What we store
A workspace holds names, emails, the market, partner organisations and the status of a referral. The clinical note, when one is entered, sits in an AES-256-GCM column. List views, partner notifications and the portal timeline do not include that text.
Who can open a note
Opening the note requires the phi.read permission and a verified authenticator. Roles that can see it idle out after 15 minutes. The session cookie is httpOnly. Each open writes an append-only audit row. The platform owner enters a tenant workspace only with a reason in that log.
Mail and sequences
We do not sell personal information. Marketing mail and partner sequences require the consent record the product already checks: Canada under CASL and the UK under PECR need a basis and a capture date, and opt-out is respected in every market. Staging messages stay on the host. They are not sent.
Access, export and deletion
Until a privacy desk is named for each production region, requests go through the contact form. A UK or Canadian production workspace needs a data processing addendum before health information is stored. A US workspace that stores PHI needs a business associate agreement with the customer and with each sub-processor that can see it. Using iqcareloop.atiqsoft.com does not execute either document. Do not type a real patient into this host.
The longer draft for counsel is on the legal page. Security controls are on Security.