PRIVACY POLICY Genuvis Health Clinic

---

 We welcome you to Genuvis Health! Led by our Medical Director Dr. Sana-Ara Ahmed, alongside her Genuvis care team. Dr. Ahmed is a practicing clinic Anesthesiologist and Chronic Pain Specialist. Her approach at Genuvis Health provides innovative, integrative, and personalized pain management solutions. Our goals of Genuvis focus on accurate pain diagnosis, opioid harm reduction, and a collaborative approach to improve the overall quality of life.    

 Genuvis Health (“we,” “us,” “our”) is committed to protecting your privacy and safeguarding the personal and health information we collect. This Privacy Policy explains how we collect, use, disclose, and protect information through our website and digital services. It also incorporates our obligations as a custodian under the Alberta Health Information Act (HIA) in relation to identifiable health information.  https://genuvishealth.com/  By using our website, submitting information, or receiving services from Genuvis Health, you consent to the practices described below. 

Genuvis Health acts as a custodian under the Alberta Health Information Act (HIA). As custodians, we comply with all requirements for the collection, use, disclosure, retention, and safeguarding of health information.

We do not rely on “legitimate interest” as a basis for processing identifiable health information. All handling of health information is based on:

• Patient consent, or
• HIA-authorized purposes, such as providing health services, administration, quality improvement, or evaluation.

We collect two categories of information:

A. Personal Information (Non-Health Information)

Collected through our website, including:

Name

Email address

Phone number

Messages submitted through contact forms

Appointment requests

This information is collected only when voluntarily provided.

B. Health Information (HIA-Protected Information)

If you submit medical or health-related information through our online forms, intake forms, or communication channels, this information becomes identifiable health information under the HIA.

We treat all such information according to our health-information privacy obligations (Sections 3–10).

Our website may use cookies or basic analytics tools to improve site functionality and understand general usage trends.

We do not collect any identifiable personal health information through cookies, analytics, or tracking technologies.
All health information remains strictly within our secure clinical systems.

We do not use third-party analytics providers.

We use personal and health information for the following purposes:

• Responding to inquiries
• Booking appointments
• Providing medical and clinical services
• Creating and maintaining patient records
• Administration, quality assurance, and clinic operations
• Compliance with legal and regulatory obligations

Health information is used only as permitted under the HIA or with patient consent

All third-party service providers who may handle or process identifiable health information on behalf of Genuvis Health Clinic will operate under Information Manager Agreements (IMAs) that meet requirements of Section 66 of the HIA.

You confirmed that no third-party services are currently used, but this clause ensures compliance if any are added in the future.

We complete and maintain Privacy Impact Assessments (PIAs) under Section 64 of the HIA for all new or significantly changed systems, applications, or processes involving identifiable health information.
PIAs will be submitted to and, where required, approved by the Office of the Information and Privacy Commissioner of Alberta (OIPC). 

We apply administrative, physical, and technical safeguards to protect all personal and health information, including:

• Encryption of data in transit and at rest
• Role-based access controls (staff access only as needed for duties)
• Audit logs of access and modifications to health records
• Secure user authentication
• Regular system monitoring
• Locked, restricted physical storage for paper records
• Mandatory privacy and security training for all staff and contractors

We retain personal and health information in accordance with:

• CPSA record retention standards
• HIA retention obligations
• Clinic operational requirements

When information is no longer required, it is securely destroyed using industry-standard protocols (e.g., secure digital erasure, shredding of physical documents).

In the event of a privacy or security breach involving identifiable health information, Genuvis Health Clinic will:

1. Immediately contain the breach
2. Investigate the cause
3. Assess harm and risk
4. Notify affected individuals
5. Notify Alberta Health and/or the OIPC as required under the HIA
6. Take corrective action to prevent recurrence

Genuvis Health does not currently store or transfer personal or health information outside Canada.

If at any time data storage or processing outside Canada becomes necessary, we will:

• Obtain informed patient consent
• Apply contractual and technical safeguards
• Inform individuals of the jurisdictions involved and any associated risks

Your Rights 

Under the HIA and applicable privacy laws, individuals have the right to:

• Request access to their health records
• Request correction of their information
• Request restrictions on use or disclosure (within legal limits)
• Ask questions or raise concerns about privacy practices

Requests may be directed to:

Genuvis Health

 We welcome you to Genuvis Health! Led by our Medical Director Dr. Sana-Ara Ahmed, alongside her Genuvis care team. Dr. Ahmed is a practicing clinic Anesthesiologist and Chronic Pain Specialist. Her approach at Genuvis Health provides innovative, integrative, and personalized pain management solutions. Our goals of Genuvis focus on accurate pain diagnosis, opioid harm reduction, and a collaborative approach to improve the overall quality of life.    

 Genuvis Health Inc., its subsidiaries and affiliates (collectively “Genuvis”, “we”, “us”, or “our”) is committed to protecting your personal information and complying with applicable data protection and privacy laws. This Privacy Policy governs our collection, use, storage, and disclosure of Personal Information via our website at https://genuvishealth.com/ (the “Site”) and via related services offered through the Site (the “Services”).
This policy does not cover personal information collected through other websites or mobile apps operated by Genuvis unless explicitly stated. 

 For purposes of applicable privacy laws, Genuvis is generally the data controller for the Personal Information you provide to us. In some cases (for example when acting on behalf of a client or business), Genuvis may act as a data processor. You may contact us at hello@genuvishealth.com  with privacy-related enquiries. 

We collect the following categories of personal data:

• Usage data (such as page views, link clicks, time on page, browser type)
• Cookies and other tracking technologies
• Contact information: first name, last name, email address, phone number, address, city/province/state, postal/ZIP code, country
• Health-related or medical information you provide when registering for Services, booking appointments, or interacting with us (only where applicable)
• Payment and billing information (if applicable)
• Any other information you choose to provide (for example via contact forms, surveys, live chat, or other interactions with us)

Any required fields will be clearly marked when you provide data. If you choose not to supply mandatory information, the relevant Service may not be available to you.

 Your data is processed using secure technologies and systems on our operating servers, hosting facilities, and via third-party service providers (sub-processors) we engage. We implement reasonable technical and organizational measures to protect your Personal Information from unauthorized access, disclosure, alteration or destruction.
Some data may be accessible to our employees, contractors and suppliers who need access to perform tasks on our behalf. We may store or transfer data across borders (for example from Canada to the U.S. or other jurisdictions) in accordance with this policy. 

 We process your personal data under one or more of the following legal bases:

• You have given consent for one or more specific purposes
• The processing is necessary for the performance of a contract to which you are party (e.g., providing services)
• The processing is necessary for compliance with a legal obligation
• The processing is necessary for the legitimate interests of Genuvis or a third party, provided your rights and freedoms are respected

 We will retain your personal data for as long as is necessary to fulfil the purposes for which it was collected (for example to provide the Services, meet legal obligations, resolve disputes, enforce our agreements) or as otherwise required by law. When the data is no longer needed, we will securely delete or anonymize it. 

 We collect and use your data for the following purposes:

• To provide you with the Services you request (e.g., appointment booking, consultations) 
• To manage our customer and patient relationships and communications
• To process payments and billing 
• To operate, maintain, improve and secure our Site and Services
• To perform analytics and understand how users interact with our Site and Services
• To send newsletters, promotional materials, and marketing communications (where you have opted-in)
• To comply with legal, regulatory or contractual obligations
• To protect our interests (for example fraud prevention, security, audit)

We may engage third-party services (analytics, hosting, CRM, email marketing, payment, live chat, remarketing) that process Personal Information on our behalf. Examples include but are not limited to:

• Web analytics (e.g., Google Analytics)
• Email marketing platforms
• Payment processors 
• Hosting and infrastructure providers
  For each provider, data collected may include cookies or usage data, contact info, etc., and processing may occur in Canada, the U.S. or elsewhere. We ensure these providers meet appropriate standards for data privacy and security.

 If you register for our newsletter or opt-in to marketing communications, we may send you promotional emails or other messages. You may unsubscribe at any time by following the instructions in the email or contacting us.
If you submit a contact form or request (e.g., for information or a quote), we will use your details to respond, provide the requested services, and may include marketing messages if permitted. 

 Our Site uses cookies and similar technologies to collect usage data, improve our Services, personalize your experience, enable remarketing, and support analytics. You may manage or disable cookies via your browser settings; however disabling cookies may affect your experience on the Site. 

•  Depending on your jurisdiction, you may have the following rights in relation to your personal data:
• Withdraw your consent at any time (where the processing is based on consent)
• Object to our processing of your personal data (where processing is based on legitimate interests)
• Request access to the personal data we hold about you
  Request rectification of inaccurate or incomplete personal data
• Request restriction of processing under certain circumstances
• Request deletion (erasure) of your personal data under certain circumstances
• Request portability of your personal data (where technically feasible)
• Lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at hello@genuvishealth.com.  We will respond as soon as possible and in any event within any statutory time-frames.

We may disclose Personal Information if required to comply with a legal obligation, enforce our agreements, protect our rights, or in connection with legal claims or investigations.

We maintain system logs and undertake routine IT maintenance. These may record technical data such as IP addresses, device identifiers, request timestamps and paths, errors, and other diagnostic information.

Our Site currently does not respond to “Do Not Track” browser signals. If you wish to know whether any of our third-party services honour such signals, please refer to their privacy policies or contact us.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the “Last updated” date at the top. If required by law or as a courtesy, we may notify users via email or other means. We encourage you to review this page periodically.

• Personal Data: Any information relating to an identified or identifiable natural person.
• Usage Data: Data collected automatically when using the Site and Services (for example IP address, browser type, request URIs, time on page).
• User: The individual using the Site or Services.
• Controller: The entity that determines the purposes and means of processing personal data.
• Processor: The entity that processes personal data on behalf of the controller.
• Sub-processor: A third-party engaged by us (or by a processor) to process personal data.
• Cookie: A small piece of data stored on your device by our Site.