Privacy policy

Our Privacy Officer

Our Privacy Officer is responsible for how MyMD handles personal information and for answering questions, requests and complaints about it.

• Email: [email protected] (write “Privacy” in the subject line)
• Phone: 604-880-7919
• Mail: Privacy Officer, MyMD Telehealth, 3819 Sunset St., Burnaby, BC V5G 1T4

What we collect

When you book a visit: your name, date of birth, email address and phone number; your B.C. health card number (PHN) or other coverage; the reason for your visit; and whether you agree to the AI scribe (see below). New patients are also asked about allergies, their family doctor and a preferred pharmacy, and may attach photos or documents.

During and after your visit: your doctor’s notes, test results, referrals, and reports and letters from other health-care providers.

When you contact us: what you send through our contact form (name, email address and message), by email or by phone.

When you use our website: information about your visit to the site, described under “Our website and cookies” below.

We collect only what we need for the purposes below.

Why we use it

• To assess you and provide your medical care, and to keep the medical record the law requires.
• To book, confirm and remind you of appointments, and to phone you at your appointment time.
• To work with other providers involved in your care, such as labs, imaging, specialists and your pharmacy.
• To bill the Medical Services Plan (MSP) and check that your coverage is active.
• To answer your messages and questions.
• To meet our legal and professional obligations.

We do not sell your information, and we do not use it to market to you.

Your consent

When you book and receive care, you consent to us collecting, using and sharing your information for your care as this policy describes. You may withdraw consent at any time by telling our Privacy Officer. We will explain first what that means for your care; for example, we cannot see you without a way to reach you. Withdrawing consent does not undo what was done before, and the law still requires us to keep your medical record.

Who we share it with

• Others caring for you: labs, imaging clinics, specialists, the pharmacy you choose, and your family doctor, when your care needs it.
• The Medical Services Plan: for billing and to confirm your coverage.
• Our service providers (listed in the next section), only to deliver their service to us and under confidentiality obligations.
• When the law requires or allows it: for example, reportable diseases, a court order, or the College of Physicians and Surgeons of BC.

Anyone else sees your information only with your consent.

Where your information is stored

Your medical record is kept in our electronic medical record (OSCAR) on the clinic’s own server in B.C. Its disk is encrypted, and it is backed up every night, encrypted, to a second computer in B.C.

Online booking, the AI scribe and our other clinical software are provided by Health Assist and run on Microsoft Azure data centres in Canada.

Some of our service providers are in the United States, so some of your information is stored or processed there:

• GoDaddy hosts this website, our contact form and our email ([email protected]), so messages you send us and emails we send you from our office are stored in the United States.
• Twilio sends text messages: verification codes and links to you, and the alert to your doctor when you book (your name, appointment time, phone number and whether your MSP coverage is active; never your health card number or reason for visit).
• Resend sends booking emails: confirmations and cancellations, with your first name and your appointment date and time.
• Google measures use of this website and the booking pages (see below).
• Microsoft may process information outside Canada for five AI drafting tools our doctors use; the information is stored in Canada.
• Doxy.me carries video visits, if you are offered one and choose it. Most visits are by phone.

Information stored or processed outside Canada may be accessed by courts, law enforcement and national security authorities there under that country’s laws. The Health Assist privacy policy has more detail on the Health Assist services.

The AI scribe and other AI tools

When you book, we ask whether your doctor may use an AI scribe. It is your choice, and saying no does not affect your care. If you agree, the scribe records your conversation with the doctor, turns it into text on Microsoft servers in Canada, and drafts a note. Your doctor reviews and corrects the note before it goes into your record. The recording is deleted within 90 days. You can change your mind at any time, including at the start of your visit.

Our doctors also use AI tools to help draft parts of a note, such as the history of your concern or a requisition. A doctor reviews everything these tools produce, and they never make decisions about your care.

Email and text messages

We use email and text messages to confirm appointments, send links, and let you know when to contact us. We avoid putting test results or other health details in them, because ordinary email and text are not fully secure. If you would rather we did not email or text you, tell us and we will phone instead.

Our website and cookies

This website and our booking pages use Google Analytics and Google Ads. They use cookies to count visits, see which pages are used, and tell us when a visit that began with one of our ads ends in a booking. Google receives technical information such as your device, browser, the pages you view and, for a booking, that it was completed. It does not receive your name, contact details, health card number or reason for visit.

You can block these cookies in your browser settings or with an ad blocker, and booking still works. You can also adjust Google’s use of your data at adssettings.google.com and install Google’s Analytics opt-out.

How we protect it

• Only clinic staff who need your information for their work can see it, and they are bound by confidentiality.
• Our medical record can be opened only from registered clinic devices, over an encrypted connection, and its storage is encrypted.
• Access to records is logged.
• Our service providers are required to protect your information and to use it only to provide their service.

How long we keep it

As the College of Physicians and Surgeons of BC requires, we keep medical records for at least 16 years from the last entry, or from the patient’s 19th birthday if that is later. AI-scribe recordings are deleted within 90 days. Other information, such as messages, is kept only as long as we need it. When we no longer need information, we destroy it securely.

Seeing or correcting your information

You may ask to see your personal information, or for a copy, and ask us to correct it. Send your request to our Privacy Officer. We will answer within 30 business days, as PIPA requires, and tell you in advance about any fee for copies. In a few cases the law lets us or requires us to withhold information, for example information about someone else; if so, we will tell you why.

Records from Dr. Manucher Mehraein’s previous family practice are held by RSRS, a physician-managed records service: recordsolutions.ca.

Questions and complaints

Please contact our Privacy Officer first; we would like the chance to fix the problem. If you are not satisfied with our answer, you may contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

Changes to this policy

We will update this policy when our practices change and show the new effective date at the top of this page.