EdEHR Privacy Policy

This Privacy Policy explains how EdEHR Technologies Inc. ("EdEHR", "we", "us") protects personal information when you visit our website at https://edehr.org and any subdomains, or when you use the EdEHR platform and related services (the "Services").

Information processed on our website

We do not store personal information when you simply browse our public website. Like most websites, we collect basic access logs such as IP address, browser type, and operating system to operate the Services securely, maintain reliability, and mitigate malicious traffic.

Information collected when using EdEHR

We intentionally limit the personal data we collect. The only personally identifying information EdEHR collects about a learner or instructor is their given and family names, provided through the institution's learning management system (LMS). We do not collect email addresses, dates of birth, program or cohort information, institutional student numbers, or other personal identifiers.

Learners only see their own coursework and submissions as authorized by their institution. Instructors can see the work related to assignments they are permitted to access, and may collaborate on content built within their institution.

Demonstration environment

If you explore our demonstration environment, we collect only the details you enter while completing the sample activities. This data may be purged periodically. Avoid entering personally identifiable information unless you do so voluntarily.

Use of artificial intelligence

Some EdEHR features use artificial intelligence to assist educators in authoring simulated (fictional) educational content. AI features are disabled by default and are enabled only through opt-in at the institution level. Personal information is not transmitted to AI providers as part of these features. Our full commitments on AI use — including feature tiers, data handling, and provider terms — are set out in the EdEHR AI Policy at https://edehr.org/ai-policy.

Data retention

We retain personal information only as long as needed to provide the Services or to meet regulatory or contractual obligations. Institutions can request that course data be purged at any time, and older data is removed periodically as part of routine maintenance.

Sharing your personal data

EdEHR does not sell personal information. We do not share personal information with third parties except as strictly necessary to operate the Services (for example, our cloud infrastructure provider). All data transmitted between your browser and the Services is encrypted.

Data residency

All EdEHR platform data, including the limited personal information described above, is hosted in Canada. Certain operational processing — for example, AI-assisted authoring of simulated educational content, or delivery of administrative alert emails — may occur on infrastructure located outside Canada; because only non-personal content is transmitted for those purposes, this does not affect the residency of platform data.

Data security

We apply technical, administrative, and physical safeguards to protect information, but no internet service can guarantee absolute security. By using the Services you acknowledge that residual risks exist. The most current version of this Policy will always be available on this page, and we encourage you to review it regularly for updates.

Privacy breach response plan

Institutions using EdEHR provide designated contacts for potential privacy incidents. If a breach is suspected, EdEHR will immediately coordinate with those contacts and act according to the steps below:

1. Contain and investigate the incident, including temporarily shutting down affected services if required.
2. Notify the designated institutional contacts to maintain transparency and coordinate remediation.
3. Work with institutions to assess risk to individuals and reduce potential harm.
4. Restore services safely after completing required corrective actions.
5. Review the incident thoroughly and implement improvements to prevent recurrence.
6. Share post-incident findings with affected institutions.

Policy changes

We may update this Privacy Policy at any time. Changes take effect once published on this page. Your continued use of the Services constitutes acceptance of the current wording.