Trust and governance.

Health information is the most sensitive thing a clinic holds. This page sets out how Datafore is designed to handle it, and the principles we hold ourselves to.

Data residency in Canada

Datafore is being built on Canadian infrastructure. Clinic data is designed to be stored and processed in Canadian data centres, so it remains subject to Canadian law.

Privacy by design

Analysis runs on de-identified records. Patient identifiers are replaced with one-way pseudonyms, and names, email addresses and phone numbers are kept out of the analytics layer altogether.

We collect only what an analysis needs, and raw exports received from practice management systems are retained only briefly before deletion.

Isolation and access control

Each clinic's data is isolated from every other clinic's at the database level, encrypted in transit and at rest, and access to it is logged.

Accountable use of AI

AI helps surface patterns and draft next steps; people decide what happens. Every recommendation can be traced back to the data and the calculation behind it.

AI features operate on de-identified data, and are prevented from returning information that identifies a patient.

Regulatory alignment.

Datafore is designed to support clinics in meeting their obligations under Canadian privacy law, starting with the frameworks that apply to private allied health practice in British Columbia.

PIPEDA: Federal private-sector privacy law
PIPA (British Columbia): Provincial private-sector privacy law
PHIPA (Ontario): Provincial personal health information law

Being plain about status.

The Datafore platform is in active development. The commitments above describe the architecture it is being built to, rather than a certification it holds. As independent reviews and assessments are completed, we will publish them here.

If you are evaluating Datafore for a partnership, funding application or procurement, we are glad to walk through any of this in detail.