Privacy policy.

Who we are, and the two kinds of information we handle

Nidl (“Nidl”, “we”) operates nidl.ca, the Nidl clinic workspace, and Nidl’s patient services. We handle two very different categories of information, in two different roles:

1 · Information you give us directly — when you browse this website, apply for the pilot, or email us. For this information, Nidl is the organization accountable under PIPEDA and BC PIPA.

2 · Health information processed for clinics — when a clinic uses the Nidl workspace, or you interact with your clinic through Nidl’s patient services (online booking, secure messages, your patient account). Your clinic remains the custodian of your health record; Nidl processes that information only on the clinic’s instructions, under a signed Data Processing Agreement. Public website forms and email links must not be used to send personal health information.

What we collect

Website + pilot: contact details you submit (name, email, clinic name), correspondence, and basic analytics (page views and traffic sources — marketing pages only; workspace and patient routes are excluded from analytics by design).

Clinic workspace: staff account details (name, work email, role), workspace settings, and an append-only audit trail of actions taken in the workspace.

Patient services: account details you provide (name, email, phone, date of birth), your clinic connections, appointment bookings, and secure messages between you and your clinic. You can also book as a guest — we collect only the name, email, and phone needed for that booking.

Why we use it

To provide and secure the services; to run bookings, messages, and clinic workflows on a clinic’s instructions; to respond to enquiries; and to meet legal obligations. We do not sell personal information, we do not put advertising trackers in the product, and we do not use clinic or patient data to train AI models.

Where it lives

Production data is stored with our cloud infrastructure provider in Canada (Montréal, Québec region). Our current sub-processors — infrastructure, transactional email, AI processing — and the live security posture are documented on the security page. Where a sub-processor performs limited processing outside Canada (for example, marketing site analytics), it is disclosed there and excluded from health-information flows.

AI processing

Nidl uses AI to classify documents, draft messages for staff review, and suggest next operational steps. AI output is a reviewable artifact — a human at the clinic approves anything that affects a patient. AI providers are configured for zero data retention and are listed with the other sub-processors.

Retention & deletion

Website enquiries are kept as long as needed to respond and for reasonable business records. Clinic and patient data is retained per the clinic’s instructions and applicable health-records law; audit trails are append-only and retained for compliance. When a patient disconnects their account from a clinic, that clinic’s staff lose access to the connected profile — recall is built into the platform.

Your rights

You may request access to or correction of personal information Nidl holds about you, ask us to delete your patient account, or withdraw consent (which may limit what we can provide). For information inside your clinic’s record, your clinic is the custodian — we route those requests to them. Contact privacy@nidl.ca. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner (in BC, the OIPC).

Breach notification

If a breach creates a real risk of significant harm, we notify affected clinics, affected individuals, and the relevant commissioner as required by law, without unreasonable delay.

Changes

Updates are posted here with a new effective date. Material changes to clinic data handling are communicated to clinics directly.