How your data is handled
CleverConsult processes patient information on your behalf, and you stay in control of it. These are the five questions physicians ask, in the order they usually ask them.
Where is the data stored?
Patient data is stored in Canada. That covers the referral packages that arrive by fax or upload, the questionnaire answers your patients submit, and the notes CleverConsult builds from them.
Who can access it?
In your clinic, access belongs to you and to the people you authorise. Each set of credentials belongs to one person.
At CleverConsult, access is limited to the staff who need the information to do their work, and only to the part of it their work actually requires. Those staff are bound by confidentiality obligations and trained in the handling of personal information.
A small number of service providers handle specific pieces of the service, such as hosting, faxing and payments. CleverConsult stays liable for what any of them do with your information.
Is it used for training?
Patient documentation passes through third-party AI providers under a zero-retention policy. They hold it for as long as it takes to return the result CleverConsult has asked for, and their contracts confine them to that single purpose.
CleverConsult may anonymise your data, including health information, and use it to make functionality available to you and to develop and improve the product. Anonymised and aggregated data also feeds the refinement of its algorithms, and may be shared publicly or with partners in a form that keeps every individual unidentifiable.
CleverConsult commits to reasonable steps to keep anonymised information resistant to reverse engineering, re-identification, and linkage back to you or a patient.
Statistics about how you use the product are collected on the same basis.
How long is it kept?
You decide. CleverConsult holds your information until you give written direction to return or destroy it, or until your agreement ends.
At that point, or whenever you ask, CleverConsult will either return everything to you or securely destroy it to your instructions, and will give you a certificate of destruction if you want one. A single copy may be retained where law or an audit requires it, and that copy stays under the same confidentiality and security obligations for as long as it exists.
Everything else is held for as long as it takes to provide the service, and for as long afterwards as law and regulation require.
Notes you have already saved into your own EMR sit outside all of this. They are records in your custody, and how long you hold them is governed by your own professional and statutory obligations.
What is the legal arrangement?
You remain the health information custodian for your patients, and CleverConsult handles personal health information as your agent under PHIPA, on your instructions and for the purpose of providing the service.
Your agreement with CleverConsult is governed by the law of Ontario and the federal laws of Canada. You keep responsibility for your own compliance obligations, for any notice your patients are owed, and for obtaining the consents required. CleverConsult processes your information solely to provide the service, in line with those instructions and with privacy law, and helps you meet your own obligations.
Reporting a privacy concern
Privacy questions, requests and complaints go to privacy@cleverconsult.ai. Product support is separate, and runs through the Feedback button in the app.
If CleverConsult becomes aware of a security incident affecting your information, you are notified promptly and in writing with full particulars. CleverConsult takes commercially reasonable steps to contain, investigate and mitigate the incident, and gives you what you need to meet your own obligations.
Your local privacy authority is also open to you if you want to take a concern further.