Privacy Policy

This Policy applies to personal information collected through our website, clinic portal, admin systems, email communications, and support channels. It does not apply to third-party websites or services that we do not control.

Clinic users: When you register a clinic or staff account, Orthix is responsible for the personal information we collect about you and your organization for account management.

Patient information: When your clinic submits orders, Orthix processes patient identifiers, clinical details, foot photos, scan files, and related order data on your instructions to manufacture orthotics. Your clinic is responsible for informing patients and obtaining consents required by law and professional standards.

We may collect the following categories of information:

• Account & clinic data: name, business email, phone, clinic name, billing and shipping addresses, business registration documents, verification status, and login metadata.
• Order & clinical workflow data: patient name, date of birth, contact details, assessment answers, orthotic specifications, internal notes, shipping preferences, and order history submitted by your clinic.
• Foot impression media: photographs, uploaded files, 3D scan or model outputs, analysis outputs generated to support ordering, and related technical metadata needed for fabrication and quality review.
• Communications: messages sent through contact forms, support email, and admin inbox replies.
• Technical data: IP address, browser type, device information, cookies, page-visit or usage logs for security, performance, and service improvement.
• Payment-related data: billing contacts and transaction references (full payment card data is not stored on our Platform when processed by third-party processors).

We use personal information for legitimate business purposes, including:

• Creating and managing clinic accounts and verifying business eligibility.
• Processing, manufacturing, shipping, invoicing, and supporting orthotics orders (including applying shipping rates based on monthly order volume).
• Running operational tools that assist ordering (for example photo checks or previews) under your clinic's instructions.
• Providing customer support and service notifications.
• Securing the Platform, detecting fraud, and troubleshooting errors.
• Complying with legal, regulatory, and professional obligations.
• Improving our services through aggregated, de-identified analytics where possible.
• Sending service-related emails (account, orders, security). Marketing emails only where permitted and with opt-out options.

We collect, use, and disclose personal information with consent where required, or without consent where permitted by law (for example, when necessary to fulfill a contract with your clinic, for fraud prevention, or to comply with legal obligations).

You may withdraw consent for optional communications at any time. Withdrawal may limit certain features. Clinic administrators are responsible for patient consent before uploading patient data.

We do not sell personal information. We may disclose information to:

• Service providers under contract: cloud hosting and database (e.g., Supabase), email delivery (e.g., Resend), application hosting (e.g., Render), image or AI processing vendors used for operational ordering tools, analytics, and IT security vendors who process data only on our instructions.
• Manufacturing, laboratory, and logistics/shipping partners involved in fulfilling and delivering your orders.
• Professional advisors (legal, accounting) under confidentiality obligations.
• Law enforcement or regulators when required by law or to protect rights, safety, and security.
• Successors in the event of a merger, acquisition, or asset sale, subject to this Policy.

Some service providers may store or process data in Canada, the United States, or other countries. Where personal information is transferred outside Canada, we require contractual and organizational safeguards appropriate to the sensitivity of the data, consistent with PIPEDA accountability requirements.

We retain personal information only as long as necessary for the purposes described in this Policy, to meet legal and professional record-keeping requirements, and to resolve disputes. Order and clinical files may be retained for a period consistent with healthcare manufacturing and tax requirements unless deletion is requested and permitted by law.

When information is no longer required, we securely delete or de-identify it.

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of information, including access controls, encryption in transit, role-based permissions, logging, and secure development practices. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Clinic users must protect account credentials and promptly report suspected incidents to info@orthix.ca.

Subject to applicable law, individuals may request access to, correction of, or deletion of personal information we hold about them, or withdraw consent where applicable. We will respond within a reasonable time and may require identity verification.

Patients seeking access to health information should generally contact their clinic first. Clinics may contact us to facilitate corrections related to orders on the Platform.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

We use essential cookies and similar technologies to keep you signed in, protect accounts, and remember preferences. We may use analytics cookies to understand aggregated usage. You can control non-essential cookies through browser settings; disabling essential cookies may affect Platform functionality.

The Platform is not directed to children for self-registration. Where pediatric patient information is submitted by a clinic for clinical care, it is processed solely for order fulfillment under the clinic's authority.

If we become aware of a security incident involving personal information that creates a real risk of significant harm, we will notify affected organizations and individuals as required by applicable Canadian breach notification rules and take steps to mitigate harm.

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes will be communicated through the Platform or email where appropriate.

Privacy Officer / Data protection inquiries:

Orthix (Pioneers Orthomedix)

101-8380 St. George Street

Vancouver BC, V5X 3S7

Email: info@orthix.ca

Phone: +1 (604) 447 2880