Data Protection & Agent Agreement

Your clinic is the health-information custodian. Aster is your agent and service provider. We handle personal health information only on your instructions and only to provide the service — never for our own purposes.

In Ontario this agreement is the written arrangement contemplated by the Personal Health Information Protection Act for a custodian permitting an agent to handle personal health information on its behalf. In other provinces it serves the equivalent role under the applicable health privacy statute.

We may collect, use, and disclose personal health information only to:

• provide the service you have subscribed to;
• keep it secure and available;
• act on a support request you make; and
• comply with a legal requirement, having told you first unless we are barred from doing so.

We will not sell it, use it for advertising, use it to train machine learning models, or use it to build a product for anyone else.

Personal health information is stored and processed in Canada, in Canadian regions of our hosting and storage providers. It is not placed in analytics, error reports, edge caches or content delivery networks.

Reminder and notification messages are relayed by email and SMS providers with United States infrastructure. These carry appointment logistics — clinic name, date, time — and not clinical content. Where a clinic requires that no identifiers leave Canada at all, those channels can be disabled.

Each clinic's data is isolated from every other clinic's at the database level, enforced by the database itself rather than only by application code. Access within your clinic is limited by the roles you assign.

Data is encrypted in transit and at rest. Files are served by short-lived signed links rather than public URLs. Sessions expire, and multi-factor authentication is available to every staff account.

Changes to records are logged, and so are reads of clinical records. You can establish who viewed a given patient's chart and when — which is what lets you answer a privacy complaint or a college inquiry with evidence rather than assurance.

Audit records are retained for the life of your account and are exportable.

Aster staff do not access your clinic's data except where you ask us to for support, or where the law requires it. Before anyone at Aster is granted such access they must accept written confidentiality obligations that survive their engagement, and their access is logged the same way anyone's is.

We use the subprocessors listed in our privacy policy. We do not allow a subprocessor to handle personal health information until a written data processing agreement is in place requiring confidentiality and restricting its use of the data to providing its service to us. We will give you notice before adding a subprocessor that handles personal health information, and you may terminate without penalty if you object.

If personal health information in our care is lost, stolen, or accessed without authorisation, we will notify you without unreasonable delay, tell you what we know, and give you what you need to meet your own notification duties to affected individuals and to your privacy commissioner.

Deciding whether and how to notify patients is yours as custodian. We will not notify your patients on our own initiative.

If a patient asks you for access to their record, a correction, or a withdrawal of consent, the product gives you the tools to answer. Where you need more, we will help you within a reasonable time and at no charge. We will not respond to such a request directly — that is the custodian's decision to make.

You may export your complete account at any time, in open formats, at no charge and without asking us — during the subscription, after cancellation, and after a non-payment downgrade.

On written instruction we will delete your data within 90 days, except where we are required by law to retain it. We will confirm when it is done. Note that your provincial record-retention obligations may make deletion the wrong choice; that judgement is yours.

This agreement applies for as long as we hold personal health information for you, and the confidentiality, breach and deletion obligations survive the end of your subscription.

It forms part of our Terms of Service.