Last updated: 2026-07-21
This policy explains, in simple and clear terms, how Colib Technology Inc. ("Colib", "we") collects, uses, discloses, retains and destroys personal information, including personal health information, on the colib platform. It applies to our two sites: the clinic and practitioner portal (www.colib.io) and the patient portal (portal.colib.io).
Colib complies with the applicable Canadian federal and provincial privacy laws, including:
colib is an electronic health record (EHR) and online booking platform used by clinics and health professionals across Canada.
When your clinic uses colib to manage your file, the clinic or the health professional remains responsible for your record: it determines which information is collected and for which purposes. Colib acts as the clinic's service provider: we host and process this information on the clinic's behalf, under strict confidentiality and security obligations.
For the information you provide directly to Colib (for example when a clinic subscribes to the platform, or when you create your patient portal account), Colib is responsible for its protection.
The information processed by the platform falls into the following categories:
We use personal information only to provide, secure, maintain and improve the platform:
Health information is never used for advertising purposes and is never sold to third parties.
Some features of the platform use an artificial intelligence component, for example the transcription of telehealth sessions and the generation of clinical note drafts. These features are enabled and triggered by your clinic and your practitioner, and the resulting note is marked as AI-generated in the record. Audio transcription is performed within colib's own infrastructure in Canada; the audio is not sent to any third-party service. Note drafts are generated by the Claude model (Anthropic) through the Amazon Bedrock managed service: your information remains stored at rest in Canada, and the AI processing itself runs in memory only, on AWS infrastructure located in Canada or the United States, over encrypted connections. The AI service does not store the content submitted to it, does not use it to train AI models, and does not share it with the model provider. By default, the audio recording and the transcript are deleted a few hours after the note is generated, unless your practitioner chooses to keep them in your record as an encrypted private document. For more details, see our artificial intelligence page.
We do not sell or rent personal information. We share personal information only with the service providers required to operate the platform, under contractual safeguards:
We may also disclose personal information where required by law, or to respond to a lawful request from an authority.
Colib's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
All personal information and health information managed by the platform is stored at rest in Canada: AWS Canada (Montreal) region and managed services located in Canada. Two limited exceptions involve processing outside Canada: the transient AI inference described in the Artificial intelligence section (in memory only), and payment processing by Stripe; audience-measurement data from our sites is also processed by its providers outside Canada. No health record information is ever sent to Stripe; the client's first name, last name and email are anonymized before transmission, and only the payment information itself is transmitted as-is.
colib applies a defence-in-depth security architecture:
For more details, see our security page.
We retain personal information only as long as necessary for the purposes described above and to meet our legal obligations.
You may access the personal information we hold about you, request that it be rectified, and withdraw your consent where applicable. You may also obtain a copy of the computerized personal information you have provided, in a structured and commonly used technological format (right to portability under Law 25).
Requests are addressed to our Privacy Officer (see the contact details below) and are answered within 30 days, as provided by law. You may also file a complaint with the Commission d'acces a l'information du Quebec or the privacy regulator of your province.
Our sites use cookies and similar technologies (log files, pixels) to measure audience, improve our services and support our marketing, including Google Analytics, Google Ads and the Facebook pixel. These tools measure page views and interactions with the sites; the content of health records (notes, forms, messages, documents) is never transmitted to them.
You can disable cookies in your browser and opt out of these services here:
Any incident involving personal information (unauthorized access, use, disclosure or loss) is handled under a documented procedure: containment, assessment of the risk of injury, recording in our incident register, correction and notification. Where an incident presents a risk of serious injury, we notify the affected clinics and persons as well as the Commission d'acces a l'information, as required by law.
The person in charge of the protection of personal information at Colib is:
Thibault Bréboin
Privacy Officer, Colib Technology Inc.
thibault@colib.io
We may update this policy from time to time to reflect changes to our practices or for legal or regulatory reasons. The current version is always available on this page, with its effective date shown at the top.
For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at support@colib.io