Privacy Policy

1. Introduction

MediPlace (mediplace.ca) is a business-to-business (B2B) marketplace for clinical space in Canada. The platform is owned and operated by Montserrat Technologies Inc., a company incorporated under the laws of Québec, with its principal place of business in Montréal, Québec.

We connect clinic owners who have available rooms with healthcare practitioners who need space to see their clients. MediPlace facilitates introductions between these parties — we are not a party to any rental agreement that may result from using our platform.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have regarding your information. It applies to all users of mediplace.ca, including clinic owners and healthcare practitioners.

We are committed to complying with Québec's Act respecting the protection of personal information in the private sector (commonly known as "Law 25" or "Loi 25"), the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and applicable privacy best practices.

2. Privacy Officer

Montserrat Technologies Inc. has designated a person responsible for the protection of personal information, as required under Law 25. For any questions, concerns, or requests related to your personal information, you may contact our Privacy Officer at:

• Email: [email protected]
• Mail: Montserrat Technologies Inc., Attn: Privacy Officer, Montréal, QC, Canada

We will acknowledge receipt of your request within 30 days and respond substantively as required by applicable law.

3. Information We Collect

We collect only the information necessary to operate MediPlace and provide our services. We organize this information into the following categories:

3.1 Account Information

When you create a MediPlace account, we collect:

• Full name
• Email address
• Password (stored in hashed form — we cannot read your password)
• Phone number (optional)

This information is used to authenticate your identity, manage your account, and communicate with you about your account. Your personal information (name, email, phone) is private and is never displayed publicly on the platform.

3.2 Clinic Profile Information

If you are a clinic owner, you may provide the following information when setting up your clinic profile:

• Clinic name
• Clinic address
• Clinic email address
• Clinic phone number
• Clinic logo
• Clinic description

This information is public-facing and is displayed on your listings to help practitioners find and contact your clinic. You control what information you include in your clinic profile.

3.3 Listing Information

When a clinic owner creates a room listing, we collect:

• Room photos (up to 10 images per listing, maximum 5 MB each, JPG/PNG/WebP formats)
• Room type, description, and title
• Professions served
• Amenities and equipment
• Availability (days and time slots)
• Pricing information

Listing information is publicly visible on the platform to enable practitioners to search for and evaluate available spaces.

3.4 Inquiry Information

When a practitioner sends an inquiry about a listing, we collect:

• Practitioner name
• Practitioner email address
• Practitioner phone number
• Message content

This information is shared with the clinic owner who posted the listing so they can respond to the inquiry. MediPlace does not participate in or mediate the conversation that follows.

3.5 Billing Information

Subscription payments are processed entirely by Stripe, our third-party payment processor. MediPlace never stores, processes, or has access to your credit card numbers, bank account details, or other financial payment data. Stripe's handling of your payment information is governed by Stripe's Privacy Policy. We receive only a confirmation of payment status and a Stripe customer identifier to manage your subscription.

3.6 Automatically Collected Information

When you visit mediplace.ca, we automatically collect limited technical information through:

• Google Analytics 4 (GA4): anonymized usage data including page views, session duration, approximate geographic region, device type, and browser type. GA4 does not collect personally identifiable information in our configuration. We use this data to understand how the platform is used and to improve the user experience.
• Cloudflare Turnstile: an invisible spam protection service that verifies you are a real person without displaying a CAPTCHA. Turnstile does not collect personal data and does not use cookies for tracking.

3.7 What We Do NOT Collect

To be clear about the boundaries of our data collection:

• We do NOT collect health, medical, or patient data. MediPlace is a space marketplace, not a health records or clinical platform. We have no access to any information about your patients or clients.
• We do NOT collect social insurance numbers, government-issued identification, or biometric data.
• We do NOT use advertising cookies or third-party tracking cookies.
• We do NOT build user profiles for advertising purposes.
• We do NOT sell, rent, or trade personal information to third parties for their marketing purposes.

4. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your personal information for any purpose not listed above. We do not use automated decision-making or profiling that produces legal or significant effects on you.

5. Third-Party Service Providers

We share personal information with the following third-party service providers, strictly to the extent necessary for them to perform services on our behalf:

We do not sell personal information to any third party. We do not share personal information with third parties for their own marketing purposes.

Where a third-party service provider is located outside of Canada, your information may be subject to the laws of that jurisdiction. We select providers that maintain appropriate privacy and security standards. For transfers of personal information outside of Québec, we conduct privacy impact assessments as required by Law 25.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by law:

• Active accounts: Your information is retained for as long as your account remains active.
• Closed accounts: Upon account deletion, we will delete your personal information within 30 days, except where we are required by law to retain certain records (e.g., billing records for tax purposes).
• Listings: Listing data (including photos) is deleted when you delete the listing or your account.
• Inquiries: Inquiry data is retained for the duration of the relevant accounts. If you request deletion, we will remove your inquiry data within 30 days.
• Analytics data: Anonymized analytics data collected through GA4 is retained according to Google's standard retention policies and cannot be linked back to you.
• Billing records: Transaction records are retained for a minimum of 6 years as required by Canadian tax law. These records are maintained by Stripe.

7. Your Rights

Under Québec's Law 25 and PIPEDA, you have the following rights regarding your personal information:

7.1 Right of Access

You have the right to request access to the personal information we hold about you. We will provide this information in a clear, understandable format within 30 days of your request.

7.2 Right of Rectification

You have the right to request correction of any inaccurate or incomplete personal information. You can update most of your information directly through your account settings on mediplace.ca, or by contacting our Privacy Officer.

7.3 Right of Deletion

You have the right to request the deletion of your personal information. You can delete your account through the platform, or by contacting our Privacy Officer. Upon deletion, we will remove your personal information within 30 days, subject to legal retention requirements.

7.4 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format (e.g., CSV or JSON). Contact our Privacy Officer to make this request.

7.5 Right to Withdraw Consent

Where we rely on your consent to process personal information, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

7.6 Right to De-indexing

Under Law 25, you have the right to request that personal information collected about you be de-indexed from any search or dissemination mechanism, where the dissemination of that information contravenes the law or a court order.

7.7 How to Exercise Your Rights

To exercise any of these rights, contact our Privacy Officer at [email protected]. We may need to verify your identity before processing your request. We will respond within 30 days, or notify you if additional time is needed.

If you are not satisfied with our response, you have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.

8. Cookies and Tracking Technologies

MediPlace uses a minimal set of cookies and similar technologies. For full details, please refer to our separate Cookie Policy.

In summary:

• Strictly necessary cookies: Session authentication (Supabase) and language preference. These are required for the platform to function and cannot be disabled.
• Analytics cookies: Google Analytics 4, which collects anonymized usage data. You may opt out by using your browser settings or a GA opt-out browser add-on.
• No advertising cookies: We do not use advertising, retargeting, or third-party tracking cookies.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Hashed password storage (we cannot read your password)
• Database hosting in Canada (Supabase)
• Role-based access controls within the platform
• Regular review of security practices

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you and the relevant authorities as required by Law 25 and PIPEDA.

10. Children's Privacy

MediPlace is a B2B platform designed for healthcare professionals and clinic owners. Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors.

If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe a minor has provided us with personal information, please contact our Privacy Officer at [email protected].

11. Cross-Border Transfers

Our primary data infrastructure (database and file storage) is hosted in Canada through Supabase. However, some of our third-party service providers are based in the United States (Stripe, Resend, Google Analytics).

Before transferring personal information outside of Québec, we conduct a privacy impact assessment as required by Law 25 (Section 17) to ensure that the information will receive a level of protection equivalent to that provided under Québec law. We enter into appropriate contractual arrangements with our service providers to safeguard your information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify registered users by email at least 30 days before significant changes take effect
• Post the updated policy on mediplace.ca

We encourage you to review this policy periodically. Your continued use of MediPlace after changes take effect constitutes your acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein, including the Civil Code of Québec, Law 25, and PIPEDA.

14. Contact Information

For any questions, concerns, or requests related to this Privacy Policy or our privacy practices, please contact:

Montserrat Technologies Inc.

Attn: Privacy Officer

Montréal, QC, Canada

Email: [email protected]

Website: mediplace.ca

For complaints, you may also contact the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca or the Office of the Privacy Commissioner of Canada at priv.gc.ca.