Your clinic’s operating layer, a server-as-a-software.

CASL governs every commercial electronic message — appointment reminders, recall campaigns, referral follow-ups, marketing emails — that a clinic sends from Canada or to Canadian recipients. Medfair's patient email tool captures the express or implied consent record at the point of collection, stamps every send with your clinic's identification and physical address, and includes a one-click, always-honoured unsubscribe link. Suppression is enforced platform-wide, so a patient who opts out of one workflow is automatically excluded from the rest.

PIPEDA sets the ten fair-information principles every Canadian private-sector organization must follow when handling personal information — accountability, identifying purposes, meaningful consent, limiting collection and use, accuracy, safeguards, openness, individual access, and challenging compliance. Medfair operationalizes each principle: clinic data is stored in Canadian Supabase regions, encrypted in transit and at rest, scoped behind row-level security and audit logs, and a signed Data Processing Agreement is available on request for every plan tier.

PHIPA is Ontario's health-privacy statute and applies to the personal health information that flows through orthotics, prosthetics, and bracing practices as a normal part of patient care. Medfair treats clinic users as the health-information custodian and Medfair as the electronic service provider — with the safeguards that role demands: tenant-isolated storage, role-based access, immutable audit trails, breach-notification tooling, and the ability to return or destroy clinic data on contract end. PHIPA does not treat Medfair as your clinical EHR; we recommend keeping regulated charting in your designated record system.

For clinics operating in or contracting with the United States, HIPAA's Privacy, Security, and Breach Notification Rules govern any protected health information that Medfair processes on your behalf. The platform's administrative, physical, and technical safeguards — least-privilege access, encryption, audit logging, secure backup, and incident response — are designed to support a Business Associate Agreement (BAA), which Medfair can sign with eligible US-operating clinics on request before regulated PHI is loaded into the platform.