Privacy Policy · Synapsis Health

Introduction

This Privacy Policy explains how Synapsis ML Inc. (“Synapsis,” “we,” “us,” or “our”) handles information in connection with the Synapsis Health mobile application (the “App”). We have designed the App around a principle of data minimization: the App is built so that your health readings stay on your device, and we do not store your health information on our servers.

The App is provided to you through a program administered by your healthcare provider or primary care network (the “Provider”). For the purposes of applicable health privacy legislation in Alberta, the Provider is the custodian of your health information, and Synapsis acts as an information manager on the Provider’s behalf. This Policy describes the App’s data practices; your Provider’s own privacy practices also apply to your care.

Summary

We do not require you to create an account. Access is code-based.
Images you capture of your devices are processed on your device and are not transmitted to or stored by us.
Your health readings remain on your device and within the report you generate and submit.
We do not sell your information, and we do not use it for advertising.
The limited technical data we hold is anonymized and stored in Canada.

Information We Do Not Collect

Because of how the App is designed, we do not collect or store the following on our servers:

Your name or other direct identifiers;
Your date of birth or other confirmatory data (this is verified on-device or in-session and not retained by us as an identifiable record);
Images captured by the App (these are processed on your device and discarded);
Your individual health readings or the contents of the reports you generate; or
Your email address after it has been used to deliver an access code (see Section 5).

Information We Collect

We collect a limited set of technical and usage information that does not identify you by name:

Access code and status: The App uses a code, issued through your Provider, to grant access. We store the code and its status (for example, issued or activated) and the associated site, so your Provider can administer the program. The code is a pseudonymous identifier and is not, by itself, your name.
Session tokens: When you use the App, we issue a signed session token to keep you signed in. Tokens contain only non-identifying session information.
Usage events: We record anonymized events describing that an action occurred — for example, that a reading was recorded (and in which category: glucose, blood pressure, or weight) or that a report was generated, together with a timestamp. These events do not contain your reading values.
Device permissions data: The App requests access to your camera to capture device readings and, optionally, to send you notifications. See Section 5.

Camera, Images, and Notifications

Camera. The App uses your device camera to photograph the display of your health device so it can read the number shown. This processing happens on your device. The captured image is used only to extract the reading and is then discarded. Images are not uploaded to our servers and are not stored by us.

Code delivery by email. If your Provider delivers your access code by email, the email address is used solely to transmit the code and is purged immediately afterward. We do not retain it.

Notifications. With your permission, the App may send reminders to take a reading or to submit your report. You can disable notifications at any time in your device settings.

How We Use Information

We use the limited information we hold to:

Provide and operate the App and authenticate your access;
Enable your Provider to administer the program and see anonymized participation and usage metrics;
Maintain the security and integrity of the App; and
Understand aggregate, de-identified usage to improve the App.

Disclosure of Information

We disclose information only in the following limited circumstances:

To your Provider. We make anonymized participation and usage metrics available to your Provider, who administers the program and is the custodian of your health information.
To service providers. We use infrastructure providers to host our systems within Canada. They process data on our behalf under confidentiality and security obligations.
For legal reasons. We may disclose information if required by law, regulation, or valid legal process, or to protect the rights, safety, or security of users, the public, or Synapsis.
Business transfers. If Synapsis is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

Report Submission and Third-Party Portals

When you submit a report, you do so by uploading it through your Provider’s patient portal or another destination you choose. Those portals are operated by third parties and governed by their own privacy practices. Once your report leaves the App, its handling is subject to your Provider’s and the portal operator’s policies, not this Policy.

Data Retention

We retain the limited technical data described in Section 4 only for as long as necessary to operate the program and for legitimate administrative purposes, after which it is deleted or further anonymized. Email addresses used for code delivery are purged immediately after transmission. Your health readings are retained on your device and within the reports you generate, under your control; deleting the App removes the readings stored on your device.

Data Location and Security

Location. The backend infrastructure supporting the App is hosted within Canada.

Security. We use technical and organizational safeguards designed to protect information, including encryption of data in transit and at rest, role-based access controls, and audit logging. No system can be guaranteed to be perfectly secure, but the App is designed to minimize risk by not holding your health information in the first place.

Your Choices and Rights

Because we do not hold your health information or identify you by name, most of your health data is under your direct control on your device. Depending on your location and applicable law, you may have rights to access, correct, or request deletion of personal information held about you. You can:

Delete the health readings on your device by deleting the App;
Disable camera or notification permissions in your device settings; and
Contact us or your Provider to request deletion of the pseudonymous access record associated with your participation, or to ask questions about your information.

Requests relating to your health information held by your Provider should be directed to your Provider as the custodian of that information.

Children's Privacy

The App is intended for individuals 18 years of age or older, or for enrolled patients with the involvement of their healthcare provider and, where applicable, a parent or legal guardian. The App is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has used the App in a manner that provided information to us, contact us and we will take appropriate steps.

International Users

The App is intended for use within Canada in connection with Canadian healthcare programs. If you access the App from outside Canada, you understand that the App’s infrastructure is located in Canada and that Canadian law governs its operation.

Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the effective date and, where appropriate, provide notice within the App. Your continued use of the App after changes take effect constitutes acceptance of the revised Policy.

Contact Us

For privacy questions or requests, contact:

Synapsis ML Inc. · 103, 6030 88 Street NW, Edmonton, Alberta, T6E 6G4, Canada
Privacy: privacy@synapsismedical.com
Support: support@synapsismedical.com