Privacy Policy

1. Who we are

AffordableHealth.ca ("the Platform") is operated by Homula Inc. ("we", "us"). This policy explains how we handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to personal health information held by a health information custodian, Ontario’s Personal Health Information Protection Act (PHIPA). Professionals on the Platform are separate custodians of the health information they collect when they provide care.

2. What we collect

Patients: name, email, phone (optional), the first three characters of your postal code and/or city, preferred language(s), appointment preference, and — optionally and only if you choose — a self-declared income band and household size. For each request: a type of care, budget range, an issue category, a short free-text description, and urgency.

Professionals: name, contact details, profile content, sectors and fees, College and registration details, and verification documents (government ID, proof of registration, insurance certificate).

Everyone: account credentials (passwords are stored hashed), messages sent through the Platform, bookings and reviews, billing records for professionals, and technical logs (IP address, browser type, timestamps) for security.

We ask you not to provide detailed medical history or clinical information in free-text fields, and we do not store clinical notes about your care.

3. Why we collect it and our legal basis

• To create and secure your account.
• To match patients with suitable Professionals and to let you communicate and book.
• To verify Professionals against College registers and maintain trust and safety.
• To process Professional subscription payments (via our payment processor).
• To send transactional messages (confirmations, responses, reminders).
• To meet legal, regulatory, and security obligations.

We rely on your consent, and on our legitimate interest in operating a safe, functioning service. You can withdraw consent by closing your account, subject to records we must keep by law.

4. Who your information is shared with

• Professionals: your request details and messages are shared with Professionals you contact, or — with "Available now" — with online Professionals in the relevant sector. Professionals see your first name until an appointment is confirmed.
• Service providers ("processors"): hosting, email delivery, and payment processing (Stripe, and for some Canadian payments a pre-authorized-debit provider). They act on our instructions under contract. Payment card details are entered directly with the processor and are never stored on our servers.
• Legal: where required by law, court order, or to protect safety and our rights.

We do not sell personal information or share it with advertisers.

5. Where your data is stored

We host data in Canada where practical. Some service providers may process limited data outside Canada (for example, the United States); where they do, it is protected by contractual safeguards and remains subject to the laws of those jurisdictions. Contact us for current details.

6. How long we keep it

Account and request data is kept while your account is active and for a reasonable period afterward. Verification documents for Professionals are kept for the duration of participation plus a limited retention period, then securely destroyed. Billing records are kept as required by tax law. Security logs are kept for a limited period.

7. Security

We use encryption in transit, hashed passwords, access controls, an audit log of staff access to sensitive records, and store verification documents outside the public web root. No system is perfectly secure; we will notify you and the relevant regulator of a breach affecting your information where required.

8. Your rights

You may access, correct, or delete your personal information, withdraw consent, or complain to us and then to the Office of the Privacy Commissioner of Canada. Use the contact form or your account settings. We will respond within the timeframes the law requires.

9. Cookies and analytics

We use a strictly necessary session cookie to keep you signed in and to protect forms against cross-site request forgery. You may set a language preference, which we remember.

On the public pages of the site we use Google Analytics to count visits and see which pages people find useful. It sets its own cookies and receives your truncated IP address, the pages you view, and general information about your browser and device. We have IP anonymisation switched on, and we do not send it your name, email address, or anything you tell us about your health or your budget. Analytics does not run at all once you are signed in, so nothing you do inside your account is measured this way.

We do not use advertising or remarketing cookies, we do not sell personal information, and we do not use analytics to build a profile of you or to target advertising. If you prefer to opt out entirely, you can use Google’s browser add-on at tools.google.com/dlpage/gaoptout, or block cookies for this site in your browser.

10. Children

The Platform is not intended for children under 16. A parent or guardian may register and make requests on behalf of a minor in their care.

11. Changes

We will post any changes here and, for material changes, ask you to review them. The current version is at /legal/privacy_policy.

12. Contact

Privacy questions or requests: use the contact form on the Platform, marked for the attention of the Privacy Officer.