Data Privacy Policy
Effective Date: January 25, 2026
1. Introduction
CO-MD Inc. is a specialized Software-as-a-Service (SaaS) provider dedicated to the healthcare and education sectors. We maintain an unwavering commitment to the privacy and security of all personal and health-related information acquired through our digital platforms, adhering strictly to legal mandates and informed user consent.
This policy delineates our protocols for collecting, utilizing, storing, and safeguarding sensitive information. Our operations are fully compliant with rigorous data protection frameworks, including Ontario’s Personal Health Information Protection Act (PHIPA), the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and other relevant privacy legislation.
By utilizing CO-MD services, you acknowledge that you have reviewed this Privacy Policy and consent to the data practices described herein, subject to your statutory rights under applicable law.
2. Scope of Data Collection
CO-MD processes personal and health-related data exclusively to the extent necessary to operate and optimize our software services, facilitate academic analytics, and conduct authorized research in accordance with legal requirements and user consent.
User-provided data, including educational background, professional training records, and health-related information—such as clinical case studies, simulated diagnoses, and treatment outcomes—entered for educational or analytical purposes.
Technical and usage metadata, including interaction logs, feature engagement patterns, and performance metrics, utilized to maintain platform integrity and enhance the overall user experience.
Research and analytical datasets, which consist of aggregated or de-identified information used for academic studies, product innovation, and validation in compliance with privacy regulations.
CO-MD does not intentionally acquire direct personal identifiers such as government-issued ID numbers, financial data, or precise geolocation. Data processing is restricted to what is reasonably required for our stated institutional objectives and handled per legal standards.
3. Data Utilization & Compliance
CO-MD does not engage in the sale of personal or health-related information (PHI). We utilize such data solely for legitimate, lawful purposes, ensuring alignment with user consent and the operational requirements of our healthcare and education services.
Authorized uses include:
Operating and optimizing CO-MD platforms, including the delivery of personalized learning features, advanced analytics, and core system functionalities.
Facilitating educational and clinical research via aggregated or de-identified data for model validation and institutional quality improvement.
Generating evidence-based insights to improve clinical decision-support tools and overall software performance without disclosing individual identities.
Ensuring system security, preventing fraudulent activity, and fulfilling legal, regulatory, and contractual obligations.
Prohibited activities include:
Selling, marketing, or otherwise commercially exploiting personal health-related information.
Linking datasets in a manner that could potentially identify an individual without explicit consent and required institutional approvals.
Attempting the re-identification of anonymized or de-identified data, except where mandated by law or authorized legal frameworks.
4. Security & Data Protection Protocols
CO-MD employs robust administrative, technical, and organizational safeguards to protect information against unauthorized access, disclosure, or loss.
Security measures include:
Encryption of data during transmission and at rest using industry-standard cryptographic protocols.
Utilization of secure infrastructure with rigorous access controls and monitoring consistent with global best practices.
Role-Based Access Control (RBAC) to ensure that data access is restricted according to the principle of least privilege.
Systematic security audits and privacy impact assessments commensurate with the sensitivity of the data processed.
Defined incident response and breach management procedures aligned with regulatory and contractual mandates.
5. Access Control & Information Sharing
We maintain a strict data governance framework to ensure that information sharing is controlled and consistent with user consent and legal requirements.
Authorized parties may include:
Validated users, including students and healthcare professionals, accessing their personal information or assigned platform features.
Authorized CO-MD personnel and service providers performing essential operational, maintenance, or security functions under confidentiality agreements.
Institutional partners or researchers granted access to de-identified information for approved educational or research initiatives.
CO-MD strictly prohibits access to personal information by third-party advertisers, data brokers, or insurers.
6. Regulatory Compliance
CO-MD is dedicated to maintaining compliance with data protection laws in all operational jurisdictions. We may act as a data controller or processor depending on the specific institutional arrangements and legal context.
Compliance measures include:
Strict data minimization practices ensuring information is collected only for clearly defined and lawful purposes.
Implementation of advanced anonymization techniques when personal identification is not required for the objective.
Internal governance controls for data retention, sharing, and cross-border processing as required by law.
7. Individual Rights & Data Management
CO-MD respects individual rights regarding personal data, subject to applicable legal limitations.
These rights include:
The right to access information regarding the collection and utilization of personal data through our platforms.
The right to request the rectification of inaccurate or incomplete personal records where permitted by law.
The right to withdraw consent or request data deletion, subject to legal and operational requirements.
8. Amendments to This Policy
CO-MD reserves the right to update this Privacy Policy to reflect technological advancements, regulatory changes, or updated security standards.
Significant amendments will be communicated via our official website. Continued utilization of our services constitutes acceptance of the updated policy to the extent permitted by law.