Privacy Policy

Last updated: October 13, 2026

This policy explains what information Pathmarker Technologies Inc. ("Pathmarker", "we", "us") collects, why, how we protect it, and the choices you have. It covers the Pathmarker platform and this website.

1. Who this policy is for

Pathmarker is software used by health and wellness clinics, the practitioners and staff who work in them, and the clinic's clients (we call them "members"). Members use Pathmarker because their clinic has invited them.

This policy applies to:

• Practitioners and clinic staff who use Pathmarker at work.
• Members who use Pathmarker through their clinic.
• Visitors to this website.

2. Clinics and Pathmarker: who is responsible for what

Your clinic decides what health information it collects about you, why, and who in the clinic can see it. The clinic is responsible for that information. Pathmarker stores and processes it on the clinic's behalf, as the clinic's service provider, under our agreement with the clinic.

If you are a member and have a question about your health record, or want to see, correct or delete it, start with your clinic. We will help the clinic answer your request. If you contact us directly, we will pass your request to your clinic.

For information we collect for our own purposes, such as practitioner account details, billing contacts and website enquiries, Pathmarker is responsible.

3. Information we collect

Account information

Name, email address, role, clinic, and sign-in details for practitioners, staff and members.

Health and wellness information

Information that a clinic or member enters or uploads, such as intake answers, lab results, notes, care plans, messages, habits and daily logs. Clinics decide what is collected.

Information from services you connect

If you choose to connect another service, we receive the information described in sections 6 and 7. We only receive it after you connect, and you can disconnect at any time.

Visit recordings and transcripts

If a clinic uses the note-drafting features, we receive transcripts from the transcription provider the clinic has connected, or audio from a practitioner's own voice dictation, and use them to draft visit notes.

Technical information

Records of sign-ins and activity inside the platform, including an audit log of who viewed or changed health information. Our hosting and network providers also keep standard server logs, such as IP address and browser type.

This website

This website does not use advertising or analytics trackers. If you email us, we keep your message and contact details so we can reply.

4. How we use information

• To provide the platform to clinics and their members, as the clinic directs.
• To keep accounts secure, and to investigate misuse.
• To send service emails, such as sign-in links, reminders and notifications.
• To support you when you ask for help.
• To meet legal obligations.

We do not sell personal information. We do not use health information or connected-service data for advertising.

5. AI features

Some features use AI. These features run on Amazon Web Services (AWS) Bedrock.

• For practitioners: AI drafts content such as visit notes and summaries. A draft does not become part of a member's record until a practitioner reviews and approves it.
• For members: if a clinic turns it on, a member can ask questions about their own information and get answers drawn from their record. These answers are information, not medical advice, and are not reviewed by a practitioner before the member sees them.

We do not use your information to train generalized AI models. Under AWS's terms for Bedrock, AWS does not use it to train its models either.

6. Google user data and Limited Use

A practitioner can connect their Google Calendar to Pathmarker. This section explains exactly what that connection does.

What we access

• Your calendar events (Google scope calendar.events).
• Your list of calendars, read only (calendar.calendarlist.readonly).
• Your basic profile: name and email address (openid, email, profile), used to link the right Google account to your Pathmarker account.

What we use it for

• To show when you are busy on your clinic's Pathmarker schedule, so visits are not booked over your other commitments. We store only the start and end time of each busy block. We do not store the titles, descriptions, locations or attendees of your Google events.
• To create or update events in your Google Calendar for visits booked in Pathmarker. These events are titled "Pathmarker visit" with the visit length. They do not include the member's name.

Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

• Google user data is not sent to, used by, or shared with any generalized or foundational AI or machine-learning model, and is not used to develop, improve or train any AI or machine-learning model.
• Google user data is not sold, not used for advertising, and not transferred to third parties, except as needed to provide the calendar feature to you (for example, through the service providers in section 8), for security, or as required by law.

How it is stored and protected

Your Google access and refresh tokens are encrypted in our database, and so is the email address of the linked Google account. Busy times are stored inside your clinic's isolated area of the platform, which other clinics cannot read.

Who can see it

You, and the authorised staff of your clinic who can view the clinic schedule. Pathmarker personnel access it only when needed to operate or support the service, or when required by law.

How to disconnect

• In Pathmarker: open Schedule, find the Calendar sync panel, and choose Disconnect.
• In Google: remove Pathmarker's access at myaccount.google.com/permissions.

What happens when you disconnect

When you disconnect in Pathmarker, we delete the stored Google tokens, ask Google to revoke our access (if that request fails, the deletion of our stored tokens still stands), and delete the busy times we copied from your calendar. Visit events that Pathmarker already created stay in your Google Calendar; you can delete them there. We keep a record that the connection existed, including the linked Google email address in encrypted form, for as long as the clinic's account is active, and we delete it with the rest of the clinic's data when the clinic leaves (see section 11).

7. Other connected services

Each of these is optional. They work only when a clinic or member chooses to connect them.

• Zoom, for video visits through the clinic's Zoom account.
• Oura and Strava, so a member can share wearable and activity data with their clinic.
• Fullscript, so a practitioner can recommend and order supplements.
• A transcription provider chosen by the clinic, which turns visit recordings into transcripts used to draft notes (for example Fathom, if the clinic connects it). Voice dictation inside Pathmarker uses Amazon Transcribe, described in section 8.

When you connect one of these services, information also flows to that service under its own privacy policy. Tokens we hold for connected services are encrypted.

8. Service providers

We use these providers to run Pathmarker. They process information only to provide their service to us.

• Amazon Web Services: hosting, storage, AI processing and speech-to-text (Amazon Transcribe).
• Cloudflare: website delivery and network traffic.
• Resend: sending email.

We may also disclose information if the law requires it, or as part of a sale or reorganisation of our business, in which case the information stays subject to this policy.

9. Where information is stored

Pathmarker's production platform is hosted on AWS in the Canada (Central) region. Some information may be processed outside Canada:

• AI features may use AWS cross-region processing, which can route a request to AWS data centres in the United States for processing.
• Network traffic passes through Cloudflare, which operates worldwide.
• Email passes through Resend.
• Connected services such as Google, Zoom, Oura, Strava and Fullscript store data in their own locations.

Information processed outside Canada may be accessible to authorities in that country under its laws.

10. How we protect information

• Each clinic's data is kept separate, and the database itself refuses to show one clinic's data to another.
• Sensitive health information and service tokens are encrypted in our database. Stored files are encrypted.
• Access inside a clinic is limited by role.
• Views and changes to health information are recorded in an audit log.
• Information is encrypted in transit between your browser and Pathmarker.

No system is perfectly secure, but we work to protect information and to fix problems quickly.

11. How long we keep information

We keep clinic and member information for as long as the clinic uses Pathmarker, and then as the clinic directs, subject to the record-keeping rules that apply to the clinic's practitioners. Clinical records that a clinic must keep by law (generally 10 years from the last entry for an adult) are kept for as long as the clinic directs.

When a clinic leaves Pathmarker, we keep its data for 30 days so it can be exported, and then delete it from the live platform. Database backups are kept for 30 days and disk snapshots for up to 35 days, and then expire automatically, so deleted information can remain in backups until they expire. Application and server logs are kept for about 30 days.

When information is deleted in the platform, it is first marked as deleted and hidden from use. It stays in the platform, so the clinic can meet its record-keeping duties, until the clinic's retention period ends or the clinic leaves, and is then permanently removed on the schedule above.

12. Your choices and rights

You can ask to see the personal information held about you, to correct it, or to have it deleted. Members should start with their clinic (see section 2). Practitioners, staff and website visitors can contact us directly.

Some health information may need to be kept even after a deletion request, because clinics and practitioners have legal duties to keep clinical records. If we or your clinic cannot fully meet a request, we will explain why.

You can disconnect any connected service at any time.

13. If something goes wrong

If we learn of a breach of security that affects personal information, we will notify the affected clinics without unreasonable delay so they can meet their own obligations. Where the law requires, we or the clinic will notify affected individuals and the relevant privacy regulator.

14. Children

Pathmarker is not designed for children. A member account is for a person who is 18 or older, or the age of majority where they live if that is higher. A clinic that needs to hold information about a minor does so through the minor's parent or guardian and is responsible for getting the consent the law requires.

15. Changes to this policy

We will update the date at the top of this page when we change this policy. If a change materially affects how we use personal information, we will tell clinics and account holders before it takes effect.

16. Contact us

Questions or requests about privacy: sales@pathmarker.ca

Pathmarker Technologies Inc.
40534 Thunderbird Ridge, Garibaldi Highlands, BC V0N 1T0, Canada

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.