Arcolab Privacy Policy

Last updated: 2026-10-03

Who we are

Arcolab Health Ltd. is a British Columbia company that builds AI tools for physician and clinic workflows. This policy applies to personal information we collect and control as the party responsible for it.

For questions, contact our privacy officer at privacy@arcolab.health.

What this policy covers — and what it does not

Covered here: the personal information we control directly, including information about:

you as a physician or user of our Services — your account and contact information, and how you use the Services (see "Account information");
visitors to our website — cookies, analytics and device information (see "Website and marketing information"); and
individuals who contact us or sign up for a demo — prospective customers and marketing contacts.

Not covered here: patient information that you or your clinic provide to the Services for processing. That information is processed on your behalf as a service provider, and is governed by your clinic's agreement with us. We are not the responsible party for patient information, and we do not use patient information for our own purposes. If you are a patient, please contact your clinic or physician.

The information we collect

Account information (physicians and other users)

When you create an account: your name, professional email address, and a password. If your account is clinic-managed, your clinic provides your name and email.
When you use the Services: information about how you use the tools — features used, dates and times, device and browser information, and log data.
Business contact information for clinic administrators and decision-makers: name, work email, phone, clinic name and address.

Website and marketing information

When you visit our website: device and browser information, IP address, pages viewed, referring site, and general location derived from your IP address.
When you request a demo, download content, or sign up for updates: your name, work email, organization, and any message you send.
Cookies and analytics: see "Cookies and analytics" below.

Other

When you communicate with us: your name, email and the contents of your messages (support requests, inquiries).
Payment information: handled by our payment processor; we do not store card numbers.
From other sources: we do not currently collect personal information about you from third-party sources, other than from your clinic when it creates your account.

How we use personal information

We use personal information to:

provide, maintain and improve the Services and your account;
communicate with you about your account, the Services, and security matters;
understand how the Services are used, in aggregate, to improve them;
respond to your requests, questions and inquiries, and send information you request (for example, a demo or update);
send you marketing communications about the Services, only where we have consent or another lawful basis to do so (see "Marketing");
meet our legal, professional and professional-regulatory obligations.

We do not sell your personal information. We do not use your account information or website information to train AI models. We may use aggregated, de-identified usage statistics to improve the Services; that data cannot be used to identify you.

Marketing and CASL

We send commercial electronic messages (for example, product updates and offers by email) only where we have consent or where we are otherwise permitted to do so. You may withdraw consent at any time using the unsubscribe link in any message or by contacting us.

Cookies and analytics

Our website uses cookies and similar technologies only as needed to operate the site. We do not currently use a third-party analytics provider. If that changes, we will update this policy. You can control or delete cookies through your browser settings.

Where information is stored

Your account data and website data are stored in Canada. We do not store account data outside Canada. When you use AI features, patient content may be processed in the United States. That processing is on behalf of your clinic or you, and is described in the cross-border section of your or your clinic's Data Processing Addendum; it is not covered by this policy.

We share personal information only with:

service providers that help us operate our website and platform, under contracts that protect your information and restrict its use to providing services to us;
clinics — if your account is clinic-managed, your clinic's administrators can see your name, email and usage in relation to that clinic's account;
professional advisers and authorities where required by law, or in connection with a corporate reorganization or sale of the business, subject to confidentiality obligations.

We do not share your personal information for advertising.

How long we keep it

Account information: for as long as your account is active. When you close your account, we delete your account information within 90 days, except where we must keep it longer for legal, security or legitimate business reasons (for example, fraud prevention or record-keeping obligations).
Usage logs: kept for 12 months.
Marketing contacts and inquiries: until you unsubscribe or the inquiry is resolved, then for a reasonable record-keeping period.

Your choices and rights

You may, subject to applicable law:

access, correct or request deletion of your personal information by contacting privacy@arcolab.health;
unsubscribe from marketing communications using the link in each email or by contacting us;
close your account at any time from account settings;
control cookies through your browser settings.

If you have a question or complaint about how we handle personal information, contact our privacy officer first at privacy@arcolab.health. If we refuse an access request, we will tell you why in writing and outline your options. You may also complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

Security

We protect personal information with encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure; if a privacy incident affecting personal information under this policy occurs, we will notify affected individuals and applicable authorities as required by law.

Changes to this policy

We may update this policy from time to time. Material changes will be notified 30 days in advance where required by law, and the current version is posted at https://arcolab.health/legal/privacy-policy.