Privacy Policy

1. Who we are and what we do

TeleMED Diagnostic Management Corp. (Ontario) and TDM Telehealth Technology Ltd. (Alberta) (together, “TeleMED”, “we”, “us”) provide diagnostic software that connects to medical testing devices, hosts diagnostic data for review and interpretation and delivers results and reports into electronic health record and related systems (the “Platform”).

TeleMED has designated a Privacy Officer who is responsible for our privacy program and for overseeing compliance with this Policy. All TeleMED personnel and contractors with access to personal information are required to follow our privacy and security policies and maintain the confidentiality of personal information.

2. Our role vs. your provider's role

Your health‑care providers (for example, physicians, clinics, hospitals and diagnostic centres) generally control the personal health information in the Platform and are responsible for it under the health privacy laws that apply to them. TeleMED acts as their service provider / information manager by hosting (where applicable) and operating the Platform and related services on their behalf.

This Policy describes how TeleMED handles personal information in operating the Platform and our business. For questions about your medical record, please contact your provider directly.

3. What information is handled

3.1 Information processed on behalf of providers

On behalf of providers, we process:

• Patient identifiers and demographics (for example name, contact details, date of birth, personal healthcare numbers, internal IDs).

• Diagnostic test data and reports, including:

  • Cardiology tests (for example ECG, Holter, stress tests and related data).

  • Other diagnostic tests supported by the Platform (for example, respirology, blood, and OB/GYN tests, where enabled).

  • Measurements, annotations, interpretations, diagnostic impressions and final reports.

• Clinical context entered by providers (for example, relevant history, medications, allergies, referring or reporting providers, care plans, and follow‑up).

• Operational and routing data (for example, dates and times of tests, device IDs, facility and provider identifiers, routing to EHRs and other clinical systems).

• Access, security and audit logs showing who accessed the Platform, when and what actions were taken.

3.2 Information we collect for our own purposes

For our own business purposes, we collect:

• Provider and clinic contact details and user account credentials.

• Support, training and other communications information.

• Technical and usage data about how our websites and Platform are accessed and used.

• Limited billing and payment information relating to our business customers (card data is typically handled by specialized processors).

• Recruitment information from job applicants.

4. How and why we use information

4.1 Basis and purposes for processing on behalf of providers

When we process personal health information for providers, we do so:

• As their service provider / information manager under health information and privacy laws that apply to them.

• Under our contracts with them and in accordance with their documented instructions.

We use personal health information on their behalf to:

• Host, operate and secure the Platform.

• Acquire, store, display, analyze and report diagnostic tests and related information.

• Route results and related data into EHRs and other systems that providers designate.

• Provide configuration, implementation, support and training.

• Maintain audit trails, logs and system performance.

Providers are responsible for having a lawful basis for collecting and using your personal health information (for example, your consent or other authority under applicable health information laws).

4.2 Basis and purposes for processing for our own use

When we handle personal information for our own purposes, we do so on one or more of the following bases, as permitted by applicable privacy laws:

• Your consent (for example when you sign up for an account, submit a support request or apply for a job).

• Performance of a contract (for example providing access to the Platform under an agreement with a clinic or medical lab).

• Compliance with legal and regulatory obligations (for example responding to authorities where required by law).

• Legitimate business interests (for example securing and improving the Platform, managing customer relationships and preventing misuse), balanced against your privacy rights.

We use this information to:

• Create and manage user accounts, authenticate users and provide support.

• Administer customer relationships, billing and service communications.

• Monitor, maintain, secure and improve the Platform, including through de‑identified and aggregated analytics.

• Meet legal, regulatory, security and risk‑management requirements.

We do not use personal health information for advertising, and we do not sell personal information.

5. How we share information

We share information only as needed to operate the Platform, support our customers and meet legal obligations, including:

• With providers and other health‑care organizations and systems they designate (for example EHRs, hospitals, referring or reporting physicians and diagnostic systems).

• With service providers who support hosting, security, communications, analytics, payment processing and other operations, under contracts that require appropriate safeguards and limit use to providing services to us.

• Within our corporate group where necessary for operations, security and compliance.

• As part of corporate transactions (for example, mergers or acquisitions) in line with legal requirements and appropriate protections.

• Where required or permitted by law (for example, in response to a court order or lawful request from a regulator or law enforcement authority).

We do not disclose personal health information to unaffiliated advertisers.

6. Data hosting, transfers and retention

The Platform for Canadian clinic customers is hosted in Canada and the Platform for Australian customers is hosted in Australia.

We use contractual and technical safeguards to help protect personal information when it is processed outside the jurisdiction where it was collected, as required by applicable law.

For information we process on behalf of providers, we retain personal health information in line with our agreements with them and their instructions, subject to technical backup and archival periods. For information we control, we retain it only as long as needed for the purposes described in this Policy and to satisfy legal and regulatory requirements, then securely delete, de‑identify or archive it.

7. Security

TeleMED maintains a privacy and security program that includes policies, procedures, training, access controls, monitoring, audit processes and vendor management designed to protect personal information.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, which may include:

• Unique user IDs, strong authentication (including multi‑factor where enabled) and role‑based access controls.

• Encryption of data in transit and at rest in our production environment.

• Network and application security controls, logging, monitoring and regular security testing.

• Secure development and change‑management practices.

• Vendor oversight and contractual security requirements for service providers.

• Policies, training and confidentiality obligations for staff with access to personal information.

No system is completely secure. Providers and users are responsible for protecting their own devices and login credentials and for using secure networks when accessing the Platform.

8. Accuracy

We use reasonable measures to help keep personal information accurate, complete and up‑to‑date for the purposes for which it is used. We rely on providers and users to inform us if their information changes or requires correction.

Questions regarding the accuracy of individual records of personal health information should be directed to the provider who collected the information.

9. Cookies and similar technologies

We use cookies and similar technologies on our websites and, in some cases, within the Platform to help operate and secure our services, remember preferences, and understand how our sites and services are used. Cookies are small text files that are placed on your device by a website. We may use: 

• Essential cookies that are necessary for the operation and security of our websites and the Platform (for example, to keep you logged in and manage sessions). 

• Functional or preference cookies to remember your settings or choices. 

• Limited analytics or performance tools to collect aggregated technical and usage information (for example pages visited, features used, and general device information) to help us improve our services. 

We do not use cookies or analytics tools to access or display personal health information, and we do not use personal health information for advertising. 

Some analytics or other service providers may set their own cookies when you visit our websites. Their use of cookies is governed by their own privacy policies. 

Most browsers allow you to block or delete cookies or to alert you when cookies are being sent. If you disable cookies, some features of our websites or the Platform may not function properly. You can usually find instructions for managing cookies in your browser’s “Help” or “Settings” menu or on the browser provider’s website.

10. Your rights and choices

If you are a patient and want to access, correct or obtain information about personal health information in your medical record, please contact your health‑care provider directly. We assist providers in responding to such requests where they relate to data in the Platform.

If you have an account with us or otherwise interact with us directly, you may request access to or correction of personal information we control about you by contacting us as set out below. We may need to verify your identity and may not always be able to fulfil a request where the law allows or requires us to refuse it; in that case we will explain why, subject to legal restrictions.

You can opt out of non‑essential marketing emails from us by using the unsubscribe link in the message or by contacting us. We may still send service, security or other non‑marketing notices.

Most browsers allow you to manage cookies and similar technologies; disabling them may affect functionality of our websites or Platform.

11. Australia‑specific information

For Australian clinic customers and patients, we handle personal information in accordance with this Policy and our contracts with Australian providers, and we take reasonable steps to ensure that personal information transferred from Australia to Canada or other countries is protected in line with applicable Australian privacy requirements.

Australian individuals whose personal information we control may exercise their privacy rights by contacting us as set out below.

12. Questions, complaints and contact

Individuals may raise questions or complaints about our handling of personal information by contacting our Privacy Officer using the contact details below. We will investigate all privacy concerns and complaints and respond in accordance with applicable privacy laws.

If you are not satisfied with our response, you may also have the right to contact the applicable privacy commissioner or regulator in your province, territory or country.

We may update this Privacy Policy from time to time. Material changes will be communicated through our usual customer channels and the effective date will be updated.

To ask a question, make a request or raise a concern about privacy, please contact:

TeleMED Diagnostic Management Corp. / TDM Telehealth Technology Ltd.
Attention: Privacy Officer
First Canadian Place
100 King Street West, #6200
Toronto, ON M5X 1B8
1-800-543-8151
privacy@telemeddm.com