DRAFT: this page has not been approved and is not in force.

Privacy statement

Who is responsible

HomeDraw Inc. is the health information custodian for the information you give us under Ontario's Personal Health Information Protection Act (PHIPA). Privacy Officer, HomeDraw Inc., 25 Berko Ave, Hamilton ON L8V 2P8, 548-577-5151.

What we collect and why

• The person booking: name, email, phone, relationship to the patient — to confirm the booking and contact you about it.
• Each patient: name, date of birth, address, phone, and your answers about the visit — so the nurse can prepare and identify the patient.
• The requisition image — so we can check it and carry out the tests your clinician ordered.

We do not ask for a health card number on this website. The nurse reads it from the requisition.

Who we share it with

• The ordering clinician and Med-Health Laboratories, to carry out the blood draw.
• Service providers that process information for us under written agreements: hosting and database in Canada (Supabase, Vercel functions in Montréal), payments (Stripe, which receives your card details and an opaque booking number only), email (Amazon, Canada).

When the nurse taps Navigate, the visit location (map coordinates only) is shared with the maps app on the nurse's phone.

We do not sell information. This website uses no advertising, tracking or analytics tools.

How long we keep it

Clinical records and requisitions: 10 years. Location readings from the nurse's phone: 30 days. An unfinished booking is deleted within a day. Marketing preferences are removed when you unsubscribe. Our access log: 2 years. A nightly encrypted copy of the records, kept in Canada for 35 days, protects against loss.

Your rights

You may ask to see or correct the information we hold about you, or complain to us or to the Information and Privacy Commissioner of Ontario. To see your record, call us: a copy is prepared for you by two staff members and given to you securely.

Deleting your account

You can ask to delete your account from your visit page or from this page; we email a link to your confirmed email address, or you can call us.

• Your login and contact details are deleted: your email address, phone number and name, your marketing preferences, your visit links and any messages waiting to be sent.
• The health record of each visit (who was seen, the requisition, the samples and their delivery to the lab) is kept for 10 years, because Ontario law requires HomeDraw, as a health information custodian, and its nurses to keep it (PHIPA; College of Nurses of Ontario documentation standard).
• Our access log keeps a record that your account existed and was deleted for 2 years.
• Payment records stay with Stripe as financial records.

An account with a booking that is not finished cannot be deleted until the booking is cancelled or finished. A visit is finished 7 days after the samples reach the lab, unless there is an open question about them.