Privacy Policy of Doctomia
Last updated:
2026-05-10
At Doctomia, the security and confidentiality of your data are a top priority. We strictly comply with the provisions of Law 25, Quebec’s legislation governing the protection of personal information in the private sector. Accordingly, we are committed to ensuring a high level of protection for your personal data throughout your use of the Platform.
1. Introduction
Welcome to Doctomia (hereinafter referred to as “the Platform”), a platform dedicated to booking private healthcare and wellness appointments in Quebec. The Platform is developed and operated by Technologies Rabbitdoc Inc., a legally incorporated business corporation in Quebec.
This privacy policy explains how we collect, use, store, and share your personal information when you use the Platform. It also outlines our commitment and the measures in place to ensure the security and confidentiality of your personal data.
We encourage you to read this policy carefully to understand how we process your data and to be aware of your rights in this regard.
By using the Platform, you accept the terms outlined in this policy. If you are a user—whether a patient, healthcare professional, or representative of a healthcare facility—and you do not consent to the collection and processing of your personal data under the terms described herein, we ask that you refrain from using the services provided by the Company.
2. Types of Data We Collect
In the course of using the Platform, the Company may collect various types of personal information from users, depending on their profile (patient, healthcare professional, or representative of a healthcare facility). These data are collected solely for the purpose of delivering the services offered on the Platform and ensuring their proper operation.
2.1 Data Collected from Patients
The following data are collected when a patient fills out the appointment request form on the Platform:
- First and last name
- Email address
- Phone number
- Postal code
- Appointment-related information, including:
- Reason for consultation
- Preferred consultation location
- Whether the patient is a new patient
- Preference for a specific healthcare professional or facility
- Desired appointment date
- Preferred time slot
- Additional details for the request: any information provided by the user in the dedicated form section (required).
- Whether the appointment is for the user themselves or for a dependent.
When an appointment is requested for a dependent, we also collect the following information about that person:
- First name
- Last name
- Date of birth
- Gender
These data are required to enable the healthcare professional or facility to review the appointment request and contact the patient to confirm or schedule the consultation.
2.2 Data Collected from Healthcare Professionals or Facilities
The following information is collected when the contact form is completed on the Platform, either to list an individual healthcare professional or a healthcare facility.
- If the form is completed by a healthcare professional to list their services, we collect the following information:
- First and last name
- Medical specialty or specialties
- Phone number
- Email address
- Practice postal code
- Preferred contact method (phone or email)
- Questions or comments (optional field for clarifying a request or sending a message to the Company)
- If the form is completed by a representative of a healthcare facility to register its services, we collect the following information:
- Name of the medical clinic
- Medical specialty or specialties
- Name of the person completing the form
- Their role within the clinic (e.g., manager, physician, administrative assistant)
- Phone number
- Email address
- Postal code of the clinic
- Preferred contact method (phone or email)
- Questions or comments (optional field)
This information is used by the Company to contact the healthcare professional or facility, understand their needs, and assess their potential integration into the Platform.
2.3 Technical and Browsing Data
We also collect technical information, such as:
- IP address (stored for 30 days)
- Timestamp and navigation data on the Platform
These technical data are used to ensure the security, stability, and proper performance of the Platform.
3. Use of Data
The personal data collected by the Company through the Platform is used solely for the provision, improvement, and management of the services offered. Specifically, it enables:
3.1 For Patients:
- To forward the appointment request to the relevant healthcare professional or facility.
- To allow the healthcare professional or facility to contact the patient to schedule the appointment.
- To follow up on the request or respond to any questions related to the appointment.
- To communicate with the patient as needed (appointment changes, cancellations, additional information, etc.).
- To improve the quality and relevance of the services offered.
3.2 For Healthcare Professionals or Facilities:
- To respond to listing or registration requests submitted via the contact form.
- To communicate with the healthcare professional or facility to better understand their needs and propose appropriate integration into the Platform.
- To establish and maintain a professional relationship with partnered healthcare professionals or facilities.
- To manage and update profiles displayed on the Platform.
3.3 For All Users:
- To ensure the technical operation and security of the Platform.
- To prevent fraud, misuse, or unauthorized activities.
- To comply with applicable legal or regulatory obligations.
- To conduct internal analyses to improve the service (statistics, performance, user experience), using anonymized data that cannot be used to identify individual users.
4. Access to and Sharing of Data
The Company is committed to never selling, renting, or transferring your personal data to any third party.
Access to and sharing of your data is strictly limited to the cases necessary for providing the services offered on the Platform or where required by law.
Personal data may be accessed or shared in the following cases:
4.1 With Healthcare Professionals or Facilities
When you submit an appointment request through the Platform, your information is shared exclusively with the relevant healthcare professional or facility so they can process your request and contact you to confirm or schedule the appointment.
4.2 With Technical Service Providers
Some data may be shared with third-party service providers who assist us in the technical operation, security, and hosting of the Platform. These providers have access to data only as part of their duties and are bound by strict confidentiality obligations.
In the context of hosting and securing the Platform, certain third-party services may have limited access to data:
- Amazon Web Services (AWS): The data we collect is hosted in Canada using Amazon Web Services (AWS) infrastructure. As a cloud hosting provider, AWS enforces strict security standards, including encryption, fine-grained access control, and high availability. In accordance with Law 25, your data remains under our exclusive control. AWS does not access your information unless legally required to do so. As an organization, we remain responsible for the secure configuration of our environments and for complying with legal obligations related to data privacy and protection.
- Cloudflare: As a network protection and optimization service, Cloudflare may process certain metadata (such as IP addresses, connection logs, or network traffic) to ensure the Platform's security, performance, and resilience. Cloudflare does not access users' personal data.
- Calendly: We use the Calendly service solely for medical prospecting purposes, to facilitate the scheduling of appointments with healthcare professionals. In this context, certain contact information (name, email address, and optionally professional phone number) is collected and processed by Calendly. This data is transferred to and hosted in the United States, under a legal framework different from that of Quebec (Cloud Act). Calendly applies security measures in line with international standards (encryption, access controls, confidentiality), as described in its Data Processing Addendum (DPA) effective as of March 8, 2024. We strictly limit the collection to the information necessary for prospecting purposes.
- Sentry: We use Sentry, an application error monitoring and performance tracking service. Sentry collects technical data (error messages, stack traces, browser type, operating system, anonymized IP address) to help us quickly identify and fix Platform issues. Sentry does not have access to users' personal data beyond this technical information. Data is processed in the United States in accordance with Sentry's security and confidentiality commitments (DPA).
- Google Analytics: We use Google Analytics, a web analytics service provided by Google LLC, to better understand how users interact with the Platform. Google Analytics collects anonymized data such as pages visited, session duration, device type and browser used, as well as approximate location data. No personally identifiable information is transmitted to Google. This information is used exclusively to improve the user experience and Platform performance. Data is processed in the United States. You may opt out of Google Analytics data collection by installing the browser add-on available on Google's website.
4.3 In the Event of a Legal Obligation
The Company may be required to disclose certain personal data in response to a lawful request from a competent authority (e.g., court order, government investigation), in accordance with applicable laws.
4.4 To Prevent Fraud or Ensure Security
Data may be used or disclosed to detect, prevent, or address fraudulent activity, abuse, or threats to user or Platform security.
4.5 Internal Use
Only Doctomia employees and representatives who are bound by professional secrecy or a confidentiality agreement have access to your data, and only to the extent necessary for managing appointments, providing user support, or carrying out essential operational tasks related to the services.
5. Data Retention
The Company retains personal data only for as long as necessary to fulfill the purposes for which it was collected.
- Information collected in connection with an appointment request is retained only for the time needed to process the request, after which it is anonymized.
- Information provided via the contact form by a healthcare professional or a representative of a healthcare facility is retained for as long as necessary to assess the registration request and, where applicable, to establish a relationship with the Platform and maintain an up-to-date listing.
6. Security Measures
The security of your personal data is a priority for the Company. We implement strict technical and organizational measures to protect the information you entrust to us.
Key security measures include:
- Encryption protocols (SSL/TLS) to secure data in transit between your device and our servers,
- Firewalls and intrusion detection systems to prevent unauthorized access,
- Secure AWS servers, hosted in Canada and certified for health data storage (HDS),
- Regular encrypted backups to ensure data integrity and recovery in the event of an incident,
- Use of Cloudflare to enhance protection against DDoS attacks and optimize network security.
Our infrastructure is <0>continuously monitored</0> and <0>regularly updated</0> to promptly address any identified vulnerabilities. We apply <0>advanced protective measures</0> to prevent intrusion attempts, data breaches, and denial-of-service attacks.
7. Consent
By completing the appointment request form on the Platform (whether for yourself or for a dependent) or the contact form to register your services as a healthcare professional or facility, you consent to the collection and processing of your personal data for the purposes described in this privacy policy.
If you are booking an appointment for a dependent under the age of 14, you consent to the collection and processing of their personal information and certify that you are their legal guardian, in accordance with the requirements of Law 25.
Minors under the age of 14 are not permitted to use the Platform independently. Any use must be made by their legal guardian.
8. Security Incident Management
Despite all the measures implemented to protect your personal data, no system is entirely immune to a security incident. The Company acknowledges this reality and takes the prevention, detection, and management of information security risks very seriously.
In the event of an incident resulting in the leakage, loss, unauthorized access, or any other compromise of personal data, the Company undertakes to:
- Promptly inform the affected individuals,
- Notify the Commission d’accès à l’information du Québec, in accordance with the requirements of Law 25,
- Implement the necessary corrective actions to contain the incident and prevent any recurrence.
This proactive approach aims to minimize potential impacts on affected individuals and to ensure responsible and transparent management of security incidents.
9. User Rights
In accordance with Law 25 on the protection of personal information in Quebec, you have specific rights regarding your personal data:
- Right of access: You may request to view the personal information we hold about you,
- Right of rectification: If your information is inaccurate, incomplete, or ambiguous, you may request that it be corrected,
- Right to withdraw consent: You may withdraw your consent to the processing of your personal data at any time.
To exercise any of these rights, please contact us using the information provided in Section 12.
10. External Links
The Platform may contain links to third-party websites, including those of clinics, healthcare professionals, or partners.
Please note that these sites have their own privacy policies, and the Company is not responsible for the privacy practices, security, or content of these external sites. We encourage you to carefully review their privacy policies before providing them with your personal information.
11. Language of the Policy
This privacy policy is available in multiple languages for accessibility purposes. However, in the event of any discrepancy or conflict between the French version and any other language version, the French version shall prevail.
12. Updates to the Privacy Policy
This privacy policy may be updated periodically to reflect changes in our practices or to comply with new regulatory and technological requirements. The date of the last update is indicated at the top of this policy. In the event of a significant change, we will notify you via our website.
13. Contact Us
For any questions, comments, or requests regarding this privacy policy, or to exercise your rights concerning the protection of personal information, you may contact our Privacy Officer.
14. Privacy Officer
Contact information for the Privacy Officer is as follows:
Privacy Officer
Technologies Rabbitdoc Inc.