Privacy Policy

This Privacy Policy applies to personal information processed through:

• the Aptux website and related websites that link to this Privacy Policy;
• Aptux PMS and other Aptux software, applications, portals, and features;
• accounts created by clinics, healthcare professionals, staff, patients, and other authorized users;
• scheduling, clinical documentation, billing, payment, communication, and patient-management functionality;
• AI-enabled or machine-learning-enabled features offered through Aptux;
• customer support, sales, demonstrations, onboarding, training, surveys, marketing, and events; and
• other interactions with Aptux that reference this Privacy Policy.

This Privacy Policy does not govern the independent privacy practices of clinics, healthcare providers, payment processors, insurers, government health plans, or other third parties. Those organizations may have their own privacy notices and legal obligations.

Clinics and healthcare providers may use Aptux to collect, create, access, store, organize, transmit, or otherwise process patient information, including personal health information.

Where a clinic or healthcare provider controls a patient's health record, that clinic or provider remains responsible for its collection, use, disclosure, retention, and other handling of the information as required by applicable law. Aptux processes that information on behalf of, at the direction of, or as authorized by the clinic or provider, except where applicable law permits or requires Aptux to process information for another purpose.

Clinics and healthcare providers are responsible for:

1. having an appropriate legal basis or authority to collect and process patient information;
2. providing any notices and obtaining any consents required by law;
3. configuring user permissions appropriately;
4. ensuring information entered into Aptux is accurate and appropriate;
5. responding to patient requests concerning clinical records where they are responsible for those records; and
6. complying with professional, clinical, record-retention, and privacy obligations applicable to their practice.

Aptux will not knowingly use identifiable patient information for purposes unrelated to providing the Services unless permitted or required by applicable law and consistent with applicable agreements.

The information we collect depends on how a person interacts with Aptux and which Services are used.

3.1 Account and professional information

We may collect:

• name;
• email address;
• telephone number;
• username and account identifiers;
• password or authentication information;
• clinic or organization name;
• professional title, role, credentials, specialty, and provider identifiers;
• business address and contact information;
• account preferences and settings; and
• information provided during onboarding, support, or account administration.

3.2 Patient and health information

When a clinic or healthcare provider uses Aptux, the Services may process patient information such as:

• name and contact information;
• date of birth, age, sex, gender, or other demographic information;
• mailing address;
• emergency contact information;
• health card, insurance, patient, chart, or account identifiers;
• appointment and scheduling information;
• medical and health history;
• symptoms, diagnoses, assessments, treatment plans, clinical findings, outcomes, and progress;
• physiotherapy notes and other clinical documentation;
• medications, allergies, precautions, or relevant health conditions;
• referrals, forms, questionnaires, uploaded files, images, and correspondence;
• billing, insurance, payment, and claims information; and
• other information entered into or generated through the Services by authorized users.

Health information is sensitive information and is handled with safeguards appropriate to its sensitivity and as required by applicable law.

3.3 Payment and transaction information

If payments are processed through the Services, payment information may be collected or processed by Aptux and/or third-party payment processors. Depending on the payment method, this may include:

• billing name and address;
• payment method details;
• transaction amount and currency;
• transaction status;
• invoices, refunds, and payment history; and
• limited payment instrument information made available to Aptux by the payment processor.

Aptux may not directly store complete payment card numbers when payments are processed by a third-party payment processor.

3.4 Communications and support information

We may collect information you provide when you:

• contact customer support;
• request a demonstration;
• submit feedback;
• communicate with us by email, telephone, chat, or other channels;
• participate in surveys, promotions, or events; or
• otherwise communicate with Aptux.

3.5 Information collected automatically

When you use the Services, we may automatically collect technical and usage information, including:

• IP address;
• browser type and version;
• device type and operating system;
• device identifiers;
• login times and authentication events;
• pages, screens, or features accessed;
• referring URLs;
• approximate location derived from IP address;
• application events, error reports, and performance information;
• security and audit logs; and
• cookie and similar technology information.

We may use this information to operate, secure, troubleshoot, analyze, and improve the Services.

3.6 Information from third parties and integrations

We may receive information from third parties when a clinic enables an integration or when necessary to provide the Services, such as from:

• payment processors;
• calendar, communication, or authentication providers;
• insurers, billing services, or claims systems;
• electronic health or medical record systems;
• referral or healthcare platforms;
• analytics and infrastructure providers; and
• other integrations authorized by a clinic or user.

The information received depends on the integration and the permissions granted.

Subject to applicable law and our agreements with clinics, we may process information to:

• create, authenticate, secure, and administer accounts;
• provide and operate the Services;
• support appointment scheduling and reminders;
• enable clinical documentation and patient management;
• facilitate billing, invoicing, claims, and payments;
• provide customer support and respond to requests;
• maintain, troubleshoot, test, and improve the reliability and performance of the Services;
• personalize permitted aspects of the Services;
• provide AI-enabled features requested by authorized users;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, and other harmful activity;
• maintain audit trails and system logs;
• enforce our agreements and policies;
• comply with legal, regulatory, professional, tax, accounting, and reporting requirements;
• establish, exercise, or defend legal claims;
• communicate service, security, administrative, and account information;
• send marketing communications where permitted by law and subject to applicable opt-out rights;
• conduct analytics using information we are permitted to use for that purpose; and
• process de-identified or aggregated information as described in Section 12.

We will not use personal information for a materially new purpose without obtaining any consent or other authorization required by applicable law.

The legal basis or authority for processing personal information depends on the jurisdiction, type of information, relationship between the parties, and purpose of processing.

Where applicable, we may rely on:

• consent;
• performance of a contract or steps requested before entering into a contract;
• compliance with legal obligations;
• legitimate interests where recognized by applicable law and not overridden by applicable privacy rights;
• processing authorized by a clinic, healthcare provider, or other organization with lawful authority over the information;
• processing necessary to provide services as an agent, service provider, processor, or similar entity; and
• other grounds permitted or required by applicable law.

In Canada, Aptux's handling of personal information may be subject to federal and/or provincial privacy laws depending on the circumstances, including laws governing personal health information.

We do not sell identifiable patient health information.

We may disclose personal information in the following circumstances, subject to applicable law and contractual restrictions.

6.1 Clinics and authorized users

Information may be accessible to the clinic or organization responsible for an account and to users authorized by that organization. Clinics control their own workforce access and are responsible for assigning appropriate permissions.

6.2 Service providers and subprocessors

We may engage service providers to help us operate the Services, including providers of:

• cloud hosting and infrastructure;
• databases and storage;
• cybersecurity and monitoring;
• authentication;
• communications, email, and messaging;
• payment processing;
• customer support;
• analytics;
• software development and error monitoring; and
• AI or machine-learning infrastructure where permitted.

These providers are permitted to process information only as authorized for the services they provide and subject to contractual, confidentiality, privacy, and security obligations appropriate to the nature of the information.

Current subprocessor list: See our Subprocessors page for the current list of providers that may process information on our behalf.

6.3 Business transfers

Information may be disclosed as part of an actual or proposed merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar corporate transaction, subject to appropriate confidentiality and legal requirements.

6.4 Legal and safety requirements

We may disclose information where we reasonably believe disclosure is required or permitted by law, court order, subpoena, regulatory requirement, or other lawful process, or where appropriate to protect the rights, safety, security, or property of Aptux, our users, patients, or others.

6.5 With consent or direction

We may disclose information when the relevant individual, clinic, or authorized organization directs us to do so or provides valid consent.

Aptux may offer features powered by artificial intelligence, machine learning, large language models, or related technologies (“AI Features”).

AI Features may assist with tasks such as drafting, summarizing, organizing, extracting, classifying, or otherwise processing information. The exact functionality may change as the Services evolve.

7.1 Information processed by AI Features

When an authorized user chooses to use an AI Feature, information submitted to that feature may be processed to provide the requested functionality. Depending on the feature, this information may include clinical or health information.

Aptux will apply contractual and technical controls to AI service providers where appropriate and will limit disclosure of information to what is reasonably necessary to provide the relevant feature.

7.2 Human review and clinical responsibility

AI-generated content may be incomplete, inaccurate, or inappropriate. AI Features are tools intended to assist authorized healthcare professionals and are not a substitute for professional judgment.

Healthcare professionals remain responsible for reviewing, verifying, editing where necessary, and approving clinical documentation and decisions before relying on or placing AI-generated content into a patient record.

7.3 Model training

Aptux will not use identifiable patient information to train general-purpose artificial intelligence models unless such use is expressly permitted by applicable law, applicable agreements, and any consent or authorization that is legally required.

Any use of de-identified information for development, training, testing, evaluation, or improvement is subject to Section 12 and to applicable law and contractual restrictions.

We may use cookies, local storage, pixels, SDKs, and similar technologies to:

• keep users signed in;
• remember preferences;
• maintain security;
• prevent fraud;
• understand how the Services are used;
• diagnose errors and improve performance; and
• support permitted analytics or marketing.

Some cookies are necessary for the Services to function. Where required by law, we will request consent before using non-essential cookies.

You may be able to control cookies through your browser settings or any cookie-management tools we make available.

Cookie Notice: See our Cookie Notice for details about the cookies and similar technologies we use.

Aptux and its service providers may process or store information in Canada, the United States, or other jurisdictions in which Aptux or its authorized service providers operate.

When information is processed outside the province, state, or country where it was collected, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law enforcement, or governmental authorities in accordance with those laws.

Where required, Aptux uses contractual, organizational, and technical measures designed to protect information transferred across borders.

Primary hosting/data region: Canada.

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, to provide the Services, to comply with contractual and legal obligations, to resolve disputes, to enforce agreements, and to maintain legitimate business and security records.

Patient and clinical records may be subject to retention periods established by clinics, professional colleges, healthcare laws, insurers, or other regulatory requirements. Where Aptux processes patient information on behalf of a clinic, retention and deletion may be governed by the clinic's instructions and applicable law.

When information is no longer required, we will delete, destroy, anonymize, or otherwise dispose of it in accordance with applicable requirements and our retention practices. Information may remain temporarily in encrypted backups or disaster-recovery systems until overwritten or deleted in the ordinary course.

Account data retention after termination: Following termination, account holders have 30 days to export information they are required to retain. After that period, Aptux deletes or de-identifies remaining information within 90 days, except that patient and clinical records are retained for at least the minimum retention period required by applicable law and the college of physiotherapists (or equivalent regulator) in the clinic's province.

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, loss, theft, and disposal.

Depending on the nature of the Services and information, safeguards may include:

• encryption in transit and, where appropriate, at rest;
• access controls and role-based permissions;
• authentication controls;
• logging and monitoring;
• backups and disaster-recovery measures;
• vulnerability management and security testing;
• confidentiality obligations;
• employee and contractor access restrictions;
• vendor security assessments;
• incident-response procedures; and
• privacy and security policies and training.

No method of electronic transmission or storage is completely secure. We therefore cannot guarantee absolute security.

Users are responsible for protecting their credentials, using strong passwords, enabling available security features, and promptly notifying Aptux of suspected unauthorized access.

Security contact: getaptux@gmail.com

Aptux may create, receive, or use information that has been de-identified, anonymized, and/or aggregated so that it is not reasonably capable of identifying an individual, subject to applicable law and contractual restrictions.

Where legally permitted, Aptux may use de-identified or aggregated data to:

• operate, analyze, maintain, and improve the Services;
• understand usage and performance;
• conduct research and statistical analysis;
• develop, train, test, validate, evaluate, and improve artificial intelligence and machine-learning technologies for physiotherapy and related healthcare applications;
• improve clinical workflow and documentation tools; and
• develop new features, products, safety measures, and quality controls.

Before information is used for these purposes, Aptux will take steps designed to separate health information from information that identifies, or could reasonably be used to identify, an individual. Direct identifiers such as names, contact information, addresses, dates of birth, patient or account numbers, and similar identifiers will be removed, transformed, or separated where appropriate.

Aptux may replace identifiers with non-identifying codes or technical identifiers. Where appropriate, Aptux may also generalize, suppress, mask, aggregate, or otherwise transform data elements that could contribute to re-identification when combined with other information.

Where a linkage key or code is retained for an authorized operational purpose, Aptux will maintain that key separately and apply access restrictions designed to prevent unauthorized linkage to an individual.

Aptux will apply reasonable measures appropriate to the circumstances to reduce re-identification risk and will not attempt to re-identify de-identified data except where necessary to test the effectiveness of de-identification, to protect security or integrity, or where otherwise permitted or required by law.

This section does not authorize Aptux to use information in a manner prohibited by applicable health privacy law or by an agreement governing Aptux's role as a service provider, processor, agent, electronic service provider, or similar entity. Where those requirements impose stricter limits, those stricter limits control.

Depending on applicable law and the circumstances, individuals may have rights to:

• request access to personal information;
• request correction of inaccurate or incomplete information;
• request deletion or erasure where legally available;
• withdraw consent, subject to legal or contractual restrictions;
• object to or restrict certain processing where applicable;
• request information about how personal information has been used or disclosed;
• request portability where applicable;
• opt out of certain marketing communications; and
• make a complaint to Aptux or an applicable privacy regulator.

These rights are not absolute and may be subject to exceptions.

Patient requests

If Aptux holds patient information on behalf of a clinic or healthcare provider, the clinic may be responsible for responding to the request. We may refer the requester to the relevant clinic and assist the clinic as required.

Account users

Users may be able to review or update certain account information directly within the Services.

To submit a privacy request, contact getaptux@gmail.com.

We may take reasonable steps to verify identity and authority before completing a request.

Where permitted by law, Aptux may send information about products, features, events, or services.

Recipients may unsubscribe from marketing emails using the unsubscribe mechanism in the message or by contacting us. Even after opting out of marketing, users may continue to receive transactional, account, security, billing, or service-related communications.

Aptux is intended primarily for use by clinics, healthcare professionals, staff, and patients interacting with healthcare providers. Aptux is not intended for children to independently create general consumer accounts unless we expressly provide a feature designed for that purpose.

Clinics may use the Services to maintain records concerning minor patients where permitted by law. In those circumstances, the clinic or healthcare provider is responsible for obtaining any consent or authority required to collect and process the minor's information.

If you believe a child has provided personal information directly to Aptux in a manner not authorized by a parent, guardian, healthcare provider, or applicable law, contact us at getaptux@gmail.com.

Aptux maintains processes for identifying, investigating, containing, documenting, and responding to suspected privacy or security incidents.

Where required by applicable law or contract, Aptux will notify affected clinics, organizations, individuals, regulators, or other parties of qualifying breaches or incidents within the applicable time requirements.

Clinics should promptly contact getaptux@gmail.com if they suspect unauthorized access, use, disclosure, loss, or modification of information within Aptux.

The Services may contain links to or integrations with third-party websites, applications, or services. Aptux does not control the independent privacy practices of third parties.

Information provided directly to a third party is governed by that third party's terms and privacy practices. Users should review those practices before providing information.

Some browsers and devices provide “Do Not Track” or similar signals. Because there is not a universally accepted standard governing all such signals, the Services may not respond to every signal.

Where applicable law requires Aptux to recognize a particular privacy preference signal, we will do so as required.

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, technology, legal requirements, or other factors.

The updated version will be identified by the “Last updated” date. If changes are material, we may provide additional notice through the Services, by email, or by another appropriate method where required.

Continued use of the Services after an updated Privacy Policy becomes effective is subject to applicable law and does not replace any consent that must separately be obtained.

Questions, concerns, complaints, or privacy requests may be directed to:

Aptux
Email: getaptux@gmail.com
Website: aptux.ca

If you are a patient seeking access to or correction of a clinical record, please contact the clinic or healthcare provider responsible for your record first.

Aptux may provide supplemental privacy notices, contractual terms, or disclosures where required for particular provinces, states, countries, healthcare organizations, or categories of information. Those supplemental terms form part of this Privacy Policy where applicable.

Nothing in this Privacy Policy limits rights that cannot lawfully be limited or waived.