AlphaDx Clinic Privacy Policy
Effective date: August 13th 2026
AlphaDx Clinic (“AlphaDx”, “we”, “us”, or “our”), located at Unit 3, 366 Main St, Steinbach, Manitoba, is committed to protecting the privacy and confidentiality of the personal information and personal health information we collect. This policy explains what we collect, why we collect it, who we share it with, and the rights you have over it.
Under The Personal Health Information Act (PHIA), AlphaDx is a trustee of your personal health information. This means we remain responsible for it, even where a service provider processes it on our behalf.
This policy is written to reflect The Personal Health Information Act (PHIA), the Personal Information Protection and Electronic Documents Act (PIPEDA), the Standards of Practice of the College of Physicians and Surgeons of Manitoba (CPSM), and Canada’s Anti Spam Legislation (CASL) where marketing communications are concerned.
1. Information We Collect
Through Our Website
When you use our website, we collect the name, phone number, and email address you provide through our contact or booking forms. We do not collect a health card number through the website. Our website also uses cookies for technical function and to understand how visitors use the site, as described in Section 8.
At Our Clinic
When you receive care at AlphaDx, we collect personal health information directly from you and, where necessary, from other health professionals involved in your care. This can include your presenting concerns, health history, examinations, test results, and treatment provided.
This includes information generated by our diagnostic imaging equipment. We use GE ultrasound systems for obstetric and gynecological imaging, general imaging, and vascular imaging. Images and study data produced by this equipment are stored and organized through Velox, a Canadian based diagnostic imaging archive (also called a PACS, a Picture Archiving and Communication System), so that your images and reports can be reviewed and shared securely among your care providers.
AI Assisted Documentation
During some visits, AlphaDx uses an artificial intelligence assisted transcription tool, integrated with our electronic medical record system, to help our providers document your visit. Consistent with the CPSM guidance on responsible use of artificial intelligence in medicine, your express consent is obtained before any conversation is recorded. This consent is typically documented once and continues to apply to future visits, unless your provider believes your circumstances have changed. You may decline at any time, for any reason, and doing so will not affect the care you receive.
These recordings are retained as part of your medical record and are not deleted after your visit note is generated. Recordings are protected using the same administrative, technical, and physical safeguards described in Section 7.
Marketing Sign Up
If you choose to subscribe to communications from AlphaDx, we collect your name and email address for that purpose only.
2. Why We Use Your Information
We use your personal information and personal health information to:
- provide you with medical care and diagnostic services
- document, review, and evaluate the care and treatment provided to you
- communicate with you about appointments, results, and inquiries
- bill Manitoba Health for insured services, or process payment for services paid out of pocket
- refer you to other health professionals when appropriate
- maintain records as required by law and by CPSM standards
- protect the security of our clinic, our patients, and our staff
- send you communications you have subscribed to receive
3. Who We Share Your Information With
We share information with third party service providers only as needed to provide you with care, to operate our clinic, or to communicate with you. Our agreements with these providers require them to protect your information consistently with this policy.
| Provider | Purpose | Data Involved |
|---|---|---|
| Telus CHR | Electronic medical record, scheduling, and clinical documentation | Personal health information |
| Velox Imaging | Diagnostic imaging archive for ultrasound and radiology studies | Imaging studies and related personal health information |
| Manitoba Health | Billing for insured services | Information required for a claim |
| Stripe | Payment processing for out-of-pocket services | Name, contact details, payment amount |
| Mailchimp | Email communications for subscribers | Name and email address only |
| Bluehost | Website hosting | Website usage data and information you submit through our forms |
If you hold a valid health card from a Canadian province other than Quebec, we generally submit your claim to Manitoba Health under Canada’s interprovincial reciprocal billing agreement, using the information on your home province’s health card. Quebec does not participate in this agreement, so patients covered by Quebec’s health plan, along with patients who are visiting from outside Canada or are not covered by a Canadian provincial health plan, pay for services out of pocket through Stripe as described above.
We connect some of these systems to each other using application programming interfaces (APIs), for example between our website or booking tools and Telus CHR, and between our systems and Mailchimp, so that information you provide does not need to be entered more than once.
Responsibility for Third Party Systems
Telus CHR, Velox, Mailchimp, and Bluehost process information on our behalf, under agreements that require them to maintain their own administrative, technical, and physical safeguards for the information in their systems. Each of these providers is responsible for the security of its own systems. Under section 25 of PHIA, a provider that processes, stores, or destroys personal health information for us, or provides us with information management or information technology services, is called an information manager, and where we use one, our patient records are deemed by subsection 25(5) of PHIA to still be maintained by AlphaDx. We remain accountable for your information as required under PHIA and PIPEDA, but we are not liable for a security incident that originates solely within a provider’s systems where we have exercised reasonable diligence in selecting that provider and putting these contractual protections in place.
Manitoba Health and Stripe are not processing your information on our behalf in this same way. Once we submit a claim to Manitoba Health, or once you provide payment details directly through Stripe’s payment page, that information becomes subject to that organization’s own privacy practices, and we encourage you to review their privacy policies directly.
We do not sell your personal information. We may disclose personal health information without your consent where permitted or required by law, in an emergency threatening someone’s life, health, or safety, or where otherwise authorized under PHIA.
4. How Long We Keep Your Information
As required by section 17(1) of PHIA, AlphaDx maintains a written policy on the retention and destruction of personal health information, and this section reflects that policy. Rather than a period we have chosen ourselves, our retention period is the default set by Manitoba’s own regulatory framework for physicians and will track any change made to it.
Under subsection 11(3) of the CPSM Standards of Practice Regulation, patient records must be retained for a minimum of:
- ten years from the date of the last entry in the record, for adult patients
- ten years after the day the patient reached, or would have reached, 18 years of age, for patients who were minors
Your medical records, including diagnostic images and AI assisted conversation recordings described above, are retained for these periods. Under subsection 10(2) of the same Regulation, our separate record of appointments is retained for at least ten years after the date the appointment record was made.
This retention period applies to every patient treated at AlphaDx, regardless of which province, state, or country you live in or are visiting from. As a walk-in clinic, we see patients who are not Manitoba residents, and sometimes patients visiting from outside Canada. The duty to retain your record for this period follows from where your care was provided and where AlphaDx is regulated, not from where you happen to live, so the same period applies to every patient rather than varying by home jurisdiction.
Contact information collected through our website for general inquiries is kept only as long as needed to respond to you. Marketing contact information is kept only for as long as you remain subscribed. Mailchimp does not apply its own fixed retention period, so we remove your information from our marketing list once you unsubscribe or ask us to remove it.
Security camera footage is retained for 180 days and is then securely destroyed.
5. How We Keep Your Information Accurate
We take reasonable steps to keep your personal information accurate and current, but we rely on you to tell us if your contact information or other personal details change.
6. How We Protect Your Information
We use physical, administrative, and technical safeguards appropriate to the sensitivity of your information. This includes restricted access to our systems, password protection, and confidentiality obligations for all staff. Only staff and service providers with a legitimate purpose may access your information. As explained in Section 3, our service providers are contractually responsible for protecting information within their own systems.
AlphaDx uses video surveillance for security purposes at the clinic. Cameras are located in the waiting area, the two walkways, and outside at the back door area. Cameras do not cover examination rooms, treatment areas, or washrooms. Access to recorded footage is restricted to designated, high level privileged security administration staff only. Footage is retained for 180 days and is then securely destroyed.
No system is completely secure. If a privacy breach involving your personal health information creates a real risk of significant harm to you, we will notify you and the Manitoba Ombudsman, as required under section 19.0.1 of PHIA.
7. Where We Store Your Information
Information in Telus CHR, including your medical record and imaging studies stored through Velox, is encrypted and stored on servers physically located in Canada.
Our website is hosted with Bluehost, whose servers for our account are in the United States. Information collected through our website, including cookies and information submitted through our contact forms, may therefore be stored outside Canada and could be subject to United States law, including possible access by authorities under that country’s laws.
We may also use standard business productivity and communication software, such as tools provided by Microsoft, to support internal clinic administration.
8. Cookies
Our website uses cookies to help it function properly and to understand how visitors use the site. You can manage or disable cookies through your browser’s privacy settings, though some website features may not work as intended if you do.
9. Marketing Communications
You will only receive marketing or promotional emails from AlphaDx if you choose to subscribe. Every email we send includes a clear option to unsubscribe. You may also unsubscribe at any time by contacting our Privacy Officer. Once you unsubscribe, we remove your information from our marketing list.
10. Consent
Your consent is implied for the collection, use, and disclosure of your personal health information for the purpose of providing your care, and for sharing it with other health professionals involved in that care.
Written or express consent is required, and will be obtained, before we share your personal health information with a third party for a purpose other than your care and treatment.
Express consent is also required, and will be obtained, before any AI assisted conversation recording is made during your visit. You may decline for any reason, at any time, and doing so will not affect the care you receive.
You may withdraw your consent at any time by contacting our Privacy Officer. We will explain any consequences of withdrawing consent before you decide.
11. Your Rights
Subject to limited exceptions under PHIA, you have the right to:
- access your personal health information
- request a correction to your information
- withdraw or update your consent to the use or disclosure of your information
- object to, or complain about, our collection, use, or disclosure of your information
- be told why your information was collected, used, or disclosed
To exercise any of these rights, contact our Privacy Officer using the information in Section 13. We will respond within thirty days. If we cannot fully grant a request, for example because it would disclose another person’s information, we will explain why.
If you are the parent or legal guardian of a minor patient, you may generally exercise these rights on the minor’s behalf, subject to the minor’s own capacity to consent to their own treatment and to the protection of their privacy under PHIA.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or in the law. The effective date at the top of this policy will be updated when changes are made. Please check back periodically.
13. Contact Us and Complaints
If you have a question, concern, or complaint about this policy or about how your information has been handled, please contact:
Olubusola Apata, Privacy Officer
AlphaDx Clinic
Unit 3, 366 Main St, Steinbach, Manitoba
Phone: +1 365 440 5873
Email: privacy@alphadx.ca
If you are not satisfied with our response, you may contact the Manitoba Ombudsman, which oversees compliance with PHIA in Manitoba:
Manitoba Ombudsman
300, 5 Donald Street, Winnipeg, Manitoba R3L 2T4
Phone: 204 982 9130
Toll Free (Manitoba): 1 800 665 0531
Website: ombudsman.mb.ca