Compliance

Where you stand, and where we stand

NutriClient™ holds clinical records on behalf of your practice. That puts obligations on you, and different obligations on us. This page is about which is which.

The split that governs everything below

You are the custodian of your clients' records. We hold them for you, under your instructions.

That single sentence decides most of what follows. Privacy and health-information laws put the duty on the person who holds the record and decides how it is used — your practice. They put a different, narrower set of duties on the service provider that stores and processes it — us. We do not use your clients' information for our own purposes, and we do not sell it.

No software makes a practice compliant. We can give you a platform built to support the safeguards these laws ask for, the agreements they require, and honest documentation about where your data lives and who touches it. The practice's own conduct is the practice's own.

HIPAA — United States

Whether HIPAA applies to your practice depends on how you bill and transact. A practice that transmits health information electronically in connection with a covered transaction — most commonly, billing payers electronically — is a covered entity. A cash-pay practice that hands the client a superbill to submit themselves generally is not. Many wellness practices are not covered entities at all.

Where a customer is a covered entity and we handle protected health information on its behalf, we are that customer's business associate. That is not a status either of us elects — it follows from what we do with the information. As a business associate we are directly responsible for the HIPAA Security Rule safeguards, for using and disclosing protected health information only as the agreement and the law permit, for holding written agreements with any subcontractor that handles it, and for notifying you of a breach within the time the rule requires.

If your practice is a covered entity, you need a Business Associate Agreement with every vendor that handles protected health information — including us. We will sign one with you. Email privacy@effectwellness.com to start it.

We do not claim to be "HIPAA compliant" and we never will. No such status exists for a software product — there is no HIPAA certification, no approved-vendor list, and no regulator that issues one. Any vendor claiming otherwise is telling you something that is not true.

PIPEDA and the provincial privacy laws — Canada

In Canada our handling of personal information is governed by PIPEDA, and by the substantially similar private-sector laws of Alberta, British Columbia and Quebec where they apply. These apply to us unconditionally — there is no size threshold and nothing to sit under.

What that means in practice: we are accountable for information transferred to the providers who help us run the platform, and we are responsible for holding them to comparable protection. Where a provider handles production client information, a written data-processing agreement covers it. For most of our providers that agreement is part of their standard terms. Where a provider asks for a separate acceptance or signature, we complete it before that provider handles any client information. If you need to know where a specific provider stands, ask us and we will tell you rather than point you at a page. We tell you plainly where your data is held. We answer access and correction requests within the time the law allows.

And we have a named person accountable for all of it — Bryan Pachal, our Privacy Officer, at privacy@effectwellness.com.

One thing worth saying plainly, because it is asked constantly: Canadian privacy law does not require that Canadian data be stored in Canada. What it requires is comparable protection, a proper agreement with the processor, and openness about where the data is. Client records are held in the United States (Oregon), and our privacy policy sets out what that means for you, including in Quebec and Alberta.

PHIPA and the provincial health information acts

*The threshold question first, because it decides everything else: these laws attach to custodians, and we are never a custodian.*

Whether your discipline makes you a custodian (or trustee) under a provincial health information act depends on your profession and your province. Where you are one — under Alberta's Health Information Act, Ontario's PHIPA, or the equivalent statutes elsewhere — you hold the record and the duty, and we act as your service provider under a written agreement carrying the obligations the statute requires of that role: an information manager in Alberta and Manitoba, an agent or electronic service provider in Ontario, an information management service provider in Saskatchewan.

Where your discipline is not designated, the health act does not attach, and the same clinical information is protected under PIPEDA or your province's private-sector law. Our obligations to you are the same in substance either way — the difference is which document names them.

Quebec

Quebec's private-sector privacy law applies to personal information about people in Quebec, and it is the strictest privacy regime in the country. We publish the person in charge of protecting personal information, our governance policies in clear language, the fact that information is held outside Quebec and who assesses that transfer (your practice for its client records, using the assessment pack we provide; us for our own), your rights and how to use them, and how to complain to us or to the Commission d'accès à l'information.

Separately — and it is a different law, not part of the one above — Quebec's language legislation governs the language of contracts, invoices and commercial documents. Our contractual documents, invoices and receipts are available in French, and where you are in Quebec the French version of an agreement is provided to you before you agree to it.

United States — state laws

California. California's Confidentiality of Medical Information Act treats a business offering software that maintains medical information as a provider of health care. We handle medical information under that Act, we disclose it only as the Act permits or as your practice directs, and we do not disclose it for marketing.

Washington and Nevada. Their consumer health data laws apply to us with no size threshold. Our separate Consumer Health Data Privacy Policy sets out what we collect and what you can do about it. We do not sell consumer health data.

What does not apply — and why we are saying so

A compliance page that only lists what applies is telling you half the story.

• We hold no certification, from anyone. There is no HIPAA certification, no PIPEDA certification, no PHIPA certification. They do not exist for software products.
• We are not registered with any privacy regulator, because none of them operate a vendor registry.
• The CCPA and CPRA do not currently apply to us — we are below every threshold that triggers them. If that changes, this page changes before it does.
• We do not extract or use biometric identifiers such as faceprints or voiceprints. Telehealth sessions a practice records contain faces and voices, and we do not process them to identify anyone.
• We are not offered in the EU, the UK or Australia, and we make no claim of readiness under the laws of those regions.

Questions

Questions, or a compliance questionnaire you need answered? Email privacy@effectwellness.com.