Privacy

The short version

We hold no patient data.

We hold your sign-in, your subscription status, and the way you set up your clinic.

We record page views on the clinician pages, and how far down each page you scroll.

We count opens and taps on patient pages, never who.

A patient page works without an account, and sets no cookie.

Who we are, and what this covers

Integrated Pelvic Care Inc. is accountable for the personal information described here.

Accountable is the word PIPEDA uses, and PIPEDA is Canada's federal privacy law.

Personal information means information about a person who can be identified.

In plain words: we answer for this information, wherever it is held.

Write to hello@pelviclens.com with a privacy question.

This policy covers pelviclens.com and every clinic address on it.

It covers every page you send to a patient.

It does not cover the other sites Integrated Pelvic Care runs.

The models themselves hold no personal information of any kind.

What we hold about a subscriber

Clerk holds your sign-in identity: your email address and your name.

If you sign in with Google, Clerk also holds the Google account id.

We never see your password.

Stripe holds your payment details, and we never see your card number.

Stripe gives us a customer id, a subscription id, its status and its renewal date.

We hold the clinic details you set.

Those are your clinic name, your clinic address, your logo and your accent colour.

For your patient pages you can add a phone number, an email address and a postal address.

You can also add a website, a booking link, an Instagram handle and your credentials.

The clinic address you chose is part of every link you send.

We hold your place in the founding twenty, if you have one.

We hold the emails you send us, and our replies to them.

We ask for nothing about your practice beyond that.

Those details are optional, and we ask for no licence number.

What we hold about a patient

Nothing.

There is no field for a name, a symptom, an answer or an email address.

There is no patient account, and no way to make one.

Nothing about a patient is asked, stored or inferred.

That is the shape of the product, and not only a promise about it.

A page you send loads no analytics service and no sign-in script.

A patient page loads no script from anywhere else, so nothing can watch from it.

"Email this link" opens your own email program, and we keep no copy of the message.

We cannot tell you who opened a link, because we never record it.

We cannot tell you whether a patient watched a clip through.

We count how often a patient page is opened, and how often each of its buttons is pressed.

A count is one number for each page and each month, and nothing else.

It holds no IP address, no cookie, no device and no time of day.

A clip link sets one cookie, named __Host-pl_moment.

It lasts two hours.

JavaScript cannot read it.

It holds a clinic id, a clip id and an expiry, signed by us.

It holds no identity, and nothing about the person watching.

It is what lets that one clip's files load, and it does nothing else.

Analytics on the clinician pages

PostHog records page views and a few product events on the clinician pages.

An example of an event is a press on the subscribe button.

When you leave a clinician page, PostHog records that you left it.

It also records how far down the page you scrolled.

That shows us which parts of a page people reach, and it holds nothing you typed.

Events are tied to your account only after you sign in.

IP addresses are discarded.

We use session recordings on the clinician library and anatomy model pages, including their Care editing and sharing controls.

These recordings show page controls and interactions, such as scrolling and button presses.

They do not record the anatomy canvas, videos, audio or patient page previews.

We mask form inputs and private text in your browser before recording data is sent.

Some standard control labels remain visible so we can understand how the controls are used.

We remove query strings, fragments, recipient details and shared link destinations from recording data.

We do not record network request bodies or console messages.

Separate product events count model choices, search result counts, Care edits and sharing attempts and outcomes.

Search text and the words you write for patients are not included in those events.

Opening a messaging app or copying a link does not tell us whether a message was delivered.

A temporary browser identifier groups clinician interactions, alongside a clinic identifier.

PostHog applies the event and recording retention periods configured for our project.

PostHog is never loaded on a page you send to a patient.

Those pages carry only the counts described above.

PostHog's hosting region is the one we configure, and it is United States by default.

Vercel counts visits to the clinician pages, alongside PostHog.

It records the page, where the visit came from, the country and the device type.

It sets no cookie, and it holds no identity.

It cannot follow you to another site.

We strip the web address before it is sent.

Only a campaign tag survives, so a payment reference never reaches it.

It is never loaded on a page you send to a patient either.

We use these counts to decide what to build next.

We do not use them to judge a clinician.

Logs, and security records

Vercel keeps a request log and a function log for the site.

It logs every request, and that includes a request for a patient page.

Those logs hold an IP address, a URL, a user agent and a time.

Vercel also keeps a firewall log of rate-limit events.

A log is our host keeping its own records, and it names no patient.

It is not analytics, and nothing reads it to build a picture of a person.

Vercel keeps all of them for a short period, under its own policy.

We read them to keep the service secure, and to fix a fault.

Why we use it

We use it to run the service you subscribed to.

We use it to bill you, and to tell you what you were billed.

We use it to keep the service secure, and to find abuse of it.

We use it to see which pages clinicians use, and to make the product better.

We use it to send you a message about the service itself.

We use it to answer you when you write to us.

We use it to meet a legal obligation, such as keeping a tax record.

We send marketing only with your consent, and you can withdraw that consent.

We sell no data.

There is no advertising network on any page of this product.

Cookies, and storage on your device

Clerk sets a session cookie on the pages where you are signed in.

It is what keeps you signed in as you move between pages.

PostHog sets a cookie on the clinician pages.

It is what tells one visit from the next.

A model page keeps one random visit number in the tab, so its pages read as one visit.

It lives only as long as the tab, and it names nobody.

The Vercel visit counter sets no cookie at all.

A clip link sets the two-hour cookie described above.

A patient page sets no cookie.

A model page keeps a copy of its files on the device that opened it.

A small worker in the browser holds that copy.

It caches what an opened page used, and it caches nothing on its own.

That copy makes the next opening fast, and it holds no personal information.

It stays on the device after you cancel, until the browser clears it.

Clear any of them by clearing the site data in your browser.

There are no advertising cookies here.

None of these cookies follows you to another site.

None of them is read by anyone but us and the company that set it.

We show no consent banner where nothing non-essential is set.

Where the law asks for a banner for analytics, we show one.

Who sees it, and where

These companies process your information for us.

Each one is under contract to us, and handles it only for us.

Your account and your clinic sit in a Postgres database run by Neon.

We add no processor without a reason, and this list is the whole of it.

A change to this list goes up on this page.

• Clerk — your sign-in identity. United States.
• Stripe — payment, and the subscription record. United States.
• Vercel — hosting, logs, visit counts, and the private store for logos and model files. United States.
• Neon — the Postgres database that holds your account and your clinic. United States.
• PostHog — product analytics on the clinician pages. The region we configure.
• Google — sign-in, and only if you sign in with a Google account. United States.

Information that leaves Canada

The database is in the United States.

Information that leaves Canada is protected by contract.

Those contracts hold each company to a standard comparable to the one here.

We sell your information to nobody, and we trade it with nobody.

What is public

Your clinic name, your logo and your colour appear on your own pages.

They appear on every page you send to a patient.

So do the contact details you add, and the words you write on those pages.

A patient video page you make public can be found by search engines.

A patient who opens your link sees your clinic, and never another one.

Nothing else about you is public.

How long we keep it

We keep your account and clinic data for the life of the subscription.

We delete it 90 days after you cancel.

Stripe keeps its records for as long as tax law requires.

PostHog events and session recordings use the retention periods configured for our project.

These periods can differ between events and recordings; contact us for the current periods.

Vercel keeps its logs for a short period, under its own policy.

A replaced logo is deleted as soon as the new one is stored.

A deletion you ask for is carried out within 30 days.

It rolls off the backups within 30 days of that.

How we protect it

The site is served over TLS, and browsers are told to keep using it.

The pages carry a content security policy, which limits what a page can load.

The cookies that carry a session or a clip cannot be read by JavaScript.

The sign-in is handled by Clerk, and we store no password of yours.

Every model file is served only after we check that you are subscribed.

A clinic reaches its own files, and never the files of another clinic.

Model files are handed over as links that expire in minutes.

An uploaded logo is re-encoded before storage, so the original bytes never land.

Uploads are rate-limited, so one account cannot flood the store.

We keep a checklist against OWASP ASVS 5.0 Level 1, and we work through it.

That is a published list of security requirements, written for people who build software.

We go back over the checklist when the product changes.

No measure is perfect.

If a breach creates a real risk of significant harm, we tell the people affected.

We also tell the Office of the Privacy Commissioner of Canada, as the law requires.

Your rights

You can ask for a copy of what we hold about you.

We tell you what we hold, why we hold it, and who sees it.

You can ask us to correct it.

You can ask us to delete it.

You can withdraw a consent you gave.

Where the law gives you portability, you can take your data elsewhere.

Export a copy, or delete your clinic, from Account, the button at the top of every page.

You can also write to us.

Write to hello@pelviclens.com.

There is no charge for a first request.

Deleting your clinic removes your clinic pages and your logo.

It also cancels your subscription.

Stripe keeps what tax law requires it to keep.

We answer within 30 days.

We can refuse a request that is unfounded or repeated, and we say why.

You can complain to the Office of the Privacy Commissioner of Canada.

A Quebec resident holds further rights under Law 25, including a right to be forgotten.

A reader in the EEA or the UK holds rights under the GDPR and the UK GDPR.

Our legal bases there are contract, legitimate interests and consent.

Contract covers running your subscription.

Legitimate interests covers keeping the service secure and working.

Consent covers marketing, and you can withdraw it.

A reader in California: we sell nothing, and we share nothing for advertising.

Children

Pelvic Lens is not for anyone under 18.

We collect nothing knowingly from a minor.

Write to hello@pelviclens.com if you think we hold something from one.

We delete it.

Changes to this policy

This page carries its own date.

We give 30 days' notice by email before a material change takes effect.

A small correction goes up with a new date, and no notice.

Contact

Integrated Pelvic Care Inc. is the company behind Pelvic Lens.

It is registered in Canada.

Zhen is the privacy contact, at hello@pelviclens.com.