Who we are and what this covers
Carelytics ("Carelytics", "we", "us") provides an operations platform for Canadian dental practices: HR, scheduling, payroll preparation, finance, hiring, engagement, analytics, patient communication and inventory (the "Platform"), and operates the website carelytics.io (the "Website").
This policy covers personal information we handle in three roles:
- Website visitors and prospects - people who browse the Website or ask us for a demo.
- Customers and their users - the dental practices that subscribe to Carelytics and the owners, managers and team members who use it.
- Information we process on behalf of practices - for example, employee records and patient information synced from a practice management system (PMS). For this information, the dental practice is the organization in control of it, and Carelytics acts as its service provider, following the practice's instructions.
We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy laws (including Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25), and the privacy obligations that health professionals in Canada must meet when they share information with service providers.
Information we collect
On the Website
- Demo requests and messages: your name, work email, phone number (optional), practice name, role, number of locations, province, practice software and anything you choose to write to us.
- Usage information: pages visited, links clicked, referring site, approximate location derived from your IP address, browser and device type, and campaign parameters (such as UTM tags) - collected through cookies and similar technologies (see "Cookies").
When a practice uses the Platform
- Account information: names, work email addresses, phone numbers, roles, clinic locations and login activity of the people who use the Platform.
- Billing information: the subscribing organization's billing contact and address, subscription details and payment records. Card details are handled by our payment processor; we do not store full card numbers.
- Team information entered by the practice: employee profiles, documents and signatures, schedules, time-off balances, clock-in records (including the location used to verify a clock-in, where the practice enables it), payroll inputs, performance reviews, kudos and anonymous feedback, and job applications.
- Practice and patient information synced from the PMS: appointments, production and collection figures, recall and treatment information, and the patient contact details needed for confirmations, reminders and reviews.
- Communications: messages sent through the Platform (for example, appointment confirmations by text or email) and support conversations with our team.
We do not ask for more information than we need for the purposes below, and practices control what they connect and enable.
How we use information
- To provide, secure, maintain and support the Platform and the features each practice turns on.
- To respond to demo requests and questions, and to arrange and run demos.
- To bill customers and manage subscriptions, including the 60-day money-back guarantee.
- To send service messages, such as security alerts, product changes and summaries a practice has set up.
- To understand how the Website and Platform are used so we can improve them, using aggregated or de-identified information wherever possible.
- To prevent fraud, spam and abuse, and to meet our legal obligations.
We use patient information only to provide the Platform to the practice that the information belongs to, as that practice directs. We never use it to market to patients on our own behalf, and we never sell it.
Artificial intelligence
Some Platform features use artificial intelligence, for example to prepare a morning huddle summary, draft a message or answer a question about a practice's numbers. When we send information to an AI model for these features:
- Patient information is de-identified first. Patient names and contact details are never sent to AI models.
- Figures are calculated by our own analytics engine from the practice's verified data; the AI only puts them into words.
- We do not allow AI providers to use practice data to train their models.
- People stay in charge: drafts are reviewed by the practice before anything is sent.
Consent and your choices
We rely on your consent, given when you submit a form, sign up or use the Platform, or implied where it is reasonable to expect we would use your information for a given purpose (for example, replying to a demo request). You can withdraw consent at any time, subject to legal or contractual limits; we will tell you if withdrawing affects what we can provide.
We do not send marketing emails to people who request a demo unless they agree to receive them, and every marketing message includes a way to unsubscribe, as required by Canada's Anti-Spam Legislation (CASL).
Patients who receive messages through Carelytics on behalf of their dental practice can opt out from the message itself (for example, by replying STOP to a text). Practices are responsible for having the consent they need to contact their patients.
Where information is stored
Platform data, including practice and patient information, is hosted in Canada.
Some service providers we use for limited functions (for example, delivering an email or text message, or processing a payment) may handle the information they need to perform that function outside Canada, including in the United States. When that happens, the information is protected by contract and may be subject to the laws of that jurisdiction. Patient information is not transferred outside Canada for analytics or AI processing.
How we protect information
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:
- Encryption of data in transit (TLS) and at rest.
- Role-based access within each practice's account, controlled by the practice.
- Restricted, logged access for Carelytics staff, granted only when needed to provide or support the service.
- Audit history of important changes, backups and monitoring.
- Confidentiality obligations for our team and service providers.
No system is perfectly secure. If a privacy breach creates a real risk of significant harm, we will notify affected customers without undue delay so that they can meet their own obligations, and we will notify individuals and regulators where the law requires us to.
How long we keep information
We keep personal information only as long as we need it for the purposes above or as the law requires.
- Demo requests that do not become customers are deleted or anonymized within 24 months of our last contact.
- Practice data is kept for as long as the practice's subscription is active. After cancellation, the practice can export its data for 30 days; we then delete it within 90 days, except for backups that expire on their normal schedule and records we must keep by law (such as billing records).
- Technical data used to protect against abuse (such as IP addresses on form submissions) is kept for up to 90 days.
Your rights
Subject to the law, you can ask us to:
- Tell you what personal information we hold about you and how we use it, and give you a copy.
- Correct information that is inaccurate or incomplete.
- Withdraw your consent or stop using your information for marketing.
- Delete your information, or (where Québec law applies) stop disseminating it or receive it in a structured, commonly used technological format.
Email info@carelytics.io. We will respond within 30 days and may need to confirm your identity first. There is no charge for a reasonable request.
Patients: if your dental practice uses Carelytics, the practice controls your information. Please contact your practice directly; we will help the practice respond to your request.
Cookies
The Website uses cookies and similar technologies:
- Essential cookies that make the Website work and keep it secure.
- Analytics cookies that tell us how visitors use the Website, so we can improve it.
- Marketing cookies that help us measure our advertising and understand which campaigns bring visitors to us.
You can block or delete cookies in your browser settings; the Website will still work, although some features may not. The Platform uses only the cookies needed to sign you in and keep your session secure.
Children
The Website and Platform are intended for dental professionals and their teams. We do not knowingly collect personal information directly from children. Information about minor patients is processed only on behalf of their dental practice, under the protections in this policy.
Changes to this policy
We may update this policy as our services or the law change. We will post the new version here with a new "last updated" date and, if the changes are significant, notify customers by email or in the Platform before they take effect.
Contact us
Our privacy officer is responsible for our compliance with this policy. For questions, requests or complaints, email info@carelytics.io.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada, or, in Québec, the Commission d'accès à l'information.