Privacy notice
EDFlow helps you follow your emergency visit. This notice explains, in plain words, what information it uses, who can see it, what it never shows, how long it is kept and what you can do.
Version 1.0Effective September 24, 2026
The short version
- We use the least information needed to show you your visit.
- We never show test results. Your care team tells you about them in person.
- Your family sees only what you choose to share, and never your tests.
- Notifications and text messages never say which hospital you are in or anything about your health.
- Your hospital is responsible for your information. We work for your hospital.
What we collect
From the hospital's system, we receive only what is needed to show your visit:
- your first name and the first letter of your last name, and your age
- the step of your visit and where you are in the department
- the names and roles of the people caring for you
- the tests you are having and how far along they are (not the results)
- whether you are going home, staying in hospital or moving to another hospital
From you, we keep your language, the requests you send (like "I need water"), and a phone number only if you add one to get text messages. Your number is kept secret and deleted when your visit updates end.
Who sees what
| Who | What they see |
|---|---|
| You | Your visit steps, your care team, your tests and how far along they are, your requests and tasks |
| Family you choose | The step of your visit, a waiting estimate and the first names and roles of your care team. Never your tests or results |
| Your care team | What they need to care for you and answer your requests |
| The hospital's privacy office | A record of every time someone looked at your visit |
Every time a person opens your visit, it is written in a log that the hospital's privacy office can check.
How long we keep it
| Information | Kept for |
|---|---|
| Your visit details (name, steps, tests, care team, most requests) | 30 days after you leave, then turned into numbers that can't identify you. Your hospital can choose between 7 and 90 days. |
| Records of care, such as urgent requests and delay notices | As long as your hospital keeps health records (often 10 years) |
| Phone numbers and access codes | Deleted when your visit updates end |
| The log of who looked at your visit | At least 2 years |
| Conversations with the assistant, if you use it | 7 days after your visit updates end |
Who is responsible
Your hospital is the health information custodian under Ontario's Personal Health Information Protection Act. EDFlow works for your hospital as its agent: we use your information only to run this service, and only as your hospital directs.[1]
How EDFlow uses AI
Your hospital may turn on an assistant that answers questions about your visit. If it does:
- The assistant can see the same visit information you see. It never sees your full name, date of birth, health card number or results.
- It can't give medical advice or explain results. It can be wrong, so ask your care team about anything important.
- Your care team does not read your conversation. If you say you might hurt yourself or you feel much worse, your care team is alerted.
- A small safety team outside your care team may review some conversations to keep the assistant safe.
- Only if your hospital approves, the assistant uses AI providers in the United States that keep nothing and don't learn from your questions.
- You can hide the assistant in settings, or ask staff to turn AI off for your visit.
Where information is stored
Hospital information is stored in Canada. The companies below help us run the service. None of them can see your health information except the Canadian database host.
| Company | Purpose | Data | Where | Applies |
|---|---|---|---|---|
| Amazon Web Services (self-hosted Convex, RDS, KMS) | Database and backend for hospital tenants | Visit data needed to run the service (minimum necessary) | Canada (ca-central-1; ca-west-1 for disaster recovery) | Always |
| Convex, Inc. | Managed backend for the showcase and development | Synthetic data only | United States | Demonstration only |
| Vercel | Web delivery and server functions | No PHI by design; authentication tokens in transit | Functions in Montréal (yul1); global CDN for static files | Always |
| Expo Push (with Apple APNs and Google FCM) | Push notifications | Device push tokens; generic notification text | United States | When turned on |
| Twilio | SMS (share links, updates, verification codes) | Phone numbers; generic message text with no hospital or patient name | United States | When turned on |
| Resend | Email (staff invitations, password resets, summary links) | Email addresses; generic message text | United States | When turned on |
| Microsoft Entra ID | Staff single sign-on | Staff identity only | The hospital's own tenant | When turned on |
| Vercel AI Gateway (Anthropic, Amazon Bedrock, Google Vertex AI) | AI features, zero data retention | Scrubbed prompts; no identifiers | United States (zero data retention) | AI phase 2 only |
| OpenAI (speech transcription) | Web voice input in the showcase | Audio from synthetic demonstrations | United States | Demonstration only |
Your choices and rights
- See your information. Ask your hospital's privacy office for a copy of your visit record.
- Fix your information. If something is wrong, ask a staff member or the privacy office.
- Stop sharing with family. Tap "Stop sharing" on your phone at any time. It works right away.
- Stop using it. Close the page or sign out. Your care continues the same way.
- Complain. Contact your hospital's privacy office or privacy@edflow.space. You can also contact the Information and Privacy Commissioner of Ontario.[2]
Sources
- [1]Personal Health Information Protection Act, 2004 (opens in a new tab) · Government of Ontario
- [2]Digital Health under PHIPA: Selected Overview (opens in a new tab) · Information and Privacy Commissioner of Ontario