How We Handle Clinic Information

Your clinic stays in control

Your clinic keeps control of its records and its accounts, including Jane. We handle patient information only as needed for the services you have chosen, on your documented instructions, or where the law requires it. We never hold your records back over a payment dispute.

Access only after approval

No one at AdminFlow accesses patient information until the required agreements are signed, your clinic has approved each person and their permissions, and the agreed safeguards are in place. You can narrow or revoke our access at any time.

How access is protected

• Individual accounts for each team member, with only the access their work needs
• Multi-factor authentication wherever your systems support it
• Written confidentiality commitments and privacy training before anyone is given access
• Encryption for information we store or send
• No patient information in personal email, messaging, screenshots or personal devices

Approved providers and locations

We use only the systems, providers and locations listed in your agreement. Before adding a provider or changing where information is handled, we tell you what is changing and get your written approval.

AI and your patients' information

We use AI to help our team work faster, for example to sort incoming patient messages by request type and urgency, flag messages that may need a clinician's attention, and prepare draft replies that our staff review before anything is sent. AI supports our team. It does not make clinical decisions or contact patients on its own.

Any AI model provider we use must meet these conditions:

• Zero data retention. The provider does not store what we send or the responses it returns once a request is complete, except as required by law.
• No training. The provider may not use your clinic's information to train or improve its models.
• Identifiers removed first. We remove names, contact details and other direct identifiers before anything is sent, wherever the task allows.
• Results only. We keep only the results we need, such as a message's request type and urgency.

If a provider cannot meet these conditions, we do not use it.

If something goes wrong

If we become aware of a privacy or security incident affecting your clinic's information, we will tell you without undue delay and no later than 24 hours after we become aware of it. We will contain it, investigate and work with you on any notices the law requires.

When services end

We return or make available any working copies we hold within 10 business days, then delete them within 30 days after you confirm you have received them. Records in your own systems stay there, under your control.

Questions

Contact our Privacy Officer at privacy@adminflow.ca. To report a security concern, see Security.