My Health Leaf: Privacy Policy

Not legal advice; prepared for counsel review. Draft, not in force. Last updated: [TO CONFIRM publish date]

1. Who we are

My Health Leaf (myhealthleaf.com) is operated by 1001726270 Ontario Inc., an Ontario corporation ("we", "us"). Mailing address: [TO CONFIRM: address or P.O. box, Boss decision]. Privacy Officer: Privacy Officer, 1001726270 Ontario Inc., hello@myhealthleaf.com [TO CONFIRM: a dedicated privacy@ inbox, verified as receiving].

2. What this policy covers

This policy covers our website and our early-access list. Today the site is a preview. It has no accounts, no forms, and only sample data, and it does not accept health records. Please do not send us health information. If you do, we will delete it and won't use it. Before My Health Leaf accepts any health records, we will publish an updated policy (see section 11) and complete the privacy reviews and agreements Ontario law requires.

3. Information we collect

Email you send us, including to join the early list: your email address, your name if you give it, and your message.
Technical logs that our hosting provider (listed in section 5) keeps when you visit: IP address, browser and device type, the page requested, the referring page, and the time.
We use no cookies, analytics, or advertising trackers [TO CONFIRM at publish with a live browser check]. If that changes, we will update this policy first.

4. Why we use it, and consent

We use your email only to reply to you and, if you joined the early list, to tell you about My Health Leaf's launch. By emailing us, you consent to this use. You can withdraw consent at any time by writing to us, and every email we send has an unsubscribe link (Canada's Anti-Spam Legislation). We don't sell personal information or use it for advertising.

5. Who we share it with

Service providers that help us run the site and email, under contract: | Provider | Role | Location | |---|---|---| | Resend [TO CONFIRM] | receiving and sending email | United States | | [TO CONFIRM host, e.g. Vercel] | website hosting and logs | United States | | [TO CONFIRM mailbox provider] | reading and replying to email | [TO CONFIRM] | We may also disclose information where the law requires it.

6. Storage outside Canada

Some providers store or process information in the United States. While it is there, it is subject to US law and may be accessed by courts, law enforcement and national-security authorities there. You can ask our Privacy Officer about our providers.

7. How long we keep it

Early-list emails: until [TO CONFIRM: e.g. 12 months after launch], or sooner if you ask us to delete them.
Other emails: up to [TO CONFIRM: e.g. 24 months] after our last exchange.
Hosting logs: as kept by our host, [TO CONFIRM: e.g. up to 30 days].
When a period ends, or when you ask, we delete the information from our mailbox and lists.
Unsubscribe and consent records: as long as needed to honour them.

8. How we protect it

We use HTTPS encryption, limit access to the people who need it, and use multi-factor authentication on accounts that hold your information [TO CONFIRM]. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

9. Your rights

You can ask to see the personal information we hold about you, ask how we used it, ask us to correct it or delete it, or withdraw consent. Write to the Privacy Officer (section 1). We answer within 30 days. If we need longer, we'll tell you why, as the law allows. We may ask you to confirm your identity.

10. Children

This site isn't directed at children under 16. We don't knowingly collect their information. If you believe a child has sent us information, contact us and we will delete it. [TO CONFIRM age with counsel]

11. Before we handle health records

My Health Leaf will not accept personal health information, record uploads or clinic integrations until: our role under Ontario's Personal Health Information Protection Act, 2004 (PHIPA) has been confirmed; written agreements are in place with the health information custodians (clinics or practitioners) we serve; a privacy impact and threat-risk assessment is complete; and a breach plan and access audit log are in place. When that happens, this policy will be replaced with a version that explains, among other things: - that your clinic (the health information custodian) controls your records, and that we handle them only on its behalf to provide the service; - where records are stored [TO CONFIRM: Canada]; - how access to your records is logged; - that you can request access to or correction of your records through your clinic; - that if your records are lost, stolen, or used or disclosed without authority, your clinic will notify you, and you can complain to the Information and Privacy Commissioner of Ontario.

12. Questions and complaints

Contact our Privacy Officer first (section 1). You can also go straight to the regulator at any time. If we don't resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca/en/report-a-concern/ · 1-800-282-1376 [TO CONFIRM number at publish]. For health records once that service exists: the Information and Privacy Commissioner of Ontario, https://www.ipc.on.ca/ · 1-800-387-0073 [TO CONFIRM].

13. Changes

We will post any change here with a new "Last updated" date. If a change materially affects information we already hold, we'll tell you and ask for consent where the law requires.