_7e26c7c2.png){kind=small}
Privacy Policy
Pryme Practice is committed to protecting the privacy and security of all personal information and protected health information we process. This Policy explains how we collect, use, disclose, and safeguard your information in compliance with HIPAA, PIPEDA, CCPA/CPRA, and applicable provincial health privacy legislation.
Table of Contents
1. Introduction and Scope
Pryme Practice Inc. ("Pryme Practice," "we," "us," or "our") is committed to protecting the privacy and security of all information we collect, process, and maintain. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information and protected health information ("PHI") in connection with our cloud-based electronic health record ("EHR") and practice management platform (the "Services").
This Policy applies to: (a) healthcare providers, clinics, and practices ("Covered Entities") that subscribe to our Services; (b) patients and individuals whose health information is processed through our platform; (c) visitors to our website at www.prymepractice.com; and (d) any other individuals whose personal information we collect in the course of operating our business.
Pryme Practice operates as a Business Associate (as defined under HIPAA) when processing PHI on behalf of Covered Entities, and as a Health Information Custodian (as defined under PIPEDA and applicable provincial health privacy legislation) when processing personal health information in Canada. We maintain separate Business Associate Agreements ("BAAs") with all Covered Entity clients as required by law.
This Policy is intended to satisfy disclosure requirements under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), the Personal Information Protection and Electronic Documents Act ("PIPEDA"), applicable provincial health privacy legislation in Canada (including Alberta's Health Information Act, Ontario's Personal Health Information Protection Act, and British Columbia's Personal Information Protection Act), and the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA").
2. Information We Collect
We collect several categories of information depending on your relationship with Pryme Practice.
2.1 Protected Health Information (PHI)
When you use our Services as a healthcare provider, we process PHI on your behalf as your Business Associate. PHI includes any individually identifiable health information, including but not limited to: patient names, dates of birth, addresses, Social Security Numbers or Social Insurance Numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle identifiers, device identifiers, web URLs, IP addresses when linked to an individual, biometric identifiers, full-face photographs, and any other unique identifying number or code. PHI is processed strictly in accordance with our Business Associate Agreement and applicable law, and is never used for any purpose beyond providing the contracted Services.
2.2 Account and Practice Information
When a healthcare practice subscribes to our Services, we collect information about the practice and its authorized users, including: practice name, address, phone number, tax identification number (EIN or BN), National Provider Identifier (NPI), professional license numbers, billing information, names and contact details of authorized staff members, and login credentials.
2.3 Website and Usage Data
When you visit our website or use our platform, we automatically collect certain technical information, including: IP address, browser type and version, operating system, referring URLs, pages viewed, time spent on pages, click patterns, session identifiers, and device identifiers. This information is collected through cookies, web beacons, and similar tracking technologies as described in Section 9 of this Policy.
2.4 Communications Data
We collect information you provide when you contact us for support, complete intake forms, respond to surveys, or communicate with us by email, phone, or live chat, including the content of those communications and any attachments.
2.5 Payment Information
Billing and payment information is collected and processed by our PCI-DSS compliant payment processor. We do not store full credit card numbers on our servers. We retain only the last four digits of payment card numbers, expiration dates, and billing addresses for account management purposes.
3. How We Use Your Information
3.1 Providing and Improving the Services
We use the information we collect to: operate, maintain, and improve our EHR and practice management platform; process transactions and send related information; provide customer support and respond to inquiries; send technical notices, updates, security alerts, and administrative messages; and develop new features and functionality.
3.2 Processing PHI as a Business Associate
As a Business Associate, we process PHI solely as directed by and on behalf of our Covered Entity clients, for the purposes of: treatment, payment, and healthcare operations as permitted under HIPAA; performing functions and activities specified in the Business Associate Agreement; and as otherwise required by law. We do not use PHI for our own marketing, research, or commercial purposes without explicit authorization.
3.3 Legal Compliance and Safety
We may use or disclose information as necessary to: comply with applicable laws, regulations, legal processes, or governmental requests; enforce our Terms of Service and other agreements; protect the rights, property, or safety of Pryme Practice, our clients, patients, or the public; and detect, prevent, or address fraud, security, or technical issues.
3.4 Analytics and Business Operations
We use aggregated, de-identified data — which cannot reasonably be used to identify any individual — for internal analytics, product development, benchmarking, and business reporting. De-identification is performed in accordance with the HIPAA Expert Determination or Safe Harbor methods, as applicable.
3.5 Marketing Communications
We may send marketing communications to healthcare providers and practice administrators who have expressed interest in our Services or who are existing clients, subject to applicable opt-out rights. We do not send marketing communications to patients. You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any email or contacting us at [email protected].
4. Disclosure of Information
4.1 Service Providers and Subcontractors
We engage third-party service providers ("Subcontractors") to assist in operating our platform and delivering our Services. These include cloud infrastructure providers, payment processors, email delivery services, customer support platforms, and analytics tools. All Subcontractors who may access PHI are required to execute Business Associate Agreements and are contractually obligated to maintain the same level of privacy and security protections as Pryme Practice. A current list of our Subcontractors is available upon request.
4.2 Covered Entity Clients
We disclose information to our Covered Entity clients as necessary to provide the Services. Healthcare practices retain ownership and control of all PHI entered into the platform and may request export or deletion of their data at any time in accordance with our data retention policies.
4.3 Legal Requirements
We may disclose information when required by law, including in response to valid subpoenas, court orders, government investigations, or other legal processes. Where permitted by law, we will notify affected parties before disclosing their information in response to such requests.
4.4 Business Transfers
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, information held by us may be transferred to the successor entity. We will provide notice of any such transfer and the choices available to you, and any successor entity will be required to honor the commitments made in this Policy.
4.5 Consent
We may share information with third parties when you have given us explicit consent to do so.
4.6 What We Do Not Do
We do not sell, rent, or trade personal information or PHI to third parties for their own marketing or commercial purposes. We do not use PHI to market non-healthcare products or services. We do not share PHI with employers, life insurers, or any entity for purposes unrelated to healthcare treatment, payment, or operations without explicit written authorization.
5. HIPAA Compliance (United States)
5.1 Business Associate Obligations
Pryme Practice is a Business Associate under HIPAA. We have implemented administrative, physical, and technical safeguards as required by the HIPAA Security Rule (45 CFR Part 164, Subpart C) to protect the confidentiality, integrity, and availability of electronic PHI ("ePHI"). Our safeguards include: risk analysis and risk management programs; workforce training and access controls; audit controls and activity logging; encryption of ePHI at rest and in transit; contingency planning and disaster recovery; and regular security assessments.
5.2 Notice of Privacy Practices
Healthcare providers using our platform are responsible for providing their patients with a Notice of Privacy Practices as required by the HIPAA Privacy Rule. Pryme Practice provides template notices and tools to assist Covered Entities in meeting this obligation.
5.3 Patient Rights Under HIPAA
Patients have the following rights regarding their PHI, which must be exercised through the healthcare provider (Covered Entity) that maintains their records: the right to access and receive a copy of their PHI; the right to request amendment of inaccurate or incomplete PHI; the right to an accounting of disclosures; the right to request restrictions on certain uses and disclosures; the right to request confidential communications; and the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
5.4 Breach Notification
In the event of a breach of unsecured PHI, Pryme Practice will notify affected Covered Entities without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HITECH Breach Notification Rule (45 CFR Part 164, Subpart D). Covered Entities are responsible for notifying affected individuals and, where required, the Secretary of HHS and the media.
6. Canadian Privacy Law Compliance (PIPEDA and Provincial Legislation)
6.1 PIPEDA Compliance
For Canadian clients and individuals, Pryme Practice complies with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation. We collect, use, and disclose personal information only with knowledge and consent, except where otherwise permitted or required by law. We collect only the minimum information necessary for the identified purposes, and we retain personal information only as long as necessary to fulfill those purposes.
6.2 Provincial Health Privacy Legislation
We comply with applicable provincial health privacy legislation, including: Alberta's Health Information Act ("HIA"); Ontario's Personal Health Information Protection Act ("PHIPA"); British Columbia's Personal Information Protection Act ("PIPA"); and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64). Where provincial legislation provides greater protection than PIPEDA, we apply the higher standard.
6.3 Cross-Border Data Transfers
Some personal information processed by Pryme Practice may be stored or processed in the United States. We take appropriate contractual and technical measures to ensure that personal information transferred across borders receives equivalent protection to that required under Canadian law, including executing data processing agreements and implementing standard contractual clauses where applicable.
6.4 Rights of Canadian Individuals
Individuals in Canada have the right to: access their personal information held by us; challenge the accuracy and completeness of their information and have it amended; withdraw consent to the collection, use, or disclosure of their personal information (subject to legal or contractual restrictions); and file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner.
6.5 Privacy Officer
Pryme Practice has designated a Privacy Officer responsible for overseeing compliance with Canadian privacy legislation. Our Privacy Officer can be contacted at [email protected].
7. California Privacy Rights (CCPA / CPRA)
7.1 Applicability
This section applies to California residents whose personal information is collected by Pryme Practice in a non-PHI context (e.g., website visitors, practice administrators, and sales contacts). PHI processed under HIPAA is exempt from the CCPA.
7.2 Categories of Personal Information Collected
In the preceding 12 months, we have collected the following categories of personal information from California residents: identifiers (name, email address, IP address); commercial information (subscription and billing records); internet or other electronic network activity information (browsing history on our website); professional or employment-related information (job title, practice affiliation); and inferences drawn from the above to create a profile about preferences and characteristics.
7.3 California Consumer Rights
California residents have the right to: know what personal information we collect, use, disclose, and sell; request deletion of their personal information; opt out of the sale or sharing of their personal information (we do not sell personal information); correct inaccurate personal information; and not be discriminated against for exercising their privacy rights. To exercise these rights, submit a verifiable consumer request to [email protected] or call us at the number listed in Section 12.
7.4 Shine the Light
California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes under California Civil Code Section 1798.83. We do not disclose personal information to third parties for their direct marketing purposes.
8. Data Security
Pryme Practice implements a comprehensive information security program designed to protect personal information and PHI against unauthorized access, use, disclosure, alteration, and destruction. Our security measures include:
**Encryption:** All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. All PHI stored on our servers is encrypted at rest using AES-256 encryption. Encryption keys are managed using industry-standard key management practices.
**Access Controls:** Access to personal information and PHI is restricted to authorized personnel on a need-to-know basis. We implement role-based access controls, multi-factor authentication for administrative access, and regular access reviews. All access to PHI is logged and auditable.
**Infrastructure Security:** Our platform is hosted on SOC 2 Type II certified cloud infrastructure. We conduct regular vulnerability assessments, penetration testing, and security audits. Our infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation.
**Employee Training:** All employees and contractors who may access personal information or PHI receive regular privacy and security training. We conduct background checks on employees with access to sensitive data.
**Incident Response:** We maintain a documented incident response plan and conduct regular tabletop exercises. In the event of a security incident, we follow established procedures for containment, investigation, notification, and remediation.
**Business Continuity:** We maintain redundant systems and regular backups to ensure data availability. Our recovery time objective (RTO) and recovery point objective (RPO) are designed to minimize disruption to healthcare operations.
Despite these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected parties and taking corrective action in the event of a security incident.
10. Data Retention
We retain personal information and PHI for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements.
**PHI Retention:** PHI is retained in accordance with the retention schedules specified in our Business Associate Agreements and applicable law. Under HIPAA, we retain documentation of our privacy and security policies and procedures for a minimum of six years from the date of creation or the date when the policy was last in effect, whichever is later. Covered Entities are responsible for complying with applicable state and provincial medical record retention requirements.
**Account Data:** Account information for active subscriptions is retained for the duration of the subscription. Upon termination of a subscription, we retain account data for a period of 90 days to allow for data export, after which it is securely deleted unless a longer retention period is required by law or agreed upon in writing.
**Website Data:** Website usage data collected through cookies and analytics tools is retained for a maximum of 26 months.
**Marketing Data:** Contact information for marketing purposes is retained until you opt out or request deletion.
Upon expiration of the applicable retention period, we securely delete or de-identify personal information using industry-standard methods, including cryptographic erasure for encrypted data and secure overwriting for other data.
11. Children's Privacy
Our Services are designed for use by licensed healthcare professionals and are not directed to individuals under the age of 18. We do not knowingly collect personal information directly from children under 18 through our website or marketing activities. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will take steps to delete that information promptly.
Note that our platform may process PHI relating to minor patients as part of the healthcare services provided by our Covered Entity clients. Such processing is governed by HIPAA, applicable state and provincial law, and the terms of our Business Associate Agreements. Covered Entities are responsible for obtaining appropriate consent for the treatment and processing of health information relating to minor patients in accordance with applicable law.
12. Your Privacy Rights and How to Exercise Them
Depending on your location and the nature of your relationship with Pryme Practice, you may have the following rights regarding your personal information:
**Right of Access:** You may request a copy of the personal information we hold about you. We will respond to verified requests within 30 days (or within the timeframe required by applicable law).
**Right to Correction / Amendment:** You may request that we correct inaccurate or incomplete personal information. For PHI, amendment requests must be submitted through your healthcare provider.
**Right to Deletion / Erasure:** You may request deletion of your personal information, subject to certain exceptions (e.g., where retention is required by law or necessary for legal claims). PHI deletion requests must be coordinated with your healthcare provider.
**Right to Restrict Processing:** You may request that we restrict the processing of your personal information in certain circumstances.
**Right to Data Portability:** You may request a copy of your personal information in a structured, machine-readable format.
**Right to Object:** You may object to the processing of your personal information for direct marketing purposes at any time.
**Right to Withdraw Consent:** Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact our Privacy Officer at:
**Email:** [email protected] **Mail:** Pryme Practice Inc., Attn: Privacy Officer, [Address] **Phone:** Available upon request
We will verify your identity before processing any privacy rights request. We will respond to all requests within 30 days, or within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.
13. Complaints and Regulatory Contacts
If you have a concern about how we handle your personal information that we have not resolved to your satisfaction, you have the right to lodge a complaint with the relevant supervisory authority:
United States — HIPAA Complaints:
U.S. Department of Health and Human Services, Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 Website: www.hhs.gov/ocr Phone: 1-800-368-1019
Canada — Federal:
Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Website: www.priv.gc.ca Phone: 1-800-282-1376
Alberta:
Office of the Information and Privacy Commissioner of Alberta Website: www.oipc.ab.ca
Ontario:
Information and Privacy Commissioner of Ontario Website: www.ipc.on.ca
British Columbia:
Office of the Information and Privacy Commissioner for British Columbia Website: www.oipc.bc.ca
California:
California Privacy Protection Agency Website: cppa.ca.gov
We encourage you to contact us first at [email protected] so we have the opportunity to address your concerns directly.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: post the updated Policy on our website with a new "Last Updated" date; notify Covered Entity clients by email at least 30 days before the changes take effect; and, where required by law, obtain renewed consent.
We encourage you to review this Policy periodically. Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree with the changes, you should discontinue use of our Services and contact us to discuss your options.
The version history of this Privacy Policy is available upon request.
15. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:
Pryme Practice Inc.
Privacy Officer Email: [email protected] Website: www.prymepractice.com
For urgent security or breach-related matters, please email [email protected] with "URGENT" in the subject line.
For Business Associate Agreement inquiries, please email [email protected].
We are committed to working with you to resolve any privacy concerns promptly and transparently.
Privacy Questions or Requests?
Our Privacy Officer is available to address any questions, concerns, or rights requests. We respond to all inquiries within 30 days.
Legal Disclaimer: This Privacy Policy is provided for informational purposes and reflects Pryme Practice's current privacy practices. This document does not constitute legal advice. Healthcare providers are encouraged to consult with qualified legal counsel to ensure compliance with all applicable privacy laws and regulations in their jurisdiction. Pryme Practice reserves the right to update this Policy at any time in accordance with Section 14.