This policy covers three groups of people: patients and parents whose information a clinic handles in OHS Flow; clinic staff who use OHS Flow; and visitors to ohsflow.com. It is written in plain language on purpose.
Last updated: November 1, 2026 · Version 1.0
OHS is 18344850 Canada Inc., a federal corporation operating as OHS, based in Toronto, Ontario. We build and operate OHS Flow for medical clinics in Canada. Our Privacy Officer can be reached at privacy@ohsflow.com for any question, request or complaint about personal information.
Whose information it is. It is held by your clinic. Under Ontario’s Personal Health Information Protection Act the clinic is the custodian of your health information, and OHS is the clinic’s agent: we handle it only on the clinic’s instructions, only for the services in our agreement with the clinic, and never for our own purposes. We do not sell it, share it with advertisers, or use it to build anything outside your clinic’s own service. For Quebec clinics, the same duties come from Quebec’s health-information and privacy laws.
What OHS Flow holds. Depending on the services your clinic uses: the contact and visit details the clinic imports from its own records so that reminders and notices can be sent; the record of what was sent to you and when; email you send to the clinic’s mailbox, if the clinic handles that mailbox through OHS Flow, and the clinic’s replies; and your choices about which clinic emails you want. Each clinic’s information is held in its own separate database in Canada.
What leaves the clinic’s database. Three things, each to a named provider on our Sub-processors page: email delivery, when the clinic sends you a message; AI assistance, when clinic staff use OHS Flow to sort or draft a reply to an email you sent; and de-identification, when, with the clinic’s agreement, copies of the clinic’s email are stripped of names and identifying details so the clinic can build a reference for its staff. The AI Oversight page describes the last two.
How long. For as long as your clinic uses OHS. Email handled in OHS Flow, and the clinic’s replies, are kept as part of the clinic’s record of its communications with you; the clinic can ask us to delete handled messages at any time. When a clinic leaves, it receives a complete export of its data within 30 days and OHS deletes its copies. The record of what was sent to you is part of your clinic’s record and stays with the clinic for as long as its own record-retention rules require. Raw copies of a clinic’s email used to build its knowledge base are deleted within seven days; only the de-identified version is kept.
Your rights. Your clinic holds your record and is the right place to ask to see it, correct it, or ask who has seen it; OHS supports the clinic in answering. If your question is about OHS itself, write to privacy@ohsflow.com. You may also complain to the Information and Privacy Commissioner of Ontario or, in Quebec, to the Commission d’accès à l’information.
OHS Flow holds your name, work email, role and sign-in details, and keeps a record of actions taken in the platform - who sent, sorted or changed what, and when - so the clinic can account for its handling of patient information. That record is part of the clinic’s records and is available to the clinic’s owner. It records actions, not the content of your messages. Your clinic’s own policies, and in Ontario its electronic-monitoring policy where the law requires one, govern how the clinic uses it. The OHS sidebar for Gmail has its own page describing exactly what it collects.
For billing and invoicing, OHS holds a clinic’s business contact details and payment arrangements. Payment cards are held by our payment processor, Stripe, not by OHS. No patient information is involved.
If you write to us through the site or by email, we keep your message and contact details to respond to you and for our records of the correspondence. ohsflow.com sets no cookies and runs no analytics. If you write to us through the contact form, your message is delivered to us by Formspree, a third-party form service. No clinic or patient information is involved in visiting this website.
Each clinic’s database, and the application that serves it, are hosted in Montréal, Canada. Where a provider processes information outside Canada, the Sub-processors page says so, what it handles, and for how long it keeps it. No provider is permitted to use clinic information for its own purposes.
The Security page describes how clinic information is protected.
If OHS learns that a clinic’s information has been lost, accessed without authority or exposed, we tell the clinic promptly so it can meet its duties to patients and to the regulator, and we keep a record of incidents. The timelines are set in our clinic agreement.
When a fact in this policy changes - a provider, a location, a practice - the policy changes and the date in the footer changes.
privacy@ohsflow.com · 18344850 Canada Inc., operating as OHS, Toronto, Ontario, Canada.