Privacy Policy

Privacy Policy

Last updated: July 2026

1. Introduction

WhichEMR ("we," "our," or "us") is committed to protecting the privacy and confidentiality of personal and health information. As an EMR consulting firm serving Canadian healthcare providers, we adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including PHIPA (Ontario) and similar health privacy laws across Canada.

2. Information We Collect

We collect only the information necessary to provide EMR consulting services. This may include:

• Practice contact details (name, email, phone, clinic address)
• Professional credentials and licensing information
• Current EMR system details and usage requirements
• Practice workflow and operational needs assessment data
• De-identified, aggregated data for benchmarking and recommendations

We do NOT collect, store, or access Patient Health Information (PHI) or Personal Health Information (PHI) at any time. Our consulting engagements are system-level, not patient-level.

3. How We Use Your Information

We use collected information solely for the following EMR-related purposes:

• To assess your practice's EMR needs and recommend suitable solutions
• To facilitate EMR vendor selection and procurement processes
• To plan and support EMR implementation and data migration
• To provide ongoing workflow optimization consulting
• To communicate with you regarding your consulting engagement
• To comply with legal and regulatory obligations under Canadian healthcare privacy laws

4. Privacy by Design in EMR Consulting

Our consulting methodology incorporates privacy-by-design principles:

• De-identification: Any practice data used for benchmarking is de-identified and aggregated
• Minimal data collection: We collect only what is directly needed for your engagement
• Secure handling: All practice information is encrypted in transit and at rest
• Limited retention: Data is retained only for the duration of your engagement unless otherwise agreed

5. Data Protection & Security

We implement robust security measures aligned with Canadian healthcare data protection standards:

• End-to-end encryption for all communications and data transfers
• Multi-factor authentication for all internal systems
• Regular security audits and vulnerability assessments
• Strict access controls — only authorized consulting staff have access to your information
• Secure data disposal upon completion of engagement

6. Disclosure of Information

We do not sell, trade, or rent your personal or practice information. We may disclose information only:

• With your explicit consent
• To EMR vendors with your authorization (as part of the selection process)
• As required by law or regulatory authority (e.g., privacy commissioner)
• To professional advisors bound by confidentiality obligations

7. Your Rights Under Canadian Privacy Law

Under PIPEDA and applicable provincial health privacy laws, you have the right to:

• Access your personal and practice information held by us
• Correct any inaccuracies in your information
• Withdraw consent for data collection (subject to contractual obligations)
• Request deletion of your information after engagement completion
• File a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner

8. EMR Vendor Data Handling

As part of our consulting services, we may facilitate introductions between your practice and EMR vendors. Each vendor's data handling practices are governed by their own privacy policies and agreements. We recommend reviewing vendor privacy policies and ensuring they comply with applicable provincial health privacy requirements before engagement.

9. Cookies & Website Analytics

Our website uses minimal cookies for essential functionality and basic analytics. We do not use tracking cookies or collect browsing behavior data. You may disable cookies in your browser settings, though some site features may be affected.

10. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact our Privacy Officer:

WhichEMR Privacy Office
Email: privacy@whichemr.com
Phone: +1 (877) 123-EMR1 (3671)
Address: Toronto, ON, Canada

You may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or your provincial privacy commissioner.