Privacy Policy

This policy explains what information Ciraura (“we”) collects through ciraura.com and its connected portals, how it is used, and the choices available to you. It applies to visitors to our marketing site and to clinics, staff and families who use the product.

Who this covers

Ciraura is built for healthcare practices operating in Canada. Client and staff health information handled inside the product is governed by the Personal Health Information Protection Act (Ontario) and the Personal Information Protection and Electronic Documents Act (federal), and is processed on behalf of the clinic that is our customer - the clinic remains the data controller for the records its staff and families create in the product.

Accounts and children

Accounts are for adults who have reached the age of majority, invited by a clinic. Children do not hold accounts. A parent or guardian acts for a child, as the Personal Health Information Protection Act allows, and the child’s record is held by their clinic.

Information we collect

• Account information you provide: name, email, role, and organization.
• Information a clinic enters or generates in the product on behalf of its staff and the families it serves, including scheduling, clinical and billing records.
• Usage information: pages visited, actions taken, device and browser information, collected to operate and secure the service.
• Communications you send us, such as support requests or a demo inquiry.

How we use it

• To provide, maintain and secure the product for the clinics that use it.
• To communicate with you about your account, a request, or the service.
• To improve the product, using aggregated or de-identified information wherever possible.
• To meet legal, regulatory and contractual obligations.

How it is stored and protected

Client, staff and clinical data are isolated per organization at the database level, and access within an organization is scoped by role and action rather than granted broadly. Any use of a third-party AI model on clinical data is routed through a vendor under a signed agreement covering that data; no identifiable clinical data is sent to a third-party model without one. Where your information goes when Ciraura uses AI.

Who we share it with

We do not sell personal information. We share information with service providers who help us operate the product (such as hosting and infrastructure providers) under agreements that limit their use of it, and where required by law.

Cookies

Ciraura uses cookies only to keep you signed in and to remember choices you make. If your browser blocks them, you cannot sign in.

• sb-…-auth-tokenKeeps you signed in as you move between Ciraura’s portals. A long session is split into pieces ending .0, .1 and so on.Lasts: until you sign out, or 400 days at most
• sb-…-auth-token-code-verifierWritten when you ask for a password-reset email, to secure the reset.Lasts: 400 days at most
• summit-browser-sessionEnds your sign-in when you close the browser, after you sign in with “Remember me” unticked.Lasts: until you close the browser or sign out
• sf-refresh-loop-guardStops a page reloading in a loop while your sign-in is renewed.Lasts: 15 seconds
• summit-themeRemembers light or dark mode.Lasts: 1 year
• summit-displayRemembers your density, text size and accessibility settings.Lasts: 1 year, or until you sign out
• summit-brandRemembers your clinic’s colours.Lasts: 1 year, or until you sign out
• summit-barRemembers the top bar’s portals and unread counts between pages.Lasts: 12 hours, or until you sign out
• summit_viewed_childCare: remembers which child you are looking at.Lasts: 30 days
• admin_view_as_clientCare: set when a clinic administrator opens Care as a client to help them.Lasts: 4 hours

The sign-in and password-reset pages include a security check from Cloudflare (a CAPTCHA). It is the one outside service on Ciraura’s pages.

Your choices

If you are a client, family member or staff member of a clinic using Ciraura, your primary relationship for privacy requests is with that clinic, as the holder of your record. You may also contact us directly using the details below, and we will route your request appropriately.

Retention

We retain information for as long as needed to provide the service to the clinic that is our customer, and afterward as required by law or a clinic’s own record-retention obligations.

Contact

Questions about this policy can be sent to hello@ciraura.com.