Privacy Policy

Effective: January 4^th, 2026 · Applies to the online booking portal operated for the medical practice of Dr Hasan. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you create an account, request appointments, or otherwise use the portal.

We follow applicable Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial laws and health-information statutes such as British Columbia’s Personal Information Protection Act (PIPA (BC)), Alberta’s Personal Information Protection Act (PIPA (AB)) and Health Information Act (HIA (AB)), and Ontario’s Personal Health Information Protection Act (PHIPA (ON)). Where there is any conflict, the stricter requirement applies.

1. What We Collect

When you register or use the portal, we collect information you provide directly, such as your name, date of birth, email address, telephone number, Health Care Number, and any messages or preferences you submit. We also collect appointment details (requested date/time, visit type, confirmations, rescheduling), account metadata (creation date, login activity), and limited technical information automatically from your browser or device (IP address, device and browser type, time zone, basic diagnostics, and cookies necessary to operate the portal). We do not intentionally collect more information than is reasonably necessary for booking and patient identity verification.

2. Why We Collect It

We use personal information to create and manage accounts; verify identity; schedule, confirm, and modify appointments; contact you regarding delays or rescheduling; operate, secure, and troubleshoot the portal; and deter fraud, abuse, and security incidents (including the two-ticket system described in our Terms). We also use it to comply with legal and regulatory requirements and to maintain accurate patient records within the Clinic. Where we process information to send optional messages unrelated to booking (e.g., clinic updates), we will ask for your consent or provide an opt-out as required by law.

3. Lawful Basis and Consent

Our collection and use of personal information is based on your consent (given when you create an account and continue using the portal), our legitimate interests in operating a secure booking service for our patients, and our professional and legal obligations to maintain accurate records. You may withdraw consent to specific non-essential uses at any time; doing so may limit your ability to use the portal. Clinical records created during care are governed by applicable health-information law and professional standards and may be retained notwithstanding a request to delete your portal account.

4. Sensitive Information and Health Care Numbers

Providing a Health Care Number is optional for portal registration but may expedite verification and approval. If provided, it will be stored with appropriate safeguards and used only for identity confirmation, eligibility, and billing/coverage verification where applicable. We do not disclose Health Care Numbers to third parties except processors acting on our behalf or as required by law.

5. How We Share Information

We limit disclosure to what is necessary. We may share information with Clinic staff and contractors who need it to manage scheduling; with service providers that host our systems, send emails/SMS, or provide security and logging (each bound by confidentiality and data-protection obligations); with regulators or law enforcement when required or permitted by law, and in connection with investigations of abuse, threats, or data theft. We do not sell personal information.

We do not use your personal information to market or promote unrelated goods or services. Staff will never contact you to advertise or sell products. Any communication you receive about goods or services that is not directly from Dr Hasan or authorized clinical personnel is not from us and should not be trusted.

6. Storage Location and Cross-Border Processing

Portal data is stored in Canada where feasible. Some service providers may process limited information in other jurisdictions. By using the portal, you acknowledge that your information may be transferred to, stored in, or processed in jurisdictions with different privacy laws. Where that occurs, we take reasonable steps to ensure comparable protection through contracts and technical safeguards.

7. Retention

Account and booking information is retained only as long as necessary for the purposes described or as required by law and professional standards. Clinical records (separate from the portal) are retained in accordance with applicable health-information legislation and medical college guidelines. When data is no longer required, we delete or de-identify it using reasonable measures.

8. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, logging, and regular review of access privileges. No system can be perfectly secure. If we become aware of an incident involving your information that creates a real risk of significant harm, we will notify you and the appropriate authorities as required by law.

9. Your Rights

Subject to legal limits, you may request access to or correction of your personal information, withdraw consent to non-essential processing, and request deletion of your portal account. To exercise a right, contact [email protected]. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, where applicable, your provincial privacy commissioner.

10. Cookies and Analytics

The portal uses strictly necessary cookies to keep you signed in and maintain session security. We do not use third-party advertising cookies. If basic analytics are enabled, they are configured to use de-identified, aggregate reporting focused on service quality (e.g., error rates, page performance) rather than user profiling.

11. Children

Where a minor patient uses the portal, the account must be created and managed in a manner consistent with applicable consent rules and Clinic policies. Guardians should supervise portal use for minors, and communications will follow clinical and legal requirements.

12. Changes

We may update this Policy periodically. Material updates will be posted here with a new “Effective” date. Continued use of the portal after an update indicates your acknowledgment of the revised Policy.

13. Contact

Privacy inquiries should be directed to [email protected] or to the Clinic at the address available on our contact page. Please do not send urgent or emergency messages to the privacy inbox.

14. Professional Standards

This portal and its use are guided not only by privacy law but also by the professional standards and ethical requirements of the College of Physicians and Surgeons of British Columbia (CPSBC). The Clinic is committed to protecting personal health information in line with CPSBC expectations regarding confidentiality, accuracy, and appropriate use of technology in patient care. Patients using the portal acknowledge that their information will be managed consistent with these professional obligations in addition to applicable privacy statutes.