Privacy Policy
Last Updated: September 2026This policy describes how Insynco collects, uses, and protects your personal and health information. Please read it carefully.
This Privacy Policy describes how Insynco Inc. ("Insynco," "we," "us," or "our") collects, uses, discloses, and protects your personal information and personal health information when you use the Insynco website (www.insynco.com), our patient portal, or receive care through our clinical team.
Insynco is committed to protecting your privacy in accordance with applicable Canadian privacy legislation, including the Personal Health Information Protection Act, 2004 (PHIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA).
By using the Insynco platform, scheduling an appointment, or receiving services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree, please do not use our services.
1. Governing Legislation
Two primary statutes govern how Insynco handles personal information:
- PHIPA (Personal Health Information Protection Act, 2004): Governs personal health information collected, used, or disclosed in the course of providing healthcare in Ontario. This includes clinical records, lab results, treatment plans, prescriptions, and health information shared within Insynco's circle of care.
- PIPEDA (Personal Information Protection and Electronic Documents Act): Governs commercial and operational personal information, including contact details, payment information, website analytics, and marketing communications.
Where both statutes may apply, Insynco follows the more protective standard.
2. Health Information Custodian
Under the Personal Health Information Protection Act, 2004, Insynco Inc. is the Health Information Custodian for all personal health information collected or maintained in the course of delivering services through the Insynco platform. The naturopathic doctors and other regulated health professionals providing care through Insynco do so as agents of Insynco under PHIPA. All clinical records, regardless of which practitioner creates or contributes to them, are held by Insynco as the Health Information Custodian.
Insynco has appointed a Privacy Officer who is responsible for overseeing compliance with this Privacy Policy and applicable privacy legislation. The Privacy Officer may be reached using the contact methods at the end of this policy.
If a practitioner ceases to provide services through Insynco, the clinical records of patients they served remain with Insynco as the Health Information Custodian. Patients are entitled to continuity of care and will be notified of any changes to their clinical team.
3. What We Collect
We collect only the personal information necessary to deliver care, facilitate that care, communicate with you, and meet legal obligations.
| Category | Examples | Primary Purpose |
|---|---|---|
| Identification & Contact | Name, email, phone, address | Create patient record, identity verification, appointment scheduling |
| Demographic | Date of birth, basic demographics | Identify you accurately in your patient record |
| Intake Information | Health concerns, goals, and symptoms described in booking or intake forms | Match you with the appropriate practitioner and prepare for your first visit. This information is collected before your clinical relationship begins. |
| Clinical Data | Assessment notes, diagnoses, treatment plans, prescriptions, lab results, clinical messages | Assessment, treatment, continuity of care. Created and maintained by your clinical team in our electronic medical records system. |
| Financial | Credit card details, transaction records, receipts | Process payments and issue receipts for insurance reimbursement |
| Device & Usage | IP address, browser details, session analytics | Security monitoring, website improvement, traffic analysis |
4. How We Use Your Information
- Deliver naturopathic care via telehealth
- Verify identity, book appointments, send reminders, and process payments
- Order labs and share results within your circle of care
- Coordinate with external providers (family doctor, labs, pharmacies) where you have authorized us to do so
- Perform quality assurance and create de-identified analytics to improve services
- Comply with legal and regulatory obligations
No fully automated decisions are made about your care without human review.
5. How Your Information Is Stored
Clinical health records, including all information created, collected, or used by our clinical team in the course of delivering care, are maintained in a secure electronic medical records system hosted in Canada.
Operational and administrative data, including your contact information, appointment scheduling, and communications, is processed by our operational systems. These systems may be hosted in the United States by third-party service providers who maintain independently audited security controls, including SOC 2/3 compliance, HIPAA compliance, and ISO 27001 certification. This data may be subject to US law, including lawful access requests by US authorities.
Insynco takes reasonable steps to ensure that all third-party service providers maintain security standards comparable to those required under applicable Canadian privacy legislation. We do not use service providers for clinical data storage unless they meet the standards described above.
6. Call Recording
Incoming and outgoing phone calls to and from Insynco may be recorded for administrative purposes, quality assurance, and training. Call recordings that contain personal health information are retained and secured in accordance with applicable privacy legislation. Call recordings are stored by our communications service providers, whose servers may be located in the United States.
7. AI-Assisted Communications
Insynco uses AI-assisted tools to support appointment scheduling, reminders, and routine administrative communications. These tools do not provide medical advice and are not used to make clinical decisions. AI-assisted communications are subject to the same security and PHIPA safeguards as our other operational systems. Patients may request to speak with a member of our team directly at any time.
8. Sharing & Disclosure
We do not sell your personal information. We share it only as follows:
- Circle of Care: NDs and authorized staff involved in your treatment may access your clinical records as necessary to deliver care.
- Service Providers: Third-party providers who support our operations, including electronic medical records, cloud hosting, communications platforms, payment processors, and website hosting. These providers process data on our behalf and are required to protect it in accordance with their contractual obligations and applicable law.
- Legal & Regulatory: Courts, law enforcement, or regulatory colleges where required by law.
- Business Transfers: In the event of a merger, acquisition, or reorganization, we will require the successor to honour this Privacy Policy.
9. Cookies & Analytics
The Insynco website uses cookies, pixel tags, and similar technologies for security, session management, and traffic analytics. You can refuse or delete cookies at any time via your browser settings.
10. Your Rights
Under PHIPA and PIPEDA, you have the right to:
- Request access to the personal information Insynco holds about you.
- Request correction of any inaccurate or incomplete information.
- Withdraw consent to the collection, use, or disclosure of your personal information, subject to legal, regulatory, or contractual obligations that may require continued retention.
- File a complaint with Insynco's Privacy Officer (contact details above), the Information and Privacy Commissioner of Ontario at ipc.on.ca, or the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Withdrawal of consent does not affect information already collected or actions already taken. Some information may be retained in secure backups for a limited period after deletion from active systems.
11. Retention
| Record Type | Retention Period |
|---|---|
| Clinical chart & PHI | Retained by Insynco as Health Information Custodian for 10 years from last entry, or 10 years after a minor turns 18 |
| Call recordings containing PHI | Retained in accordance with PHIPA and applicable College standards |
| Web server logs | 18 months |
| De-identified analytics | Indefinite |
12. Breach Notification
In the event of a breach or suspected breach of personal health information, Insynco will take immediate steps to contain the breach, investigate the circumstances, and assess the risk of harm. Where required by PHIPA, Insynco will notify the Information and Privacy Commissioner of Ontario and affected individuals at the first reasonable opportunity. Insynco will also notify any other regulatory body or authority as required by applicable law.
13. Minors
For patients under the age of 18, parental or guardian involvement may be required depending on the patient's capacity to consent to treatment. Where a minor demonstrates the capacity to consent to treatment independently, that patient may also consent to the collection, use, and disclosure of their own personal health information in accordance with PHIPA.
14. Third-Party Links
The Insynco website may contain links to websites or services we do not own or operate. These third parties have their own privacy practices, and we are not responsible for their handling of your information.
15. Passwords
Online access to your Insynco patient portal is protected by a password you select. Do not share your password. We will never ask for it in unsolicited communications.
16. Contact Us
If you have questions about this Privacy Policy or how we handle your personal information, please contact us:
- Email: support@insynco.com
- Phone: (647) 490-3236
- Online: www.insynco.com/contact-us
Insynco's Privacy Officer can be reached using the contact methods above.
Mailing address: Insynco Inc., 2967 Dundas St. W. #729, Toronto, ON M6P 1Z2
17. Changes to This Policy
This Privacy Policy may be updated from time to time to reflect changes in our practices, technology, or legal requirements. The revision date at the top of the policy will be updated when changes are made. We encourage you to review the policy periodically. Your continued use of Insynco's services after a change constitutes acceptance of the updated policy.