Privacy is important to us. This Privacy Policy (this “Policy”) sets out how we address the privacy and security of information entrusted to us by our customers through their access to and use of the HealthConnex services (the “Services”), and of information entrusted to us by business partners, prospective customers and others who contact us through www.healthconnex.ai, including any subdomains (the “Site”). The Site may be used by the public as a source of general information about HealthConnex Incorporated. Our customers and business partners may also access the Services through the Site.
As privacy laws and practices evolve, we will amend this Policy from time to time. While we will endeavour to give reasonable notice of such changes, we reserve the right, where necessary, to make them without prior notice.
This Policy covers information submitted to us, or collected by us, through the Site and the Services. If you exchange information with a HealthConnex Incorporated customer or business partner by a means other than the Site or the Services, that activity is not covered by this Policy.
We treat as private any information that identifies an individual or that can be used, alone or in combination with other information, to identify an individual. This includes identifiers issued by a government authority, financial institution or insurer, contact details such as an email address, mailing address or telephone number, and information about an individual’s health, including insurance and billing information.
Different laws use different terms for this information, including personal information, personally identifiable information, sensitive personal information, protected health information and personal health information. In this Policy we refer to all of it as “Personal Information”. Where we need to refer only to information about an individual’s health, we refer to “personal health information”.
An individual’s business contact information and business title are generally exempt from privacy legislation.
We collect Personal Information in two ways: information you provide to us, and information collected automatically when you interact with the Site.
You provide Personal Information to us when you contact us, when you enter information into the Services, and when you instruct us to obtain information on your behalf from a system you use. Where you become a customer, the information needed to establish and administer your account is provided as part of that process. This may include name, email address, mailing address, telephone number and other contact and billing information.
When your computer, mobile device or tablet visits or interacts with the Site, your device transmits a request to us. That request includes information necessary to identify and route what your device has asked for. This is necessary for all websites and internet services.
We also use cookies. Cookies are files placed on a device by a web browser that tell us whether a visitor has used the Site before, and they often include an anonymous unique identifier. Information collected using cookies can include:
The date and time a request is transmitted through the Site
The model of the device making the request
The type and version of the operating software running on the device
The web browser making the request
IP address
Time zone
Search terms used
URLs visited
Information about some of the cookies installed on the device
Internet service provider
Previous activity on the Site
We use a web analytics service to understand how pages on the Site are used and to improve the Site and the Services. We do not use it to build profiles of identifiable individuals, and we do not combine the information it collects with Personal Information you have provided to us. You can control analytics cookies through the cookie preference centre on the Site.
We do not alter the Site’s data collection practices in response to a Do Not Track signal from your browser. Where you have prevented tracking from occurring, those practices will not apply.
HealthConnex Incorporated provides cloud-based software that supports infection prevention and control, hand hygiene and personal protective equipment auditing, and quality and compliance auditing for hospitals, long-term care homes and other healthcare providers.
We collect Personal Information primarily as necessary to communicate with you and to provide the Services. Some Personal Information, but not personal health information, may also be collected for marketing and sales purposes, for example where you complete a form to register for a webinar or download content, or where you visit a part of the Site on which we use cookies from a social media platform, in which case that platform’s privacy policy will also apply.
We may use Personal Information and non-personal information:
to register customer accounts
to contact customers about their use of the Services, their current and future needs, or events and offers that may be of interest to them
to contact a prospective customer
to provide, operate, maintain and administer the Services, including processing registrations and payments and diagnosing technical problems
to respond to questions and communications
to make service or administrative announcements to customers, including about unscheduled downtime, new features, or changes to the Services or their terms
to perform audits, measurements and analyses in order to maintain, support, enhance and protect the Services, including determining usage trends and measuring the effectiveness of content and features
to develop and improve the Services, using information that does not identify an individual
Cookies and similar technologies are used for the following purposes:
saving user preferences
preserving session settings and activities
providing limited auto-fill functionality for those who use the Services frequently
analyzing various features and content of the Services
We will never sell your Personal Information, or non-personal information that can be used to identify you.
We issue a session cookie to record encrypted authentication information for the duration of a session. The session cookie does not contain a username or password, and we do not store passwords in session cookies, persistent cookies or headers. This session cookie is necessary to sign in, so if it is rejected the Services cannot be used; optional cookies may be declined without affecting access. You can manage optional cookies through the cookie preference centre on the Site.
Personal Information collected through the Site may be used to respond to customer requests for support, to provide education or consulting services, and to confirm compliance with the terms of a customer’s purchase. This may include testing and applying new versions, patches and upgrades, monitoring and testing system performance, and resolving issues reported to us. Personal Information collected for these purposes is used only for as long as is relevant to those purposes.
From time to time we may ask customers to complete surveys or ratings about the Services or about their own practices and operations. Survey responses may be used and reported in aggregate, and may be shared in a form that does not identify you. Please do not include personal health information or other sensitive information in a survey response. We will tell you why we are collecting your responses and how they will be used.
We rely on your consent for the collection and use of Personal Information described in this Policy, except where we are permitted or required by law to proceed without it. Where you submit information to us directly, you consent to its use for the purpose for which it was submitted. Where information is collected automatically through the Site for purposes other than those necessary to operate it, including marketing, personalization and analytics, we collect it only with your consent, which you may give or withhold through the cookie preference centre on the Site and may change at any time.
On occasion we may request additional consent in connection with a use or disclosure not described in this Policy, or because the law requires it.
If you are a customer or business partner, we will not use your Personal Information in a manner not provided for in our written agreement with you, in an authorization you have given us, or in this Policy.
Our customers are healthcare providers and are subject to laws governing the use and disclosure of personal health information.
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act, 2004 (PHIPA) in Ontario, and the equivalent health information legislation of other provinces and territories govern the handling of personal health information.
In the United States, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), the regulations adopted under those statutes, and state laws that are more stringent than HIPAA govern the handling of protected health information.
Other laws may apply to particular customers, as set out in our agreements with them.
Under HIPAA, healthcare providers are covered entities. Where a covered entity delegates work to a third party that must access protected health information to perform it, that party is a business associate and is subject to the same rules regarding the protection of that information. HIPAA requires a covered entity to execute a Business Associate Agreement with each of its business associates. Our United States customers are required to sign a Business Associate Agreement with us. As a business associate, we are required to use reasonable and appropriate measures to safeguard the confidentiality, integrity and availability of protected health information that we hold on behalf of covered entities.
We use a major cloud infrastructure provider to host the Services. We select service providers with regard to their security and privacy practices, and any service provider that handles customer data on our behalf is bound by contractual confidentiality, security and data protection commitments. Where a service provider handles protected health information subject to HIPAA, the arrangement is governed by a Business Associate Agreement or equivalent terms.
The Site may contain links to third-party websites, software and services. Customers and visitors who follow such a link may be disclosing Personal Information. We are not responsible for, and cannot control, the privacy practices of third parties. A third party’s use, storage and sharing of your Personal Information is subject to its own privacy policy and not to this Policy.
There are two situations in which we may need to share your Personal Information with a third party as a result of a business reorganization. The first is the acquisition of HealthConnex Incorporated by a third party. The second is the acquisition of one of our customers. A reorganization involves a sale, merger, transfer, exchange or other disposition of all or part of a business. If such a transaction occurs, your Personal Information may be made available to the acquiring party.
Where the reorganization concerns one of our customers, we require the parties to the transaction to provide written evidence of its completion, or an alternative form of written authorization signed by both the buyer and the seller, before transferring Personal Information hosted in the Services from the seller to the buyer. A change in the management of a customer may involve similar requirements. We will not disclose your Personal Information to a party without sufficient and proper authorization, unless required by law.
We may need to preserve, use or disclose your Personal Information in response to a court order, subpoena, search warrant, judicial proceeding or other legal process, where we have a good faith belief that the law requires us to do so, or to otherwise protect our rights. Some legal procedures may prohibit us from notifying users or other persons identified in them, or may compel us to take measures that would otherwise be inconsistent with this Policy or with a written agreement you have with us.
Personal Information preserved as a result of legal procedures may be retained for as long as we have a good faith belief that retention is necessary and appropriate in the circumstances.
The Services are hosted with a major cloud infrastructure provider. We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption, logging and monitoring, and change management. Access to customer data is limited to what is necessary to provide the Services. Further detail about our safeguards is available to customers on request.
Connections to the Services are encrypted in transit using Transport Layer Security (TLS). Customer data is also encrypted at rest.
Each person is issued an individual account, and personal accounts are not shared. A small number of service and shared-function accounts exist for system and organizational purposes; these are not used by individuals to access customer data, and are subject to the same review as personal accounts.
Access to our systems is federated through our identity provider, and multi-factor authentication is enforced for our personnel. Multi-factor authentication is available to customers for their own users.
All personnel are bound by confidentiality obligations in respect of customer information, including personal health information, under their employment or contractor agreements and our Code of Conduct. We educate our personnel about the protection of Personal Information and the importance of compliance with privacy legislation and our policies.
These safeguards help prevent unauthorized access, maintain accuracy and support the appropriate use of Personal Information. No system can guarantee complete security at all times. Where we detect a threat or a security vulnerability that affects you, we may contact you to recommend protective measures.
Incidents of suspected or actual unauthorized handling of Personal Information are escalated immediately and handled under our incident response procedures. Each incident is assessed and classified, and the response is directed accordingly. A determination as to whether an incident constitutes a reportable breach is made separately from the handling of the incident itself.
Where we discover a use or disclosure of Personal Information that is not permitted by our agreement with a customer, or a security incident affecting a customer’s information, we will notify that customer in accordance with the applicable legislation and the terms of our agreement with them, including any Business Associate Agreement or equivalent agreement.
Where an individual asks us for access to, or correction of, personal health information, we will direct the request to the customer on whose behalf we hold it, as the customer is the appropriate party to respond. We act on a correction only on the customer’s written instruction.
Where information is corrected or removed at a customer’s instruction, we retain a record of the instruction and of the information as it stood beforehand, so that the change can be accounted for if it is later questioned. We will tell the customer where this applies. Unless the customer directs otherwise, we may transmit corrected information to third parties that received the earlier version.
We will provide an individual with access to personal health information we hold about them where the customer directs us to do so, unless providing access could reasonably be expected to interfere with the administration or enforcement of the law, or it is impracticable for us to retrieve the information.
Customers and their users may update or change their own Personal Information by editing the organization or user record within the Services.
Where the law of your jurisdiction provides you with additional rights in respect of your Personal Information, we will give effect to those rights. Requests should be made as set out under Contact Us, and where the information concerned is held on behalf of one of our customers, we will direct the request to that customer.
We retain Personal Information as necessary for the purposes set out in this Policy, for as long as a customer account remains active, as required to administer the Services, as required to carry out our legal responsibilities including legal holds, to resolve a dispute including the enforcement of a contract, or as communicated to you at the time of collection.
After all applicable retention periods have expired, we will delete or destroy Personal Information in a manner designed to ensure that it cannot be reconstructed or read. Where it is not feasible to delete or destroy it, we will continue to apply the safeguards described in this Policy for as long as it is retained.
Our personnel are located in Canada, and the Services are administered from Canada. Customer production data is hosted in the customer’s country of residence: Canadian customer data is hosted in Canada, and United States customer data is hosted in the United States. Customer data is not replicated between these environments.
Where a United States customer requires support, our personnel in Canada may access that customer’s data to the extent necessary to provide the Services, including responding to support requests and resolving software issues. Such access is limited to what is necessary and is subject to internal controls.
Where we provide the Services to a customer located outside Canada or the United States, we handle personal information on that customer’s behalf and on its instructions. The terms governing that handling, including the basis for any transfer of information across borders and any additional rights available to individuals under the law of the customer’s jurisdiction, are set out in our agreement with that customer.
We offer visitors to the Site and customers using the Services a means to choose how we use the information they provide. If at any time you change your mind about:
our use of Personal Information submitted to the Site;
our use of Personal Information submitted through the Services;
receiving notices from us, including automatic notifications about updates to the Services and how often we send them;
receiving marketing or sales communications from us; or
our sharing of non-personal information with third parties as described in this Policy,
please contact us as set out below, specifying your choice or change of preference.
Please note that certain restrictions you may ask us to apply would prevent us from providing or supporting the Services. Where that is the case, we will tell you before acting on the request and confirm with you how you wish to proceed. Similarly, if you unsubscribe from notifications about the Services, your experience in using them may be affected.
We may update this Policy from time to time to reflect changes to our practices, or for operational, regulatory or other legal reasons. The date of the most recent update appears at the end of this Policy.
Please do not include personal health information in a message to us.
We have designated a Privacy Officer who is accountable for our compliance with this Policy and with applicable privacy legislation. Enquiries, requests and complaints may be addressed to our Privacy Officer at privacy@healthconnex.ai, or by mail at the address below. We will identify the individual holding this role on request.
HealthConnex Incorporated
1100 Burloak Drive Unit 300
Burlington, Ontario
Canada
L7L 6B2
Last Updated: Oct 30, 2026
