How Clinic Conductor looks after your patients' information, the laws it follows, and what we put in writing. Written for your privacy officer, your IT lead and your patients.
We use it only to do the work your clinic asks for. We never sell it, share it, or use it for anything else.
Patient data is never training data, for any model, ours or anyone else's.
Canadian clinics are stored and processed in Canada. Québec clinics are stored and processed in Québec, on servers in Montréal.
A fully separate US setup with its own data, in the United States only. Canadian and US clinics never share anything.
Drafts waiting for your clinician stay in your clinic's own account, under your control. Where that account is held depends on your clinic's setup, and we confirm it with you at onboarding so what you tell patients matches.
Your data is encrypted when it moves and when it rests, and everyone who signs in uses two-step verification.
A log of who touched what, kept for seven years in your clinic's own country, and yours whenever you ask.
A privacy agreement with every clinic before any data is shared: a BAA for US clinics, a PHIPA or Québec agreement for Canadian ones.
Ontario
We use health information only to do the work your clinic asks for, and we never share it.
CompliantQuébec
Stored and processed in Québec, on servers in Montréal. We help with the privacy impact assessment Québec asks for.
CompliantCanada
Personal information is handled to the federal standard, wherever provincial health law does not already apply.
CompliantUnited States
Safeguards that meet the Security Rule, and a signed BAA with every US clinic before any data is shared.
CompliantPan-Canadian
Built on the Canadian health-data standards Infoway publishes, so we connect cleanly to the systems you already use.
Standards readyInfrastructure
Runs on infrastructure independently certified to ISO/IEC 27001, 27017 and 27018 and audited under SOC 2 Type II. Our own practices follow the same frameworks.
Certified infrastructureYour clinic is the keeper of its patients' information. Here is what we take on with you, under each law.
Ontario
Québec
Canada
United States
What your clinic does on its side: your privacy responsibilities
Clinic Conductor exchanges information on HL7 FHIR R4, the standard beneath the pan-Canadian specifications published by Canada Health Infoway. Jane App, Oscar Pro and TELUS Health are live in production.
Clinic Conductor runs on infrastructure independently certified to ISO/IEC 27001, 27017 and 27018, and audited under SOC 2 Type II.
Our own security practices follow the same frameworks, and we review them as the platform changes.
Clinic Conductor organizes and surfaces information. Every clinical decision stays with your physicians.
Nothing generated for a patient reaches them until a clinician has reviewed it and signed.
When an automated step is unsure, it stops and waits for a person.
Our security package has the detail your privacy review needs, including our subprocessors and template agreements. We send it to your privacy officer on request.
If you believe patient information has been handled in a way it should not have been, write to support@pulseai.ca. A person reads every message and replies within one business day.
AI, privacy and compliance · 6 min read
What Canadian privacy law and the 2026 regulator guidance require of a clinic using an AI scribe: consent, assessments, vendor terms, recordings and training.
Read the guideAI, privacy and compliance · 3 min read
What Ontario's PHIPA expects of the software and vendors a clinic uses, and the questions to ask before any patient information moves.
Read the guideAI, privacy and compliance · 4 min read
What HIPAA requires before a US clinic lets an AI scribe or any AI tool touch protected health information: the BAA, the Security Rule, training and breaches.
Read the guideWe walk through the data flow for your clinic, the agreement your jurisdiction requires, and anything your team needs answered before going live.
