Privacy policy

Who we are and what this policy covers

C-Encode Inc. ("C-Encode", "we") makes DXA Encode and related software for medical imaging. This policy explains how we handle personal information about people who visit c-encode.com, contact us, or work with us as customers, prospects and suppliers. For that information we are responsible under the Personal Information Protection and Electronic Documents Act (PIPEDA).

It also explains our role with patient information. When a clinic uses DXA Encode, the clinic is the health information custodian and decides how its patients' information is used. We act only as its service provider, under our contract with the clinic and provincial health privacy laws such as Ontario's PHIPA.

Information we collect

• Details you give us: your name, work email, job title, company and phone number when you fill in a form, email us or book a meeting.
• Business contact details of the people we work with at customers and suppliers, and our correspondence with them.
• How you use this website: pages viewed, the page that referred you, your browser and device, and your approximate location, collected with cookies from Google Analytics and HubSpot.

How we use it

• To answer your questions, send the material you asked for, and arrange demos.
• To provide, support and bill for our services, and to manage our relationship with customers and suppliers.
• To send occasional updates about our products. Every marketing email has an unsubscribe link.
• To understand how the website is used and improve it, and to protect our forms from spam.
• To meet our legal obligations.

We do not sell personal information.

Who we share it with

We share personal information only with service providers that help us run the business, under contracts that limit their use of it to providing services to us:

• Amazon Web Services, which hosts our applications and this website.
• HubSpot, our customer relationship and email platform.
• Google Analytics, for website statistics.
• Microsoft 365, for email and documents.
• Cloudflare Turnstile, which protects our forms from automated abuse.

Some of these providers process information outside Canada, including in the United States, where it may be accessible to authorities under local law. We may also disclose information where the law requires it.

Patient information

When C-Encode hosts DXA Encode for a clinic, patient information is stored and processed in Canada, in Amazon Web Services' Canada (Central) region. It is encrypted in transit and at rest, access is restricted to the people who need it to provide the service and is logged, and it is used only to provide the service the clinic has asked for. It is never used for marketing.

If you are a patient and want to see, correct or delete your health information, please contact your clinic, which decides on these requests. If you contact us instead, we will pass your request to your clinic within two business days and let you know we have done so.

How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires, and then delete it securely. Records of privacy requests are kept for three years. Patient information is kept and deleted as the clinic's contract with us sets out.

How we protect it

We run an information security and privacy program with access controls, multi-factor authentication, encryption, logging and monitoring, staff training, and regular review. Our Trust Centre has more detail.

Cookies and your choices

This website uses cookies from Google Analytics and HubSpot to measure visits and to connect form submissions to the pages you viewed. You can block or delete cookies in your browser settings, or use Google's opt-out browser add-on for Analytics. The website still works without them. You can unsubscribe from our emails at any time using the link in each message.

Your rights and how to make a request

You can ask to see the personal information we hold about you, how it has been used and who it has been shared with, to correct it, to withdraw your consent, or to have it deleted where we do not need to keep it by law. We may ask you to confirm your identity first. We answer within 30 days, free of charge, and if we cannot meet a request we will explain why in writing.

Use this form, or email privacy@c-encode.com directly:

Questions and complaints

Our privacy officer is responsible for this policy. Contact them at privacy@c-encode.com or by mail at C-Encode Inc., Attention: Privacy Officer, 36 Toronto Street, Suite # 850, Toronto, Ontario, M5C 2C5, Canada.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Changes to this policy

We review this policy at least once a year. If we change it, we will post the new version here with a new effective date.