Skip to content

Collection · 10 articles

Trust, privacy & legal

Where data lives, the subprocessors and the agreements.

  1. Policy The free clinic website and minor enhancements Does Qlynic really build a website for my clinic for free? Yes, for subscribing clinics — Schedule D of the Subscriber Agreement scopes a standard informational site (home, services, practitioners, contact and hours) connected to your Qlynic online booking, built at no charge with hosting included while you subscribe; the clinic owns the content, branding, domain and site files and can request handover within 90 days of leaving; and small changes to Qlynic are built at no charge where the work is minor, safe and general.
  2. Policy Cookies and analytics What cookies does Qlynic use, and is there tracking? Essential cookies keep you signed in, protect against request forgery and remember security state; preference cookies remember settings; first-party analytics measure how the platform is used — with no third-party advertising networks, no ad pixels, no cross-site tracking and no sharing of analytics with advertisers; and this assistant sets a cookie on qlynic.com so your conversation follows you between pages until you start a new chat.
  3. Policy Who owns the data Who owns my clinic's data in Qlynic? Your data stays yours — as between the parties the clinic owns Customer Data and Arxeon claims no ownership of it; Arxeon holds only a licence to host, process, transmit and display it to provide, secure, support and improve the service, may use statistical or de-identified information that identifies no one, never sells personal or health information, never uses it for advertising or to train AI models, and makes it exportable in machine-readable formats on request.
  4. Live Where the data lives Where is my clinic's data stored? The system of record — health information, charts, claims and backups — is hosted in Microsoft Azure's Canadian regions (Canada Central, Microsoft's Toronto region); specific, purpose-limited processing crosses the border — SMS and email delivery, AI processing in the United States, payment processing with Stripe, live telehealth media, encrypted traffic through security and delivery networks — and Arxeon will not otherwise store health information outside Canada without the clinic's written authorization.
  5. Policy Custodians, information managers and the HIA Who is the custodian of patient records, and what is Arxeon's role under the Health Information Act? The clinic and its physicians remain the custodians of health information; Arxeon is the clinic's information manager under section 66 of Alberta's HIA (and, for H-Link claims, an affiliate of the custodian) under the Information Manager Agreement in Schedule A — handling health information only to provide the service or on the clinic's instructions, never selling it, never using it for advertising or to train AI, keeping the safeguards listed there, notifying confirmed breaches within 72 hours, supporting the clinic's PIA, and returning or destroying data on exit.
  6. Policy Retention, export and deletion How long is data kept, and what happens to it when a clinic leaves? While a clinic subscribes its data stays; when the relationship ends there are 60 days to export Customer Data in machine-readable formats, deletion from live systems within 90 days and backups overwritten within a further 35 — billing records live 6–7 years under tax law, security and audit logs up to 24 months, support correspondence up to 24 months after resolution, and opt-out records indefinitely so they keep working.
  7. Policy Consent rules for the AI Scribe What consent is required before using the Ambient Scribe? Schedule C of the Subscriber Agreement requires the clinic to obtain the patient's informed, contemporaneous consent (or a guardian's for a minor) before the scribe starts, to record the attestation the platform prompts for, to stop on withdrawal, and to honour a standing do-not-record preference; recording without valid consent is prohibited and the clinic's sole responsibility, every draft stays a draft until a qualified member reviews and saves it, and Arxeon may suspend the feature for a clinic using it without consent.
  8. Live Certifications and compliance status Is Qlynic SOC 2, ISO 27001, HIPAA or PIPEDA certified? None yet — SOC 2 is in preparation and that is the whole of the status; nobody has audited Qlynic against anything, ISO 27001, HITRUST and PIPEDA certification are not held or claimed, and what can be checked instead are the facts: Azure Canada Central hosting, Arxeon's H-Link accreditation, the Alberta corporate registry number, and a once-a-year security summary and questionnaire under the Information Manager Agreement.
  9. Live The subprocessors Which third parties process Qlynic data, and where? Schedule B of the Subscriber Agreement names nine — Microsoft Azure (hosting, Canada Central), Microsoft Azure AI Speech (scribe speech-to-text, Canada Central), Cloudflare (network security, global edge), Stripe (payments, Canada/US), Twilio (SMS, US), Twilio SendGrid (email, US), Anthropic (AI, US), Daily.co (telehealth media, US/global edge) and MaxMind (IP geolocation, a local lookup with no data sent) — each with its processing location and the data it touches, and adding one that handles health information takes 30 days' notice with a right to object.
  10. Policy The Terms of Service, in short What are the key points of the Qlynic Terms of Service? Accounts for people 18+ operating under a licensed health professional or organization; Qlynic is software that never diagnoses or replaces clinical judgment and is not for emergencies; per-doctor subscriptions renew until cancelled with taxes added where required; acceptable use forbids scraping, reverse engineering, circumventing limits or building a competing product from outputs; liability is capped at the fees paid in the previous 12 months; Alberta law and Calgary courts govern; material changes get 30 days' notice; and if documents conflict the Subscriber Agreement, then the AHCIP Billing Terms, then the Terms prevail.

Still stuck?

A person in Calgary reads every ticket.

Weekdays 08:00–18:00 Mountain Time. First reply under six business hours is the target the desk works to. Or write to support@qlynic.com.

Open a ticket Book a walkthrough