ProcareMD Privacy Policy

Effective date: October 11, 2026

1. Our commitment to your privacy

ProcareMD protects the privacy of everyone who uses our online form. We follow Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Where the two laws differ, we follow the stricter rule. This statement explains what we collect, why, who receives it, how we protect it, and your rights.

ProcareMD is a third-party medical marketing company. We are not a medical clinic and do not provide health care. We help patients enrol (roster) with our featured physician by securely passing their information to the physician’s clinic.

The featured physician and their clinic are the “health information custodians” under PHIPA for your medical record. ProcareMD collects your information on their behalf as their agent, and their staff and service providers must follow PHIPA and this policy.

This policy covers the New Patient Enrolment form on procaremd.ca. It covers only what ProcareMD does. Once your information reaches the clinic, the clinic’s own privacy policy applies. The website has one job: to securely send your information to our featured physician’s clinic for patient enrolment (rostering). It keeps your submission for no more than 30 days, then deletes it permanently.

2. Our Privacy Officer

Our Privacy Officer is the contact person for all privacy questions, access and correction requests, and complaints. The Privacy Officer makes sure our staff are trained on PHIPA and that this policy is followed.

Contact	Details
Name	Zeeshan Chattha
Phone	+1 (226) 774-0110
Email	[email protected]
Mail	358 Oxford St E, London, ON N6A 1V7, Attention: Privacy Officer

Please do not send health details by regular email. Call us or write to us by mail.

3. What information we collect

We collect only what we need to process your request to enrol as a new patient. All of it comes from you, or from a parent, guardian or substitute decision-maker.

Form section	What we collect
New Patient Enrolment form: your details section	Name, date of birth, sex, Ontario health number and version code, home and mailing address, phone, email, preferred contact method, emergency contact, previous family doctor and pharmacy
New Patient Enrolment form: health history section	Current medications, allergies, medical conditions, past surgeries and hospital stays, family medical history, alcohol, tobacco and substance use, and other lifestyle information you choose to share
New Patient Enrolment form: Children and dependants section	The same information, provided by a parent, guardian or substitute decision-maker

You do not have to answer every health history question online. You can leave a question blank and discuss it with your physician in person. Your answers to the health questions are not used to decide whether you are accepted as a patient. They help the physician prepare for your care.

4. Why we collect and use it

We use your online submission for one purpose only: to enrol (roster) you as a patient of our featured physician. We do not sell it, use it for marketing, or send it anywhere except that physician’s clinic.

To connect you with the clinic. We transfer your information to the featured physician’s clinic so their staff can contact you about rostering with that physician. The clinic may ask you to complete a further preliminary health information form before a meet-and-greet appointment.
To create your chart. Clinic staff transfer your information into the clinic’s secure electronic medical record (EMR). Staff then permanently delete the online copy (see section 9).
To complete Ministry enrolment. If you are accepted, you sign the Ministry of Health’s Patient Enrolment and Consent to Release Personal Health Information form at the clinic. Your physician and the Ministry then exchange your name, address, phone and enrolment details. The Ministry may also share dates of immunizations, preventive screening and primary care visits outside that physician’s practice.
To contact you about your registration, using the method you choose.

Once your information is in your chart, the clinic uses it to provide your care and bill OHIP, under the clinic’s own privacy policy, not this one. Sections 5, 6 and 9 summarize what typically happens at the clinic, for your information.

We collect your information only with your express, opt-in consent, which meets both PHIPA and PIPEDA. You can refuse or withdraw it at any time.

Express opt-in consent. The form has an unticked consent box that you must check before submitting. It confirms what we collect, that we send it only to the featured physician’s clinic for enrolment (rostering), that we delete it within 30 days, and that we never use it for marketing.
No new uses without asking. We will not use or share your information for any other purpose unless you agree first or the law requires it.
Withdrawing consent. Before your information reaches the clinic, contact our Privacy Officer and we will delete it. After transfer, contact the clinic; under PHIPA you may ask it not to use or share all or part of your record (a “lockbox”). Withdrawal is not retroactive, and without your information we cannot arrange your enrolment.
At the clinic. ProcareMD is not part of your care team. Once you become a patient, the clinic may rely on implied consent to share what is needed with others treating you, such as specialists, labs and your pharmacy. It needs your express consent to share with anyone outside your care team, such as an insurer or employer.
Someone acting for you. A parent, guardian or other legally authorized person may submit a form and consent for a patient who cannot. Under PHIPA, consent depends on a person’s capacity, not their age: a capable person of any age may consent for themselves. For a child under 16, a parent or guardian may also consent, with some exceptions under PHIPA.

Your online submission goes only to our featured physician’s clinic. Our cloud hosting provider stores it, encrypted, on our behalf and cannot use it for its own purposes. Once it is part of your chart, the clinic, not ProcareMD, decides how it is shared, under the clinic’s own privacy policy. For your information, a clinic typically shares the minimum needed, and only with your consent or where the law allows or requires it:

Who	Why	Consent
Specialists, hospitals, labs, imaging, pharmacies, home care	To provide or support your care	Implied (circle of care)
Ontario Ministry of Health (OHIP)	Billing, enrolment (rostering), audits	Required by law; enrolment by your signed form
Provincial health systems run by Ontario Health	Lab results, hospital reports and digital health records used by your providers	Permitted by PHIPA
The clinic’s service providers (EMR vendor, IT support)	To operate the clinic’s systems; they act only on the clinic’s instructions under written agreements	Permitted as the clinic’s agents or electronic service providers
Insurers, employers, lawyers, schools, family members	Forms, notes or reports you request	Express consent
Public health, Children’s Aid Society, Ministry of Transportation, police, coroner, CPSO, courts	Mandatory reports, such as reportable diseases, a child in need of protection, medical fitness to drive, or a court order or subpoena	Required by law
Anyone, in an emergency	To reduce a significant risk of serious bodily harm	Permitted by PHIPA

ProcareMD never sells or rents your information. If ProcareMD stops operating or is sold, any submissions it still holds will be deleted on the normal 30-day schedule, not transferred.

Our cloud provider, Amazon Web Services, is a US-based company. Your submission is stored only in its Canadian data centres, but because the provider operates in the US, it could be subject to lawful access requests under US law. We never send your submission outside Canada ourselves. Separately, the Google Analytics and Google Ads tags described in section 7 send limited technical data to Google LLC in the United States, never your form answers or health information.

7. Our website and online form

procaremd.ca sends your form securely to data centres in Canada, keeps it encrypted, and permanently deletes it within 30 days. Here is what happens to your submission:

You submit the form over an encrypted HTTPS (TLS) connection.
It is stored in Amazon Web Services data centres in Canada (Canada Central region), encrypted at rest with managed encryption keys.
Authorized clinic staff sign in to view it, each with their own account protected by a password and an authenticator-app code, and transfer it into the clinic’s EMR. Access is logged.
Once the transfer is done, staff permanently delete the online copy. Anything not yet deleted is erased automatically 30 days after you submit it. Deleted submissions cannot be recovered.

Other things to know:

Not end-to-end encrypted. Your information is protected in transit and in storage, but our system decrypts it to show it to authorized clinic staff. ProcareMD’s system administrator, who is our Privacy Officer, also has technical access to the system to maintain it. This access is limited to what is needed and is logged.
Website data. Our website uses cookies and analytics tools such as Google Analytics. These collect general usage data, such as pages visited and browser type, not health information. Google Analytics is provided by Google LLC, a US company, so this data may be processed in the United States or other countries. Form contents are never sent to analytics or advertising tools. You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google’s browser add-on at tools.google.com/dlpage/gaoptout.
Email and text messages. Regular email and text are not fully secure. ProcareMD does not send appointment reminders; the clinic may, under its own policy. Please do not email us health details unless we have arranged a secure method with you.
Links to other sites. We are not responsible for the privacy practices of websites we link to.
Advertising. As a marketing company, we may use advertising tools such as Google Ads on our general web pages. When you submit the form, our website tells Google Ads that a submission happened, so we can measure how well our ads work (conversion tracking). Google’s tag sends only that event, with standard technical data such as an ad-click identifier, your IP address and browser type. Google Ads is provided by Google LLC, a US company, so this data may be processed in the United States or other countries. It never sends your name, contact details, health number, health information or any other form answers to Google. We do not use form submissions for retargeting, audience lists or personalized advertising. You can limit this tracking by blocking cookies or changing your Google ad settings at myadcenter.google.com.

8. How we protect your information

We use physical, administrative and technical safeguards to protect your information from theft, loss and unauthorized access, use, copying, change or disposal.

Physical: ProcareMD does not keep paper copies of form submissions. Devices used to manage the system are password-protected, encrypted and kept secure.
Administrative: Staff may access only the information they need for their job. Service providers sign written agreements requiring them to protect your information.
Technical: encryption in transit and at rest, unique user accounts with two-factor authentication, access logs that we review regularly, firewalls and up-to-date security software. Submissions are deliberately not backed up, so deleted copies cannot be recovered.
Patient identity: we confirm your identity before discussing your information by phone or in person.

9. How long we keep it

procaremd.ca keeps your online form submission for no more than 30 days. Once clinic staff transfer it into the EMR, they permanently delete the online copy; anything left is deleted automatically at 30 days and cannot be recovered.

At the clinic: your medical chart. Information transferred into the EMR becomes part of your medical record. The clinic keeps it under its own policy and Ontario’s medical-record rules, which require at least 10 years after the last entry, or for children, at least 10 years after they turn 18 (Ontario Regulation 114/94 under the Medicine Act). Ask the clinic for details.
Applicants the clinic cannot accept. If the clinic cannot take you as a patient, your submission is deleted within the same 30 days and is not added to an EMR chart.
Secure destruction. Online submissions are permanently deleted from encrypted storage. Any device ProcareMD retires is permanently wiped or destroyed.

10. Your rights

You can see your information, ask us to correct it, and complain to us or to the Information and Privacy Commissioner of Ontario.

Access. For a copy of your medical record, contact the clinic. For any form submission ProcareMD still holds, contact our Privacy Officer. We will respond within 30 days, or tell you in writing if we need up to 30 more days and why. In rare cases PHIPA lets us refuse access to part of a record, such as where access could cause serious harm. We will explain any refusal in writing.
Fees. ProcareMD does not charge for access to submissions it holds. The clinic may charge a reasonable fee for copies of your medical record, under its own policy.
Correction. If you believe your submission is inaccurate or incomplete, ask us in writing to correct it. We will respond within 30 days. If we disagree, you may add a statement of disagreement. To correct your medical chart, contact the clinic.
Complaints to us. Contact the Privacy Officer (section 2). We will look into your concern and respond in writing.
Complaints to the Commissioner. You may also complain to the Information and Privacy Commissioner of Ontario, 2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8; 416-326-3333 or 1-800-387-0073; www.ipc.on.ca.

Requests about your medical chart go to the clinic that holds it. ProcareMD can only respond about form submissions it still holds, which is never more than 30 days.

On request, we will also tell you whether we hold your information, how it has been used, and which organizations we have sent it to. If anything in your submission is wrong, tell us before it is transferred and we will correct it.

Complaints under federal law. Where PIPEDA applies, you may also complain to the Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, QC K1A 1H3; 1-800-282-1376; www.priv.gc.ca.

11. If a privacy breach happens

If your information is stolen, lost, or used or shared without authorization, we will notify the clinic immediately, as PHIPA requires of a custodian’s agent. You will be notified at the first reasonable opportunity, by us on the clinic’s behalf, and told that you can complain to the Information and Privacy Commissioner of Ontario.

We will contain the breach, investigate it, and take steps to prevent it from happening again. The clinic, as custodian, reports to the Information and Privacy Commissioner of Ontario where PHIPA requires it, and we give the clinic the information it needs to do so. Where a breach creates a real risk of significant harm, we will also report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible. We keep a record of every breach, reportable or not, for at least 24 months.

12. Changes to this policy

We review this policy at least once a year and when our practices or the law change. The current version is always posted at procaremd.ca and is available from our Privacy Officer on request. We keep a dated copy of every previous version.

Last updated: October 11, 2026.