Privacy Policy

CyberPatient and CP OnCall

Effective date: September 25, 2026

Who we are and what this policy covers

Interactive Health International Ltd. (IHI), operating as CyberPatient, provides the CyberPatient websites, institutional learning platform and CP OnCall for individual learners. This policy explains how we handle personal information when you visit our sites, use our services, purchase a plan or contact us.

For individual accounts and our own marketing and business operations, IHI is responsible for the personal information it handles. When an institution supplies learner information or directs us to process learning records, we handle those records under its instructions and our agreement with it.

The institution remains responsible for its own educational purposes and decisions. We remain responsible for our own legal obligations.

Information we collect

Account and contact information includes your name, email address, login identifiers, account settings, institution or course affiliation where relevant, and information you choose to include in a support request, walkthrough request or other message.

Learning information includes cases attempted, actions taken in a simulation, answers, scores, feedback, progress and activity times. For institution-managed accounts, it may also include classroom assignments and the identifier your institution uses to connect you to its records.

AI interaction information includes prompts or messages you submit, simulated responses and usage records needed to operate an AI feature and measure its allowance. If a feature uses a microphone or other additional input, its collection and processing will be explained when that feature is offered. Do not enter identifiable patient information or confidential records about another person.

Purchase information includes the plan, amount and currency paid, transaction and customer identifiers, payment status, renewal dates, refunds and billing details needed for the transaction.

Payment-card information is handled by the checkout provider. We receive the payment and billing information needed to manage your purchase, not a copy of your full card security credentials.

Technical and referral information may include IP address, device and browser type, pages viewed, timestamps, error and security logs, session identifiers and campaign or referral codes. The information collected depends on the features you use and your choices about optional tracking.

We receive information directly from you, automatically through your use of the service, and from your institution or service providers where needed for the purposes below. Please do not send information that is unnecessary for your request.

How we use information

We use account, learning and technical information to provide access, run simulations, return feedback, save progress, administer classrooms, apply plan allowances, troubleshoot problems and protect the service against misuse. We use contact information to answer requests and send essential account, security and billing messages.

We use purchase information to process and reconcile payments, administer renewals and cancellations, issue refunds, prevent fraud and meet accounting or legal obligations. Referral information helps identify the source of a visit or purchase and administer an applicable creator or affiliate commission.

We use appropriately minimized usage information to understand service performance and improve educational features. Where we conduct research involving identifiable learner information, we explain the project and obtain the permissions or consent required for that research. Participation in a service does not by itself constitute consent to a separate research study.

We send optional promotional messages where permitted by law and in accordance with your choices. You can unsubscribe using the message link or by contacting us. Unsubscribing from marketing does not stop essential messages about your existing account or purchase.

AI services and your information

When you use an AI-assisted feature, information needed to generate a response is processed by the AI services supporting that feature. That may include your input, the relevant simulation context and technical or usage identifiers.

We do not rely on a general acceptance of the Terms of Use as consent for an unrelated use of your personal information. Any new purpose that requires consent will be explained before we ask for that consent. The service is for simulated learning and must not be used to transmit real patient records.

Who receives information

Authorized personnel and service providers receive the information needed for their work. Provider categories include hosting and storage, identity and account management, payment processing, AI delivery, technical support, communications, analytics and affiliate attribution. We require appropriate contractual and security protections for providers processing information on our behalf.

Stripe supports payment processing. Affonso supports the creator affiliate program where used. Their involvement does not mean a creator receives access to your learning records or AI conversations.

For institution-managed learning, authorized instructors and administrators may receive classroom activity, submissions and results. Your institution explains how it uses that information for teaching, assessment and administration. Linking an individual account to an institution should be accompanied by a notice explaining the records that will become visible.

We may disclose information when law requires it, to respond to valid legal process, or where law permits disclosure to protect rights or address a serious security threat. If our business is reorganized or transferred, personal information may be reviewed or transferred subject to applicable law and appropriate confidentiality protections. We will provide any notice required by law.

Cookies and privacy choices

Cookies and similar technologies can maintain a signed-in session, support security, remember preferences, measure site performance and associate a purchase with a referral. Their purposes differ; not every cookie is necessary to deliver the service.

Where consent is required for optional analytics, advertising or referral tracking, we will obtain it before that tracking begins and provide a way to withdraw it. Declining optional tracking will not prevent access to the core paid learning service. Browser controls may also let you delete or block cookies, although blocking necessary cookies can prevent sign-in or other requested functions.

Where information is processed and how long we keep it

Our providers may process information outside your province or country. Information processed abroad may be subject to the laws and lawful access powers of that country. We apply contractual and other safeguards required by applicable law; an institutional agreement may impose additional location restrictions.

We keep personal information only for as long as needed for the stated purposes, including providing your account, meeting institutional instructions, maintaining required transaction records, resolving disputes and addressing security issues. We then delete it or make it no longer identifiable, subject to lawful retention requirements.

Closing an account does not necessarily erase records your institution must retain or transaction records we must keep by law. We will explain an applicable limitation when responding to a deletion request.

Security

We use safeguards appropriate to the sensitivity and risks of the information, including access restrictions and measures to protect data in transit and storage. No online service is completely secure. Keep your login details private and tell us if you suspect unauthorized access.

We assess suspected privacy incidents and provide notifications to affected individuals, institutions and regulators when required by applicable law or our agreements. Please report concerns to info@cyberpatient.ca without including unnecessary sensitive information.

Your rights and requests

Depending on the law that applies, you may have rights to access and correct your information, request deletion, withdraw consent, object to or restrict particular processing, or obtain a portable copy. These rights have legal limits. Withdrawing consent does not undo lawful processing that already occurred, and it may prevent us from providing a feature that needs that information.

Email info@cyberpatient.ca with “Privacy request” in the subject line. Tell us what you are requesting and which account it concerns. We may take proportionate steps to verify your identity or an authorized representative’s authority. We will respond within the time required by applicable law and explain any refusal and available recourse. You do not have to use a particular form to exercise a right.

If your request concerns records controlled by your institution, contact its privacy office or administrator. You may also contact us and we will help route the request appropriately. We will not discriminate against you for exercising a privacy right.

You may raise a concern with our privacy contact or complain to the regulator responsible for your jurisdiction. In Canada, this may be the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada. You do not have to contact us before approaching a regulator.

Consent and other lawful grounds

We explain the purposes of collection and obtain meaningful consent where applicable law requires it.

You can decline optional uses independently of the information needed to provide a requested service. When consent is withdrawn, we will explain the practical effect and any lawful reason some information must still be retained.

Where European or UK data-protection law applies, the relevant grounds may include performing our contract with you, meeting a legal obligation, your consent for optional processing, and legitimate interests such as security and proportionate service administration where those interests do not override your rights. You may object to processing based on legitimate interests. We do not treat every processing activity as covered by a single blanket consent.

Our services are designed for health-profession education rather than children. If a learner cannot legally provide meaningful consent, appropriate parental, guardian or institutional authorization is required. Contact us if you believe we have collected a child’s information without the required authorization.

Changes and contact

We will update this policy when our practices change. A material new purpose or disclosure will be explained before it begins, with fresh consent where required. The policy’s effective date will identify the current version.

Privacy contact: Interactive Health International Ltd., attention Privacy Officer. Email: info@cyberpatient.ca.