1. Who we are
RIGHTCLINIQ (the “Directory”) is operated by Brightsquid Secure Communications Corp. (“Brightsquid”, “we”, “us”), a Canadian company that provides secure communication and privacy-compliance services to healthcare organizations. Brightsquid is the controller (in Canadian law, the organization accountable) for personal information collected through the Directory.
2. What the Directory is, and is not
The Directory publishes business information about clinics: name, address, phone number, website, opening hours, services and similar details that clinics make public. It helps visitors find and contact a clinic. It is not a medical service, does not book appointments and does not hold patient records. Please do not send medical history, health card numbers or other sensitive health information through the Directory.
3. Personal information we collect
3.1 Information you give us
- Enquiries and quick messages to a clinic: your name, email address, phone number (when provided) and the text of your message.
- Contact reveal / Connect on WhatsApp: your name, email address and phone number, plus an optional message, which you leave in order to see a clinic’s full phone number or open a WhatsApp chat.
- Clinic listing requests submitted through the “List your clinic” form: the clinic’s business details and the contact email of the person submitting.
- Clinic accounts: name, work email address and password (stored hashed) for clinic managers who claim and maintain a listing, together with the changes they request.
3.2 Information collected automatically
- Technical data in server logs: IP address, browser type, pages requested, date and time, and the referring page. Logs are used for security and troubleshooting.
- Cookies and local storage needed to run the site (session, security token, your cookie choice, whether contact details have been unlocked in this session). See the Cookie Policy. The Directory does not use advertising cookies.
- Location: only when you choose “use my location” in a search, your browser asks your permission and the coordinates are used for that search. They are not stored on our servers.
3.3 Information about clinics
Clinic listings are compiled from publicly available business sources, from clinics themselves and from Brightsquid’s own customer records (used solely to show the “Secured by Brightsquid” badge). Where a listing names an individual practitioner, that is business contact information published by the clinic. Practitioners may ask us to correct or remove a listing at any time (see section 10).
4. Why we use personal information and our legal basis
| Purpose | Information | Basis (PIPEDA / GDPR) |
|---|---|---|
| Passing your enquiry to the clinic you chose and letting the Directory team follow up | Enquiry details | Your consent, given when you tick the box and send |
| Unlocking a clinic’s phone number or WhatsApp chat after you leave your details, and recording that request for the clinic | Contact-reveal details | Your consent / performance of your request |
| Reviewing, publishing and maintaining clinic listings; verifying that a person claiming a listing is authorized | Listing request and account details | Contract (clinic account) and legitimate interest in an accurate directory |
| Running, securing and improving the site; preventing spam and abuse | Technical data, essential cookies | Legitimate interest; legal obligation to safeguard information |
| Aggregate statistics (searches, enquiries per clinic, popular cities) | De-identified counts only | Legitimate interest |
| Optional analytics cookies, if ever introduced | Usage data | Your consent through the cookie banner |
5. Who we share information with
- The clinic you contact. Your enquiry or contact-reveal details are made available to the manager of that clinic once their ownership of the listing has been verified. Until then only the Directory team can see them. If you choose “Connect on WhatsApp”, your message is also sent to the clinic through WhatsApp, which is operated by Meta Platforms under its own privacy terms.
- Service providers that host the Directory, send email on our behalf or store backups, under contracts that restrict their use of the data to our instructions.
- Authorities where required by law, court order or to protect the rights, safety or property of Brightsquid, clinics or visitors.
- A successor in the event of a merger, acquisition or sale of the Directory, with notice on this page.
We do not sell personal information, and we do not share it with advertisers.
6. Where information is stored and international transfers
The Directory is hosted in Canada. Some service providers may process data in other countries, in which case we use contractual safeguards. For visitors in the European Economic Area, the United Kingdom or Switzerland, transfers rely on adequacy decisions (Canada holds an adequacy decision for PIPEDA-covered organizations) or standard contractual clauses.
7. How long we keep information
| Record | Retention |
|---|---|
| Enquiries and contact-reveal requests | 24 months after the enquiry, then deleted or anonymized for statistics |
| Clinic accounts and listing requests | For the life of the account, then 12 months after closure |
| Server and security logs | 90 days |
| Cookie preference | 12 months, then you are asked again |
8. How we protect information
Information is transmitted over HTTPS, stored in access-controlled databases with encrypted backups, and is available only to staff who need it. Passwords are stored as one-way hashes. Phone numbers of clinics are masked until a visitor identifies themselves, which limits automated harvesting. Brightsquid maintains a SOC 2 Type II attestation for its services; the Directory is operated under the same security program.
9. Children
The Directory is intended for adults looking for clinic information. We do not knowingly collect personal information from children under 13 (or the age of consent in your province or country). If you believe a child has sent us information, contact us and we will delete it.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to withdraw consent, to object to or restrict certain processing, and to complain to a privacy regulator. The Your Privacy Rights page explains each right, how to exercise it and how quickly we respond. Clinics and practitioners may request a correction or removal of their listing through the same channel or through a clinic account.
11. Clinic managers: your responsibilities
Enquiries you receive through the Directory contain personal information of the people who sent them. Use them only to answer the enquiry, protect them as you would any patient contact, and follow your own clinic privacy policy and applicable health-information laws (for example PHIPA in Ontario, HIA in Alberta, PIPA in BC, Law 25 in Quebec).
12. Changes to this policy
We may update this policy as the Directory changes. The effective date and version at the top of the page will change, and material changes will be announced on the home page for at least 30 days.
13. Contact us
Questions, requests and complaints about privacy can be sent to Brightsquid’s Privacy Officer: see brightsquid.com for current contact details . If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, your provincial privacy commissioner, or (for EEA/UK residents) your local data-protection authority.