Privacy Policy
FormsMD is a service for licensed physicians and their practices. Physicians use it to draft, complete and send medical forms. Because that work involves patient records, we treat privacy as the core of the product, not a policy attached to it.
Where your data lives
All application data — accounts, patient details, uploaded charts, drafted forms and faxes — is stored and processed on servers located in Ontario, Canada. The artificial-intelligence drafting runs on hardware we operate in the same location. Patient information is never sent to a third-party AI provider.
Roles under PHIPA
Under Ontario's Personal Health Information Protection Act, the physician or practice using FormsMD is the health information custodian. FormsMD acts as an agent and electronic service provider to that custodian: we handle personal health information only as needed to provide the service, on the custodian's instructions, and we do not use it for any other purpose.
What we collect
- Account information — the physician's name, email address, CPSO number, practice address and billing details needed to run the subscription.
- Patient information entered by the physician — names, dates of birth, health-card numbers and the clinical content of uploaded charts and drafted forms. This is stored encrypted at rest and is visible only to the practice that entered it.
- Usage records — which features were used and when, so we can meter the monthly forms allowance, support you, and keep the service reliable. Usage records never contain patient information.
Payment
Subscription payments are processed by Helcim, a Canadian payment processor. Card numbers are entered directly into Helcim's secure form and are never stored on FormsMD servers; we keep only a payment token and the last four digits for your receipts.
Transactional email (sign-in links, password resets, receipts) is delivered through SendGrid. These messages contain no patient information.
Retention and deletion
Your practice's data stays available for as long as your account is active. When you close your account, we delete your patient data within 30 days, except where a copy must be retained to meet a legal obligation. You can export your forms at any time before closing.
Security
Data is encrypted in transit (TLS) and at rest. Access inside FormsMD is limited to the practice that owns the data and to named support staff acting on a documented support request. We log administrative access and review it.
Cookies
The marketing site at formsmd.ca sets no cookies and uses no analytics trackers. The application at app.formsmd.ca uses a session cookie strictly to keep you signed in.
Your rights
Patients exercise their access and correction rights through their physician, who is the custodian of the record. Physicians and practice staff can review, correct or delete their own account information from Settings, or by contacting us.
Contact
Privacy questions or concerns: support@formsmd.ca. If you are not satisfied with our response, you may contact the Information and Privacy Commissioner of Ontario.