Privacy policy

Who we are

Eyada is built and run by Synergia Solutions Holding Ltd. (“Synergia Solutions”, “we”), a Canadian company at 502 Smith Avenue, Suite 104, Coquitlam, British Columbia V3J 0H9, Canada. For patient records, the clinic group is in charge of the information and we process it on its behalf.

Who this covers

Eyada is used by clinic groups to keep their patients' records. This policy covers the people who use Eyada at a clinic and the patients whose information clinics keep in it.

What we keep

For staff: name, email address, language and settings, and the devices and addresses used to sign in. For patients: what their clinic records, such as contact details, visits, prescriptions, results and payments. We also log the emails Eyada sends.

How patient records are used

Patient records belong to the clinic group that entered them. We use them only to run Eyada for that group. We don't sell them, use them for advertising or share them with other clinic groups. Eyada staff only look at a clinic group's information to help with a support request, and each time is recorded with a reason the group can see in its audit log.

Who else is involved

We use a small number of providers to run Eyada, and they process information only on our instructions: Hetzner (the servers and database, in Germany), Amazon Web Services (uploaded files and encrypted backups, in Canada), Cloudflare (the secure connection to the servers), Postmark (email) and Twilio (text messages), both in the United States, and Honeybadger (error reports, in the United States).

Usage statistics

To see which parts of Eyada get used, we count page views and actions on the public site and on staff screens with PostHog (in the United States). These count people by an anonymous number, not a name or email address. They never include patient names or anything from a patient's record, and nothing is counted in the patient portal.

Keeping it safe

Each clinic group's information is kept apart, connections are encrypted, backups are encrypted, uploads are scanned for viruses, and two-factor sign-in is available to everyone. Clinic groups can require it and limit sign-in to their own networks.

How long we keep it

Clinical records are kept while the clinic group uses Eyada. Housekeeping records are deleted on a schedule: sign-in history after a year and the email log after six months, for example.

Your choices

Staff can see their own sign-ins and devices and sign out elsewhere from Settings. Patients who want to see or correct their information should ask their clinic, which manages it.

Your rights and complaints

You can ask us what we hold about you, ask us to correct it, or complain about how we handle it, at the address below. We reply within 30 days. In Canada you can also complain to the Office of the Privacy Commissioner of Canada, and patients can complain to the authority that oversees health records where their clinic is.

Questions about this page? Write to [email protected].