This is a working draft prepared to support legal review. It is not legal advice. Have counsel experienced in Ontario health privacy law review before use.
Last updated: 30 September 2026. This policy covers the Med Copilot web application at medcopilot.ca and the API that supports it. It is written for the physicians and clinics who use Med Copilot, the privacy officers who assess it, and the patients whose information is involved.
The physician or clinic using Med Copilot is the health information custodian — they own the patient relationship, decide what is collected, are responsible for consent, and are the contact for patient access and correction requests.
Med Copilot is the custodian's agent (PHIPA s. 2, s. 17) and an electronic service provider (O. Reg. 329/04 s. 6). We provide the software that lets the custodian capture, generate and store records electronically. We handle personal health information only as needed to provide the service, only as the custodian directs, and never for our own purposes.
If Med Copilot's service is ever used to transmit personal health information electronically between two or more custodians, Med Copilot could be a Health Information Network Provider under O. Reg. 329/04, with additional obligations. Today, referral letters are drafted in the application and sent by the physician through their own channels, so we do not believe Med Copilot transmits personal health information between custodians. This is under review by counsel.
Captured during a visit: the audio of the encounter (streamed for transcription only, never stored); the live transcript (held in the clinician's browser during the visit, and in that browser's local storage if the clinician saves a draft — not on our servers); and the encounter details the clinician enters (patient name or medical record number, age, referring physician, place of service, urgency, and the visit date, time and duration).
Generated by Med Copilot and stored in Canada: the AI-drafted structured clinical note and its highlights; AI-suggested OHIP billing and diagnostic codes, the codes the physician selected, fees, claim status and any recorded claim outcomes; and AI-drafted referral letters, including the patient details and clinical question the physician provides and a snapshot of the recipient's contact details.
Account information (not patient data): the physician's sign-in identity (email) from Microsoft or Google; the practice profile and letterhead; the referral address book; subscription status from Stripe (never card numbers); and any Contact-Us messages sent to us.
The audio is captured in the browser, streamed directly to Amazon Transcribe for speech-to-text, and then discarded. Med Copilot creates no recording file and stores no audio. Med Copilot operates its Amazon Web Services account so that Amazon does not retain transcription content for service improvement.
The word-for-word transcript is used to produce the AI note and is otherwise only as durable as the clinician's own browser. Our database stores the AI-drafted note and highlights, not the transcript.
All personal health information that Med Copilot stores is held in Amazon Web Services' Canada (Central) region.
| Subprocessor | What it does | Patient data? | Location |
|---|---|---|---|
| Amazon Web Services | Application hosting, database, storage, sign-in, speech-to-text, AI models, email | Yes | Storage in Canada; AI text generation processed transiently in the United States |
| Anthropic | Provides the Claude AI model that runs inside Amazon Bedrock (no access to customer content) | No direct access | Within Amazon Bedrock |
| Stripe | Subscription payments (hosted checkout and billing portal) | No — email and billing data only | Global / United States |
| Microsoft, Google | "Sign in with Microsoft" / "Sign in with Google" identity providers | No — authentication only | Provider global |
| Google Analytics | Visit statistics for the public website (not the signed-in app) | No | United States |
Customers with a signed Data Processing Agreement receive advance notice of any new subprocessor that handles personal health information.
Our public pages (the home page, demos, and these legal pages) use Google Analytics to count visits, see how visitors found us, and measure how many go on to sign in. It sets cookies and receives your browser's general details and approximate location. It does not run inside the signed-in application, and we never send it your email, any account details, or any patient information. You can block it with any standard ad or tracker blocker without affecting the service.
Med Copilot uses Amazon Bedrock for text generation (Anthropic Claude — the draft note, billing suggestions, referral letters, the billing assistant) and for text embeddings (Amazon Titan, used to ground billing suggestions in the OHIP fee schedule; this runs in Canada).
Per Amazon's published documentation, Amazon Bedrock does not store or log prompts and responses, does not use them to train any model, and does not share them with third parties. Model providers have no access to the deployment accounts, the logs, or customer content. Traffic stays on the Amazon network and is encrypted in transit and at rest.
The Claude text-generation model is currently invoked through a United States regional inference profile, so the prompt — which for a clinical note is built from the visit transcript, and for billing and referral features contains clinical details — is processed on Amazon infrastructure in the United States for the few seconds the model takes to respond. The content is stored only in the Canadian region and is not retained or used for training. A Canada-resident model is available and can be enabled for a clinic that requires strictly in-country processing.
Every AI output is a draft for the physician to review, edit, and accept or reject. Med Copilot does not finalise a clinical record or submit a claim on its own.
Audio is not retained. The transcript is not stored on our servers. Clinical notes, claims and referral letters are retained in the Canadian database while the clinic's account is active, so the physician can meet their own recordkeeping obligations — Med Copilot is not the record of record, and clinics should not rely on it as their sole retention system.
A physician can delete an individual encounter (and its claim and referral letters) from within the application. On a documented request from the custodian, and on termination, Med Copilot returns or securely destroys all personal health information it holds for that clinic, including from backups on the backup cycle.
Med Copilot does not sell, rent or trade personal health information; does not use it for advertising or marketing; does not use it to build, train or evaluate AI models; and does not use it for any purpose other than providing and supporting the service and meeting legal obligations. De-identified, aggregate operational metrics that identify no patient may be used to run the service.
If Med Copilot becomes aware that personal health information it handles for a custodian has been lost, stolen, or accessed or used without authorisation, Med Copilot will notify the affected custodian at the first reasonable opportunity, provide the information the custodian needs to meet its own PHIPA obligations, and cooperate with the investigation and containment.
Patients have the right under PHIPA to access and request correction of their personal health information. Because the custodian holds the primary record and the patient relationship, patients should direct these requests to their physician or clinic. Med Copilot assists the custodian in responding and does not respond to a patient directly without the custodian's instruction.
Med Copilot will post any material change here and, for customers with a signed Data Processing Agreement, provide notice as that agreement requires.
Privacy questions: privacy@medcopilot.ca
You may also contact the Information and Privacy Commissioner of Ontario at ipc.on.ca or 1-800-387-0073. For questions about your own care or your own records, contact your physician or clinic.