SoapSolvers Privacy Policy
This Privacy Policy explains how SoapSolvers Inc. (“SoapSolvers”, “we”, “us”) collects, uses, discloses and protects personal information about the people who visit our website, sign up for SoapSolvers, or use it as clinic staff. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply to us.
1. Patient information is handled for clinics
Clinics use SoapSolvers to keep their patients’ records. Patient information belongs to the clinic, and the clinic decides how it is collected, used and shared. SoapSolvers handles it only on the clinic’s behalf, as its service provider, under the Clinic Data Agreement (Schedule A to our Terms of Service). This Privacy Policy does not cover how a clinic uses patient information.
If you are a patient and have a question about your records, a booking or a form, please contact your clinic. Its privacy policy applies to you. If you contact us, we will pass your request to the clinic.
2. Information we collect about our customers and users
| Type | Examples |
|---|---|
| Account information | Name, email address, phone number, password (stored only as a secure hash by our sign-in provider), your role at the clinic, your profession, and for practitioners the optional photo and biography you add to your online booking profile |
| Clinic information | Clinic name, address, province, professions offered, settings |
| Billing information | Plan, billing history, billing contact. Card details are collected and stored by our payment provider (Stripe). We never see or store full card numbers. |
| Agreement records | Which version of our Terms and Privacy Policy you accepted, and when |
| Usage and technical information | Sign-in times, actions recorded in the clinic’s audit log, error reports, browser type. To protect public booking and form pages from automated attacks, we keep a one-way scrambled code (hash) of the visitor’s internet (IP) address for a short time — not the address itself. |
| Communications | Emails and support requests you send us, and our replies |
3. Why we use it
- to create and manage accounts, sign you in and keep accounts secure;
- to provide the Service, including the features your clinic uses;
- to bill subscriptions and add-ons and keep financial records required by law;
- to send service messages: sign-in and security emails, trial and billing notices, important changes to the Service or our terms;
- to answer questions and provide support;
- to understand how the Service is used, fix problems and improve it (using information that does not identify patients);
- to prevent fraud and abuse, and to meet our legal obligations.
We will only send you marketing emails about SoapSolvers if you agree, and you can unsubscribe at any time. Service messages about your account are not marketing.
4. Consent
By creating an account or using SoapSolvers, you consent to the collection, use and disclosure of your personal information as described in this policy. You can withdraw consent at any time, subject to legal or contractual restrictions, but we may then be unable to provide the Service. Clinic Owners are responsible for telling their staff that their account information is handled by SoapSolvers under this policy.
5. Who we share it with
We don’t sell personal information. We share it only:
- within your clinic — for example, a clinic’s Owner and Admins can see staff names, roles and audit-log entries; practitioners’ booking profiles are shown publicly on the clinic’s booking page;
- with our service providers, who process it for us under written agreements that require them to protect it: Supabase (database, file storage and sign-in, hosted in Canada), Netlify (delivers the website and app pages), Stripe (payments), Amazon Web Services (email delivery through Amazon SES, in Canada) and Twilio (text messages — during a free trial, test texts are sent from a SoapSolvers number);
- if the law requires it, for example a court order, or to protect the rights, safety or property of people or SoapSolvers;
- in a business transfer, if SoapSolvers or its business is sold or merged, to the buyer, who must protect it as this policy describes.
6. Where it is stored
Our database and file storage are in Canada. Emails are sent through Amazon Web Services in Canada. Some service providers (for example payment and text-message providers) may process information in the United States or other countries, where it may be accessible to authorities under those countries’ laws. We choose providers with strong privacy and security practices and bind them by contract.
7. Cookies and similar technologies
We use only what is needed for the Service to work, such as keeping you signed in and remembering choices on your device (browser storage). We do not use advertising cookies or sell browsing information.
8. How long we keep it
We keep account information while the account is open and for as long as needed for the purposes above. If a subscription payment fails, the Clinic keeps full access for a 7-day grace period; after that, access becomes limited (see our Terms of Service, section 6), but we don’t delete a Clinic’s information because a payment fails or a subscription ends. Billing and tax records are kept as long as the law requires (generally six years in Canada). Short-term security records, such as the scrambled internet address codes used to block automated attacks, are kept for about a day. When information is no longer needed, we delete it or make it anonymous.
9. How we protect it
We use safeguards that match the sensitivity of the information, including encryption in transit and at rest, role-based permissions checked on our servers, audit logs, limits on repeated attempts, backups, and restricted staff access on a need-to-know basis. No method is perfectly secure, but we work to protect your information and we review our safeguards as the Service changes.
10. Privacy breaches
If a privacy breach involving your personal information creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law, and keep a record of it. Breaches involving patient information are handled with the clinic as set out in the Clinic Data Agreement.
11. Your rights
You can ask to see the personal information we hold about you, ask how it has been used or shared, and ask us to correct it. Most account details can be changed in the app. To make a request, email our Privacy Officer. We will answer within 30 days, and may need to confirm your identity first. If we can’t give you access to some information, we will tell you why, unless the law prevents us.
12. Children
SoapSolvers accounts are for clinic staff and are not intended for children. Patient information about minors is entered by clinics and handled for them under the Clinic Data Agreement.
13. Changes to this policy
We may update this policy. If the changes are significant, we will tell clinic Owners by email or in the app before they take effect, and Owners will be asked to review the new version. Each version shows its number and date.
14. Facebook and Instagram lead ads (Meta)
A clinic can choose to connect its Facebook Page to SoapSolvers so that people who fill out the clinic’s lead forms on Facebook or Instagram appear in the clinic’s Leads list. This connection is optional and is made by the clinic’s own staff through Facebook’s sign-in window. SoapSolvers never sees or stores anyone’s Facebook password.
What we receive from Meta
- About the connection: the Page’s name and ID, the names of the clinic’s lead forms, and a Page access key that lets SoapSolvers read that Page’s new leads. The access key is stored encrypted and is never shown in the app or sent to anyone’s browser.
- About each lead: the answers the person typed into the clinic’s form (usually name, email and phone number, plus any other questions the clinic added), whether they ticked a consent box, the form name, the campaign, ad set and ad names, whether it came from Facebook or Instagram, and when it was submitted.
How we use it
- Only to add the lead to that clinic’s Leads list and to run the clinic’s own follow-up settings. The lead belongs to the clinic, and SoapSolvers handles it on the clinic’s behalf, the same way as patient information (see section 1).
- We don’t sell this information, use it for our own advertising, or share it with other clinics.
- We follow Canada’s anti-spam rules (CASL) and do-not-call rules for lead follow-up. Every follow-up email includes a one-click unsubscribe link, and anyone who asks not to be contacted is put on the clinic’s do-not-contact list.
How long we keep it
- The Page access key is deleted as soon as the clinic disconnects the Page.
- Leads stay in the clinic’s account until the clinic deletes them. A clinic Owner can permanently delete a lead at any time. Do-not-contact requests are kept so they keep being respected.
Disconnecting and deletion requests
- A clinic can disconnect its Page at any time in Settings → Marketing → Facebook & Instagram lead ads → Disconnect, or remove SoapSolvers in Facebook under Settings & privacy → Settings → Business integrations.
- If you filled out a clinic’s lead form and want your information deleted, please contact that clinic directly. If you email our Privacy Officer at info@soapsolvers.com, we will forward your request to the responsible clinic and assist them in fulfilling your deletion request within 30 days. Step-by-step instructions: Data deletion instructions.
15. Contact us
Privacy Officer, SoapSolvers Inc.
Email: info@soapsolvers.com
If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).