, and retention of client records. Can EHR processes that information only to provide the software you asked for.
5. Sharing
We share information only with:
- Hosting and infrastructure needed to run canehr.ca (including our Canadian-facing web host);
- Stripe, for Can EHR plan payments;
- Google, Microsoft, or Apple, only if you choose those sign-in buttons;
- Video session infrastructure when you start an online session;
- Authorities when Canadian law requires it.
Other clinicians on Can EHR cannot see your clinic. Clients see only what you mark as visible to them (for example portal files or notes you set as client-visible).
6. Storage, security, and retention
We use access controls, isolated clinic storage, and encrypted transport (HTTPS). Session rooms are joined by link. You should use a strong password and keep join links private. We keep account and clinic data while the account is active and for a reasonable period afterward so you can export or as required by law. You may ask us to close an account.
7. Your choices
You may access and correct your account information, change language, disconnect a sign-in provider, and control note visibility and portal files. Ontario clients of a clinic generally make access requests to that clinic (the custodian), not to Can EHR.
8. Children
Can EHR is sold to licensed clinicians, not directly to children. A clinic that records a minor’s care is responsible for consent under PHIPA and professional rules.
9. Changes
We may update this policy. The effective date above will change. Continued use of Can EHR after an update means the new policy applies.
10. Contact
Privacy questions: use the contact options on canehr.ca and write “Privacy” in the subject. Can EHR, Toronto, Ontario, Canada.