Privacy & PHIPA Notice

Last updated: 2026-05-06.

1. Health Information Custodian

Cloud Care Clinics Inc. (operating as Cloud Care Clinics) is a Health Information Custodian under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). Address: 55 Dundas St E, Toronto, ON M5B 1C6.

2. Privacy Officer

Our designated Privacy Officer is Amir Khela.

• Email: admin@cloudcareclinics.ca
• Phone: 416-361-6000
• Mail: Privacy Officer, 55 Dundas St E, Toronto, ON M5B 1C6

3. What we collect

• Identifiers: full legal name, date of birth, sex assigned at birth, contact details, health card number (optional).
• Travel itinerary: destinations, dates, purpose, planned activities.
• Health history: conditions, medications, allergies, vaccination history, pregnancy/breastfeeding status (where applicable).

4. Why we collect it (purpose)

Your information is collected under PHIPA s. 18 — implied consent for circle-of-care assessment — to allow your treating physician to perform a complete pre-travel risk assessment and recommend appropriate vaccinations and medications. We will not use your information for any other purpose without your express consent.

5. How we store and protect it

• Encryption in transit: TLS 1.2+ for all submissions.
• Encryption at rest: Vercel Blob storage with provider-managed encryption.
• Access control: Only authorized clinic staff and the treating physician access the records.
• Audit trail: every submission generates a hashed-IP access log entry separate from the record content.

6. Disclosure to authorized agent (s. 17)

Records are received by an authorized agent at Cloud Pharmacy under a PHIPA s. 17 information-management agreement. The agent is bound by the same confidentiality obligations as the custodian.

7. Your rights under PHIPA

• Right of access (s. 52) — request a copy of your record. We respond within 30 days.
• Right of correction (s. 55) — request correction of inaccurate or incomplete information.
• Right to withdraw consent at any time — email the Privacy Officer.
• Lockbox provision (s. 19) — restrict any element of your record from secondary uses; tickbox available on the consent form.
• Right to know who has accessed your record — request the audit log.

8. Breach notification

If we discover an unauthorized use, disclosure, or loss of your personal health information, we will notify you within 24 hours and report to the Information and Privacy Commissioner of Ontario where required by law.

9. Right to complain to the IPC

If you believe your privacy rights have been violated, you may file a complaint at no cost with the Information and Privacy Commissioner of Ontario:

• Web: https://www.ipc.on.ca
• Phone: 1-800-387-0073

10. Retention

Travel-intake records are retained for 10 years per College of Physicians and Surgeons of Ontario record-keeping standards, after which they are securely destroyed.

11. Cookies and analytics

This site uses only strictly-necessary cookies for form-state persistence (saved locally in your browser, never transmitted). No third-party analytics are loaded on the intake form.

12. Updates to this notice

If we materially change this notice, we will update the "Last updated" date and, where required, contact you for fresh consent.