Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how TeKanAid Solutions Inc. ("we", "us", or "our") collects, uses, and protects information when you use NextEMR ("the Platform") at nextemr.com and the associated application at app.nextemr.com.

This Policy applies to clinic organizations, healthcare providers, and administrative users of the Platform. By using NextEMR, you agree to the collection and use of information as described here.

2. Data Controller

Where tenants collect and control personal data about their own end users through the Platform, TeKanAid Solutions Inc. acts as a data processor on behalf of the tenant (the data controller) for that data.

3. Data We Collect

Authentication & Identity

• Email address, display name, and account identifier
• Authentication and session information used to secure account access
• Email verification status

Organizational & Team Data

• Tenant ID and organization name
• Authorized-user roles and permissions
• Invite records (invited by, invite date)
• Account status and join date

Clinical & Operational Information

• Patient, appointment, clinical, prescription, billing, and document information entered by authorized clinic users
• Security, audit, and operational records necessary to provide and protect the Platform

Payment & Billing

• Stripe customer ID and subscription plan
• Payment history and invoice data
• Billing contact email
• We do not store full card numbers; Stripe handles payment data

Usage & Analytics

• IP address, browser type, device type, operating system
• Pages visited, navigation patterns, access timestamps
• Feature usage patterns and session frequency

AI-Enabled Features

• Audio, transcripts, prompts, and AI-generated clinical documentation when an authorized clinic enables and uses an AI feature
• The applicable customer agreement identifies the approved AI service providers and processing terms

Support & Communications

• Contact form submissions (name, email, message)
• Support ticket history and email correspondence
• Please do not submit patient health information through the marketing contact form

4. Legal Basis for Processing (GDPR)

For users in the European Union and UK, we process personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services you have subscribed to
• Legitimate interests: Security monitoring, fraud prevention, platform analytics, and improving our services
• Consent: Marketing communications (you may withdraw consent at any time)
• Legal obligation: Where required by applicable law

5. How We Use Your Data

• Authenticate users and manage account access
• Provide clinical, administrative, billing, and patient-communication workflows requested by authorized clinic users
• Process payments and manage subscriptions
• Send transactional emails (verification, invitations, password resets)
• Maintain audit records, support the Platform, and resolve technical issues
• Provide approved AI-enabled clinical documentation features when enabled by a clinic
• Monitor platform performance and security
• Prevent fraud and enforce these Terms of Service
• Send marketing communications (with your consent, opt-out available)

6. Multi-Tenant Architecture & Data Access

The Platform uses a multi-tenant architecture where all tenant data is logically isolated using a unique tenant identifier. This means:

• Your organization's data is not accessible to other tenants
• Authorized clinic administrators can manage users and access relevant organizational information
• TeKanAid Solutions Inc. staff may access data for support, security, and legal compliance purposes

Where a tenant controls personal data about their end users, the tenant acts as the data controller and TeKanAid Solutions Inc. acts as the data processor.

7. Third-Party Sub-Processors

We share data with the following third-party service providers to operate the Platform:

We also share information when required by law, court order, or to protect the rights, safety, or property of TeKanAid Solutions Inc. or others. In the event of a business transfer (merger or acquisition), user data may be transferred with appropriate notice.

8. International Data Transfers

NextEMR's Canadian offering is intended to use Canadian hosting. Some enabled services, including payment processing and any approved external clinical service provider, may process limited information outside Canada.

We identify applicable service providers and transfer safeguards in the customer agreement and data-processing terms. We do not use the marketing contact form for patient health information.

9. Data Retention

• Active accounts: Data retained for the duration of your subscription
• Account closure and backups: The applicable customer agreement identifies deletion, export, and backup-retention commitments
• Legal holds: Extended retention where required by applicable law
• Billing records: Retained for the period required by tax and accounting regulations

10. Your Rights

GDPR Rights (EU / UK)

If you are located in the EU or UK, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw marketing consent at any time

CCPA Rights (California)

If you are a California resident, you have the right to:

• Know: What personal information we collect and how it is used
• Delete: Request deletion of your personal information
• Opt-out of sale: We do not sell personal information
• Non-discrimination: We will not discriminate for exercising your rights

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

11. Security

We implement industry-standard security measures to protect your data:

• Authenticated access controls and session management
• HTTPS/TLS encryption for all data in transit
• Role-based access control (RBAC) enforced at the application and database level
• Logical separation of clinic data and application-level authorization controls
• Security logging, monitoring, and incident-response processes appropriate to the service
• Regular security reviews and audits

No security system is impenetrable. If you believe your account has been compromised, contact [email protected] immediately.

12. Cookies & Tracking

We use cookies and browser storage necessary to provide and secure the Platform:

• Authentication cookies: Essential for maintaining your logged-in session
• Local storage: Used for application preferences and session-related state

We do not sell personal information. Marketing-form processing is limited to delivering the form and consent-based communications.

13. Children's Privacy

The Platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a minor has provided us with personal data, contact us at [email protected].

14. Policy Updates

We may update this Privacy Policy periodically. For material changes, we will notify you via email before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision.

Continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy.

15. Contact

For privacy-related questions or to exercise your data rights: