Privacy Policy

Concord Health Inc. ("Concord," "we," "us") operates the clinical trial matching platform at concordhealth.ca. We are a federally incorporated Canadian company. Our Privacy Officer is Andrew Stephen, reachable at privacy@concordhealth.ca.

Concord is an informational tool that helps patients discover clinical trials that may be relevant to their medical situation. It does not determine eligibility, make diagnoses, or provide medical advice. Only a qualified healthcare provider and the trial site can assess eligibility after proper screening.

Concord also lets you save trials to a private Collection, follow conditions to receive automatic alerts about new trials, share trials with your own doctor, and — only if you ask — get help from a person at Concord in approaching a study team. The study team alone decides who takes part.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Personal Health Information Protection Act (PHIPA). If you are located in Quebec, the provisions of Law 25 (Act respecting the protection of personal information in the private sector) also apply.

What we hold depends on how you use Concord. Each of the following is separate; using one part never requires another.

Browsing without an account

Nothing here identifies you.

• Searches and filters you use (not stored against any identity)
• If you use "near me": your location is resolved in your browser and stays there. It is not sent to our servers except as a search parameter.
• Trials you save before signing up live in your browser's local storage only

Explorer account

• First name; last name only if you add it; email; how you sign in (password, emailed link, or Google)
• Your Collection and Care Package (saved trials), followed conditions, notification settings, and learning progress (which terms and articles you've read)
• Your own activity while signed in (visits, trials viewed or saved), counted to see whether Concord is useful — never combined with anonymous browsing, never shown to sites or sponsors as your personal details

Trial alerts

• Your email address, the conditions or trial you asked about, and your consent record

Get Matched

• Age and sex
• Medical diagnosis and condition details
• Cancer stage, biomarkers, and prior treatments (if applicable)
• Performance status (ECOG score)
• Province, city, and travel preferences
• Your goals and preferences for trial participation

Enrolment help

• The trial you asked about, the fact that you asked, and the email address we use to reply (we write from help@concordhealth.ca)
• If you turn on "Concord may reach out": a record of that choice and when you made or withdrew it

Sharing with your doctor

• Your name, the doctor's name and email or fax number, the trials you chose, and any personal message

Clinician accounts

• Name, email, and clinic affiliation
• Professional license number (for verification)

Automatically

• Session cookies (expire after 24 hours)
• Security and audit logs: a one-way hash of your IP address and browser type, so we can detect abuse without storing who you are
• Consent records with version and timestamp

• Trial matching: We compare your medical profile against published clinical trial eligibility criteria from ClinicalTrials.gov to identify potentially relevant trials.
• Trial alerts: To email you when new trials appear for conditions you follow, only if you asked.
• Enrolment help: If you ask for help with a study — or if you've turned on "Concord may reach out" — a person at Concord reads your request or looks at the trials you've saved and decides whether to email you. This is never automated. Concord does not decide whether any study is a fit for you; the study team does. Nothing goes to a study team unless you tell us to.
• Clinician communication: When you choose to share results with your doctor, we send a summary via fax or email to the clinician you designate.
• Service improvement: Aggregate, de-identified data may be used to improve matching accuracy.
• Security: To detect abuse and keep accounts safe.

• All data is stored on servers located in Canada (Toronto). Backups are encrypted before they leave the server and are stored in Toronto.
• Data is encrypted in transit (TLS/HTTPS)
• Your saved trials, followed conditions, enrolment requests, sharing details and health profile fields are encrypted at rest (AES-256-GCM). Your name and email are account identity and are stored in the clear.
• Authentication uses secure, hashed passwords and time-limited sessions (24 hours)
• Access is role-based (patient, clinician, admin)
• We maintain audit logs for compliance purposes

We do not sell your personal information. We share data only in these circumstances:

• With your clinician: Only when you explicitly initiate a share
• With trial sites: Only when your clinician submits a referral on your behalf, or when you ask us to help you approach a study team and confirm what will be sent
• ClinicalTrials.gov: A public registry we read from. Nothing about you is sent.
• DigitalOcean (Toronto, Canada): Hosts the service and stores the database.
• Resend: Delivers our emails; processes the email addresses we send to.
• SRFax: Transmits faxes to clinics you name.
• Google: Only if you sign in with Google: Google confirms your email and name to us. No health information goes to Google.
• Sentry (EU-hosted): Receives technical error reports so we can fix bugs. We configure it not to receive health information or personal identifiers.
• Law enforcement: Only if required by law or a valid court order

We do not currently use any AI service to process your health information.

• Patient health data: Retained for up to 2 years after your last activity, then securely deleted
• Explorer accounts: Kept until you delete them; deleted immediately on request from your profile
• Consent records: Retained for 7 years
• Audit logs: Retained for 6 years
• Session data: Automatically deleted after 24 hours
• IP address and browser hashes: Removed from log records after 30 days
• Emailed sign-in links: No more than 30 days after use; password-reset links: 7 days
• Fax and email delivery logs: 90 days

Under PIPEDA and PHIPA, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Withdraw consent at any time (this may limit our ability to provide the service)
• Request deletion of your personal information
• File a complaint with the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario

Explorer account holders can export or delete their data instantly from their profile page — no request needed.

To exercise any of these rights, contact our Privacy Officer at privacy@concordhealth.ca. We will respond within 30 days.

We ask for consent at each step, separately, in plain language — creating an account, turning on trial alerts, using Get Matched, asking for enrolment help, allowing Concord to reach out, and sharing with your doctor are each their own choice. No box is pre-checked and no choice is bundled with another. Each consent is versioned and timestamped, and you can withdraw any of them — from your profile where a control exists, or by writing to privacy@concordhealth.ca. Withdrawing one never affects the others.

We use essential cookies only: tm_session (keeps you signed in, 24 hours) and tm_clinician_session (set only when a doctor opens a page you shared with them, so they can return to it for 72 hours without signing in), plus short-lived settings cookies that carry no personal information. We use your browser's local storage to hold your Collection before you sign up, your Care Package, a location you've chosen for "near me", your learning progress and self-assessment answers, and small display preferences. Nothing in local storage is sent to us unless you sign up (when your saved trials move into your account) or run a search. We use no advertising or cross-site tracking cookies.

If you use Concord to look for trials for someone else, you may enter information about their condition. Please only do this with their knowledge and agreement (or as their substitute decision-maker). We treat that information with the same protections as your own, and the other person has the same rights to it — including asking us to delete it.

Concord is for adults. We do not knowingly create accounts for anyone under 18. Some trials in the registry enrol children; they are findable by condition search, but Concord does not offer a children's browse filter.

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be posted on this page with an updated date. If you have an account, we will notify you by email of significant changes.

Privacy Officer

Andrew Stephen

Concord Health Inc.

privacy@concordhealth.ca

For anything that is not a privacy matter: hello@concordhealth.ca.