Privacy Policy & Statement of Information Practices

Effective May 24, 2026

Introduction

Northstar Medical operates a secure, AI-assisted virtual care platform (including web portal and native iOS/Android apps) that connects patients with Nurse Practitioners in Ontario. This Privacy Policy explains how we collect, use, disclose, and protect your personal health information (PHI) in accordance with the Personal Health Information Protection Act, 2004 (PHIPA) and other applicable laws.

This document also serves as our public Statement of Information Practices as required under PHIPA.

What Information We Collect

Personal Health Information (PHI) includes:

  • Name, date of birth, contact information, and health card number
  • Medical history, medications, allergies, symptoms, and care records
  • Information provided during AI-assisted assessments
  • Documents, lab results, imaging, and consultation records (video, voice, messaging)
  • Billing and payment information (processed securely via Stripe)

Other Information: Device and usage data for security and platform functionality.

How We Use Your Information

We use your information to:

  • Provide and improve virtual care services, including AI-powered diagnostic support
  • Enable Nurse Practitioners to review and approve AI suggestions
  • Schedule appointments, conduct consultations, and support secure messaging
  • Process payments and maintain accurate records
  • Comply with legal and regulatory obligations (PHIPA, CNO standards)

We do not sell your personal health information.

How We Share Your Information

We share your PHI only when necessary and permitted:

  • With your Nurse Practitioner and circle of care for treatment purposes
  • With service providers under strict contracts (see Document 11 – Vendor Agreements Policy):
    • Microsoft Azure (hosting and AI)
    • Zoom (video, voice, SMS, fax)
    • Stripe (payments)
  • When required by law or to protect health/safety in emergencies

All service providers are contractually bound to protect your information.

Your Rights

You have the right to:

  • Access and receive a copy of your PHI
  • Request corrections to inaccurate information
  • Withdraw consent for certain uses of your information
  • Request restrictions on how we use or disclose your PHI (including Lock Box requests)
  • File a complaint with us or the Information and Privacy Commissioner of Ontario (IPC)

To exercise these rights, contact our Privacy Officer at general@northstarmed.ca.

How We Protect Your Information

We use robust safeguards including:

  • Encryption of data at rest and in transit
  • Multi-factor authentication and role-based access controls
  • Comprehensive audit logging of all PHI access
  • Regular security testing and monitoring
  • Mandatory review and approval by Nurse Practitioners of all AI-generated suggestions

AI Use

AI (MedGemma) is used only as a support tool. All AI suggestions are reviewed and approved by a licensed Nurse Practitioner before being shared with you. Explicit consent is obtained for AI-assisted features.

Data Retention

We retain your PHI for as long as necessary to provide care and meet legal obligations (generally a minimum of 10 years after your last interaction — see our Data Retention Policy for details). When no longer needed, information is securely destroyed or de-identified.

Changes to This Policy

We may update this policy. Material changes will be notified via the platform or email. The most current version is always available in the patient portal.

Contact Us

Northstar Medical

Email: general@northstarmed.ca

You may also contact:

Information and Privacy Commissioner of Ontario (IPC)

www.ipc.on.ca