Version 1.1 — Effective June 15, 2026
1. Introduction
Tarsi Inc. ("Tarsi", "we", "us", "our") operates a multi-tenant electronic medical record and practice-management platform for Canadian medical-aesthetics clinics. This Policy explains how we handle personal information in connection with our website and platform. It is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for the personal information of Quebec residents, Quebec's Act respecting the protection of personal information in the private sector (Law 25, CQLR c. P-39.1). This Policy is distinct from our Patient Privacy Notice (which addresses personal health information held on behalf of clinics under Ontario's Personal Health Information Protection Act, 2004 ("PHIPA")).
2. Our Two Roles
2.1 As Electronic Service Provider and Agent to clinics. When a clinic uses Tarsi to manage patient records, the clinic is the Health Information Custodian and Tarsi acts as its Electronic Service Provider ("ESP") and Agent under PHIPA. The clinic controls that information; Tarsi processes it only on the clinic's instructions and does not use it for its own purposes. Patients direct questions about their health record to their clinic.
2.2 As the organization responsible for its own data. For information Tarsi collects directly — clinic-operator accounts, Tarsi's own marketing contacts, website visitors, and the cross-clinic login credentials patients use to access the patient portal — Tarsi is the organization responsible under PIPEDA and Law 25.
3. Categories of Personal Information We Process
- Patient identifiers: legal name, date of birth, sex and gender, contact details, home address, the last four digits and issuing jurisdiction of government identifiers (health card, driver's licence, passport), and a shared patient-identity record used across the clinics a patient visits.
- Personal health information (PHI): clinical chart entries and notes, diagnoses and conditions, medications, allergies, contraindications, implants and devices, Good Faith Examinations, treatment photographs, and pregnancy/skin-type and similar clinical attributes.
- Financial information: payment-method tokens and processor customer identifiers (we do not store full card numbers); invoices, balances, and operator subscription-billing data.
- Staff and provider information: name, email, phone, professional licence number, and compensation data.
- Marketing and communications data: campaign recipient lists, consent records, and unsubscribe states.
- Technical information: IP address captured at the moment of consent signing (through the service ipify), device and log data, and behavioral analytics described in Section 11.
4. The Cross-Clinic Shared Identity Model
Tarsi maintains a single shared patient-identity record so that a patient who attends multiple Tarsi clinics has one identity rather than duplicate profiles. Holding one identity does not, by itself, share clinical history between clinics. Cross-clinic sharing of clinical history is off by default and occurs only with the patient's explicit, purpose-specific consent, which the patient can revoke at any time (see the Cross-Clinic Data Sharing and Patient Network Consent).
5. Why We Process Personal Information
To provide, maintain, and secure the platform; authenticate users; process payments; deliver appointment, account, and (where consented) marketing communications by email and SMS; provide optional artificial-intelligence assistance for clinical documentation; support clinic onboarding; prevent fraud and abuse; and communicate with clinic operators. We collect only what is necessary for these purposes.
6. Sub-Processors
We engage the following sub-processors. A current list is maintained and provided on request.
| Sub-processor | Function | Data category | Location |
|---|---|---|---|
| Supabase | Primary database and file storage | All platform data, including PHI | Canada (ca-central-1) |
| Cloudflare | Application hosting, CDN, edge delivery | Platform traffic; no PHI stored at rest | Global edge; U.S. entity |
| Stripe | Card payment processing and subscriptions | Patient/operator name, email, payment tokens | United States |
| Clover | In-person payment terminals | Patient name, transaction and line-item data | United States |
| Rotessa | Operator subscription billing only (pre-authorized debit). No patient PHI. | Clinic/operator name, email, banking authorization | Canada |
| Resend | Transactional and marketing email delivery | Recipient email/name; message content | United States |
| Telnyx | SMS delivery | Recipient phone number; message content (clinical detail excluded by design) | United States |
| Anthropic | AI assistance for clinical documentation | Chart text, clinical context (allergies, conditions), raw consultation transcripts, patient names, message bodies, and treatment names | United States |
| OpenAI | AI audio transcription for clinical note assistance (Whisper API) | Consultation audio submitted for transcription | United States |
| Google / Firecrawl | Clinic-onboarding website extraction | Public business website data only; no PHI | United States |
| ipify | IP-address capture at consent signing | IP address | United States |
| PostHog | Product-usage analytics | PHI-free product-usage events; opaque user/organization identifiers only | European Union (Cloud-EU) |
7. Data Residency and Cross-Border Processing
7.1 Primary patient and clinic data is stored in Canada (Supabase, ca-central-1). 7.2 Certain sub-processors operate in the United States (Stripe, Clover, Resend, Telnyx, Anthropic, OpenAI, Cloudflare edge, ipify). Product-usage analytics are processed by PostHog in the European Union (Cloud-EU). Personal information processed by these providers may be transferred to, processed in, or accessed from those jurisdictions and may be subject to lawful-access requests by foreign authorities. 7.3 For the personal information of Quebec residents, before any transfer outside Quebec, Tarsi conducts a privacy impact assessment under s. 17 of Law 25, considering the sensitivity of the information, the purposes of its use, the protection measures (including contractual) that would apply, and the legal framework of the destination jurisdiction. Information is transferred only where the assessment establishes that it would receive adequate protection, and each transfer is governed by a written agreement reflecting the assessment.
8. Retention
We retain personal information only as long as necessary for the purposes identified or as required by law. Health information held on behalf of clinics is retained according to the clinic's instructions and applicable retention law (see the Records Retention and Disposition Schedule). Operator account and billing records are retained for the life of the account and for the period required by tax law (the Canada Revenue Agency generally requires business records to be kept for six years from the end of the relevant tax year).
9. Your Rights
9.1 Access and correction (PIPEDA and Law 25). You may request access to, and correction of, the personal information Tarsi holds about you as an organization. We respond within 30 days. 9.2 Erasure, de-indexation, and portability (Law 25). Quebec residents may request that we cease disseminating personal information and de-index it where the legal conditions are met; request deletion where applicable; and receive a copy of the computerized personal information they provided to us in a structured, commonly used technological format (data portability). 9.3 Automated decision-making. Tarsi does not make decisions producing legal or similarly significant effects about individuals based exclusively on automated processing. AI documentation assistance is clinician-reviewed decision support, not automated decision-making. 9.4 Health records. Requests concerning a patient's health record are handled by the clinic custodian under PHIPA (see the Patient Privacy Notice).
10. Consent
We rely on consent appropriate to the sensitivity of the information. Under Law 25, consent is clear, free, and informed, given for specific purposes, requested in clear and simple language and separately from any other information; express consent is required for sensitive personal information, which includes medical information. In Quebec, the age of consent is 14; for a person under 14, consent is given by the person having parental authority or the tutor.
11. Cookies, Tracking, and Analytics
The platform uses first-party behavioral analytics captured server-side — for example, page views, photo views, and navigation events within the patient portal — to operate and improve the service. We also use PostHog (hosted in the European Union, Cloud-EU) for product-usage analytics; PostHog is configured to receive no personal health information — only PHI-free product-usage events keyed to opaque user and organization identifiers. We do not use advertising software-development kits, and we do not sell personal information. Tracking technologies that identify, locate, or profile an individual are deactivated by default for Quebec users and activated only with their opt-in.
12. Safeguards
We maintain administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access controls, least-privilege design, written confidentiality undertakings for personnel, and event-level audit logging.
13. Privacy Officer and Complaints
Our Privacy Officer can be reached at privacy@tarsi.ca. You may also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
14. Language
A French-language version of this Policy is available on request and governs for Quebec residents.
15. Changes
We may update this Policy and will post a revised effective date. Version 1.1 — June 15, 2026.