Privacy Policy

Who We Are

Dr. Victoria E. Cook Inc. ("we", "us", or "our") operates the Inbox Agent service. Inbox Agent is a medical documentation tool that helps healthcare providers process incoming referrals, record and transcribe clinical encounters, and create patient chart data for electronic medical records (EMRs).

We are based in British Columbia, Canada, and this policy is governed by the Personal Information Protection Act (PIPA) of British Columbia and other applicable Canadian privacy laws.

Service Availability

Inbox Agent is designed for use in Canada only. Our service is built to comply with Canadian privacy laws, including British Columbia's Personal Information Protection Act (PIPA).

We are not HIPAA compliant. Inbox Agent is not intended for use by healthcare providers in the United States or for processing health information of US residents. If you are subject to the US Health Insurance Portability and Accountability Act (HIPAA), this service is not appropriate for your use.

By using Inbox Agent, you confirm that you are a Canadian healthcare provider and that you will only use the service to process information in accordance with Canadian law.

Our Role

When healthcare providers use Inbox Agent to process patient information, we act as a data processor. This means we handle data on behalf of healthcare providers, who remain the data controllers responsible for their patients' information.

Healthcare providers using Inbox Agent are responsible for obtaining appropriate consent from patients before recording clinical encounters or processing their health information through our service.

If we have signed a service or data-processing agreement with your clinic, that agreement governs wherever it differs from this policy.

Information We Collect

Account Information

When you create an account, we collect:

• Email address
• First and last name
• Authentication method (email/password or Google Sign-In)

Organization Information

Organization administrators may provide:

• Organization and clinic name
• Business address (street, city, province, postal code)
• Phone and fax numbers
• Contact email and website
• Email display name and reply-to address
• Email and fax template preferences

Clinical Data (Processed on Behalf of Healthcare Providers)

When healthcare providers use our service, we process:

• Audio recordings of clinical encounters
• Transcriptions of those recordings
• Scanned or uploaded medical documents
• Extracted patient health information
• Generated medical notes and summaries

Technical Information

We automatically collect:

• IP address and browser type
• Pages visited and features used
• Device information

How We Use Your Information

We use the information we collect to:

• Provide and maintain the Inbox Agent service
• Process audio recordings into transcriptions
• Extract information from medical documents
• Generate medical notes and summaries
• Send service-related communications
• Provide customer support
• Ensure security and prevent fraud

We do not use your data to train AI models. We do not sell, rent, or share your personal information with third parties for their marketing purposes.

Third-Party Services

We use trusted third-party services to operate Inbox Agent. Here's where your data goes and where it's stored:

Data Stored in Canada

• Supabase (Montreal) — Database hosting, user authentication, and data storage
• Google Cloud (Montreal) — Audio file storage, storage of faxes and screen captures awaiting review, and AI analysis of clinical notes, faxes and screen captures (Gemini). Faxes and captures are deleted, and the personal information extracted from them is removed, once the document has been actioned.

Data Processed (But Not Stored) Outside Canada

While information is being processed by a provider outside Canada it may be subject to the laws of that country, including lawful access by its authorities. None of these providers stores your information after the request is complete.

• Google Gemini, global endpoint (outside Canada) — Used only when Google's Canadian region is at capacity, so that a note, fax or screen capture can still be analysed. The request is processed and not retained.
• Google Speech-to-Text (USA) — Audio transcription service. Audio is processed but not retained after transcription is complete.
• Deepgram (USA) — Real-time speech-to-text transcription. We have opted out of their model improvement program, so audio data is retained only for the duration needed to process each request.
• Resend (USA) — Email delivery service for sending documents and notifications
• SignalWire (USA) — Fax transmission and SMS delivery for task reminders and outreach notifications. Fax documents are fetched for transmission only and are not retained by the provider; text message bodies are redacted at the provider once delivered.
• Vercel (USA) — Web application hosting with basic page analytics
• Sentry (USA) — Error monitoring service. Collects technical diagnostic data only (error codes, performance metrics) to help us identify and fix application issues. No personal health information or patient data is sent to this service.
• hCaptcha (USA) — Bot check on our sign-in, sign-up, and password reset pages. To tell humans from bots, hCaptcha looks at technical signals like your IP address, mouse movements, and time spent on the page. No patient data or clinical information is sent to this service. See hCaptcha's privacy policy and terms of service.

All third-party services are bound by their own privacy policies and security practices. We select services that maintain appropriate security standards.

Data Retention

How long we keep each kind of information:

• Faxes and screen captures — The document and the patient and referrer details extracted from it are deleted as soon as you record an outcome for it. A record of the analysis (document type, timing, cost) is kept without any personal information.
• Recordings, transcripts and clinical notes — Kept until you delete them or close your account. Deleted audio remains recoverable for up to 7 days and is then permanently removed.
• Account and clinic details — Kept for as long as the account exists.
• Usage and billing records — Kept for as long as accounting and tax rules require. They contain no clinical content.
• Backups — Encrypted database backups are kept for a short, rolling period for disaster recovery and are then overwritten.

When you delete data or close your account, we will remove your information from our systems, except where we are required to retain it for legal or regulatory purposes.

Data Security

We protect your information through:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure authentication with optional two-factor authentication
• Role-based access controls
• Regular security reviews

Access to clinical information by our own team is limited to what is needed to operate and support the service, and is never used for any other purpose.

If we become aware of a breach of security safeguards involving your information that creates a real risk of significant harm, we will notify the affected clinic without undue delay so that it can meet its own obligations.

While we implement reasonable security measures, no system is completely secure. We cannot guarantee absolute security of your data.

Your Rights

Under BC's Personal Information Protection Act (PIPA), you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent for data processing (which may limit your use of the service)
• Request deletion of your personal information
• File a complaint with the Office of the Information and Privacy Commissioner for British Columbia

To exercise these rights, contact us using the information below.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have questions about this privacy policy or how we handle your information, please contact us:

Dr. Victoria E. Cook Inc.
Email: privacy@inboxagent.oaklabs.ca