Privacy policy

1. About this policy

Ally Health Technologies Inc. ("Ally," "we," "our," or "us") operates a rehabilitation-plan platform for approved, college-regulated healthcare practitioners and their patients, together with exercise education and an optional directory of publicly funded clinics. This policy explains how we collect, use, disclose, and protect personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario's Personal Health Information Protection Act (PHIPA), and applicable provincial law.

2. Information we collect

We collect the following categories of personal information:

2.1 Account information

• Name, email address, and account role
• Preferred language and rehabilitation-notification choices
• Terms and consent version, acceptance time, and account lifecycle status
• Authentication identifiers and security information maintained by Supabase

2.2 Practitioner information

• Regulated profession and college registration number
• Registration verification and Ally approval status
• Patient-roster links needed to authorize plan access

2.3 Patient assignment and invitations

• A managed patient's name and assigned practitioner
• An invitation email address when a practitioner asks Ally to invite the patient
• A hashed, expiring claim token, invitation status, and claim consent record

2.4 Rehabilitation plans and progress

When you create, receive, or use a rehabilitation plan, we may collect:

• Assigned exercises, dosage, stages, dates, and practitioner-authored instructions or notes
• Provider-owned templates and custom exercises, which are not linked to a patient until assigned
• Plan consent records, author and patient identifiers, and version history
• Exercise completion status and timestamps
• Optional pain and difficulty ratings and optional feedback notes
• Derived adherence, streak, and progress summaries

A plan linked to an identified patient, its completion history, and symptom feedback are personal health information. Optional feedback is visible to the patient and authorized practitioner responsible for the plan.

2.5 Information Ally does not save

Browsing the general exercise library does not create an assigned rehabilitation plan or a separate clinical record. Ally does not ask you to submit body-region choices or safety-screen answers to select an exercise program.

2.6 Technical and audit data

• IP address, browser type, and operating system
• Authentication, security, and identifier-only access-audit events
• Scrubbed error details, anonymous public-site analytics, and a pseudonymous account identifier used for server-side feature-flag evaluation when those services are enabled

2.7 Optional clinic-search information

When you use an address-search feature, the partial and complete address text you type is sent directly from your browser to Google Maps Platform to return suggestions and coordinates. Google also receives ordinary request information such as your IP address and browser or device information. Ally uses the selected coordinates in browser memory to sort and display nearby results and does not save the address or selected coordinates to Ally's servers through the clinic finder.

3. How we use your information

We use your personal information to:

• Create and manage your account
• Let practitioners create, assign, update, and export rehabilitation plans
• Let patients view plans, record completion, and optionally share symptom feedback
• Provide exercise education and clinic referrals
• Verify practitioner registration and restrict clinical access
• Resolve disputes and enforce our Terms of Service
• Operate, secure, troubleshoot, and improve the platform using minimized data
• Comply with legal and regulatory obligations
• Send neutral service communications and optional exercise reminders

We do not sell personal information, use personal health information for advertising, or send authenticated rehabilitation activity to analytics providers.

4. Disclosure to third parties

We disclose personal information only as necessary for the operation of the platform:

4.1 Third-party service processors

Google processes address-search information under the Google Maps End User Additional Terms of Service and Google Privacy Policy. Ally does not control Google's independent retention or use of information. You can use the clinic directory without entering an address, although results will not be sorted by distance.

4.2 Other disclosures

We may also disclose information:

• To an authorized Practitioner who creates or manages your assigned rehabilitation plan, limited to the plan and progress information needed for that purpose
• When required by law, court order, or regulatory authority
• To prevent fraud, abuse, or imminent harm to any person
• In connection with a business transaction (merger, acquisition), with notice

5. Cross-border data transfers

Ally's system of record is operated in approved Canadian AWS regions, and the identity service holding your sign-in credentials is operated by Supabase in a Canadian region, so stored records and stored credentials remain in Canada. Ally's applications themselves are hosted by Render in the United States (Ohio). Every request you send and every page the platform builds for you is processed there, including the sign-in details you submit and any personal health information the page contains, such as assigned plans, completion history, symptom feedback, practitioner notes, and patient names. Postmark, Sentry, Google Maps Platform, PostHog, and professional registries may process further limited information in the United States or other jurisdictions. Information processed in the United States may be accessible to courts, law enforcement, or national-security authorities under local law, and that access may happen without notice to you. Ally limits what each provider receives, keeps health content out of analytics and error monitoring, limits health details in email, and uses contractual and technical safeguards appropriate to its role.

6. Personal health information (PHIPA)

For Ontario users, an assigned plan, completion history, symptom feedback, and practitioner notes may be personal health information under PHIPA. Ally provides information-management services that store and transmit this information on behalf of authorized users and Practitioners for the rehabilitation-plan service. Ally does not use personal health information for advertising, public-site analytics, research, or another secondary purpose without appropriate authority and consent.

A Practitioner who creates or accesses a patient's plan may be a health information custodian with independent PHIPA and professional record-keeping duties. Ally limits access to the patient and authorized Practitioners with a documented relationship, keeps identifier-only access audits, and requires consent when a plan is assigned or materially updated. Ally's precise legal role and each Practitioner's obligations depend on the circumstances and should be confirmed with the responsible Privacy Officer or custodian.

7. Data retention

We retain personal information as follows:

• Active accounts: account and profile data is retained while the account is active. After closure, data that is no longer needed is removed or minimized, while information required for care, financial, legal, security, consent, or audit purposes is retained for the applicable period
• Practitioner-authored plans: retained as directed by the responsible Practitioner and for the period required by applicable professional, clinical-record, consent, and legal obligations; archived plan versions are preserved rather than overwritten
• Exercise-library browsing: does not create an assigned rehabilitation plan or a separate clinical record
• Adherence and optional symptom feedback: retained with the related plan for as long as needed for the plan's purpose and applicable record obligations
• Security, consent, and audit evidence: retained for the period needed to demonstrate authorization, protect the service, investigate incidents, resolve disputes, and meet legal obligations

You may request account closure and deletion of information that is no longer required. See Section 8 below.

8. Your privacy rights

Under PIPEDA and applicable provincial law, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information, subject to legal retention obligations
• Withdrawal of consent: withdraw consent to non-essential uses of your information; note that withdrawal may affect your ability to use certain features
• Complaint: file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
• Ontario health privacy complaint: file a PHIPA complaint with the Information and Privacy Commissioner of Ontario (IPC) at ipc.on.ca.

To exercise any of these rights, contact our Privacy Officer at privacy@allyhealth.co. We will respond within 30 days.

9. Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit (TLS) and at rest (AWS encryption)
• Access controls and role-based permissions
• Presigned URLs with short expiry for document access (never public URLs)
• Regular security reviews and dependency updates

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but commit to notifying affected users of any breach as required by applicable law.

10. Cookies and tracking

Ally uses session cookies necessary for authentication and platform functionality. We do not use advertising cookies or authenticated behavioral analytics. PostHog is limited to anonymous, explicit events on signed-out public pages. Optional embedded services such as Google Maps may receive request information or use cookies under their own privacy policies. Disabling necessary cookies may prevent sign-in or other core features.

11. Children's privacy

Ally accounts are intended for people aged 18 and over. A practitioner may create and manage a care record for a minor only when permitted by law and with consent from the minor or an authorized substitute decision-maker, as applicable. Minors may not independently create or claim an Ally account. Contact us at privacy@allyhealth.co with any concern.

12. Changes to this policy

We may update this Privacy Policy as the service or law changes, or to correct or clarify it. Whenever we revise this policy, we will update the effective date at the top of this page. If you accepted this policy when you signed up, your continued use of the platform after the effective date constitutes acceptance of non-material changes. Material changes will be communicated before they take effect and, where required by law, renewed consent will be requested. The version number identifies the current policy.

13. Contact: Privacy Officer

For privacy-related questions, concerns, or requests:

Privacy Officer, Ally Health Technologies Inc.
Email: privacy@allyhealth.co