Privacy Policy

This Privacy Policy explains how Neopric Inc. and 741512 NB Inc. (operating as Clinexa.co) (together, "OctopusLM", "we", "us") handle personal information in connection with the OctopusLM website and the OctopusLM web application.

1. Our role

OctopusLM is used by healthcare providers, independent medical examiners, legal and insurance professionals (our "Customers") to review medical records. When a Customer uploads medical records, the Customer remains responsible for that personal health information as its trustee, custodian or controller. We process it only on the Customer's behalf and instructions, as an information manager, agent or service provider under laws such as PIPEDA, The Personal Health Information Act (Manitoba), PHIPA (Ontario) and similar provincial laws.

If you are a patient or claimant and have a question about your records, please contact the clinic or organization that holds them. We will refer any request we receive to the right Customer.

2. Information we collect

• Account information: name, email address, organization, professional role and login details.
• Customer content: medical records and other documents Customers upload, and the summaries, chronologies and other outputs generated from them. This may include personal health information.
• Usage and audit information: logs of sign-ins and actions in the application, including an audit log of access to personal health information, used for security and support.
• Billing information: details needed to process payments. Card details are handled by our payment processor and are not stored by us.
• Website: this website does not use advertising or analytics cookies. The ROI calculator runs entirely in your browser.

3. How we use information

• To provide the OctopusLM service, including generating summaries, chronologies, AI chat responses and examiner drafts.
• To secure the service, prevent misuse, and investigate incidents.
• To provide support and respond to your requests.
• To bill for the service and meet legal obligations.

We use only the minimum personal health information needed to provide the service. We never sell personal information, never use it for advertising, and never use Customer content to train artificial intelligence models.

4. Where information is stored

Customer content and outputs are stored on Amazon Web Services (AWS) infrastructure located in Canada. Artificial intelligence processing may be performed transiently on servers outside Canada, configured with zero data retention, so no Customer content is stored outside Canada or retained by the AI provider. Customers who require Canada-only processing can request it.

5. Service providers

We share information only with service providers that help us run OctopusLM, under written terms that protect it:

• Amazon Web Services: hosting, storage in Canada, and document and AI processing.
• Convex, Inc.: application metadata such as account details, case titles, dates and status. No medical document content or personal health information is stored in Convex.

We may also disclose information where required by law, such as in response to a court order.

6. Retention and deletion

• Uploaded files and generated outputs are deleted automatically 30 days after upload.
• Customers can delete any case, or their entire account, at any time from within the application.
• When a Customer's agreement ends, we securely destroy remaining Customer content within 30 days.
• Account, billing and audit records are kept only as long as needed for security, support and legal purposes.

7. Security

We protect information with encryption in transit and at rest, unique user accounts and access controls, per-user audit logging, threat monitoring, and limited, need-to-know staff access. Staff with access sign confidentiality pledges and complete privacy training. If a privacy breach affects Customer content, we notify the affected Customer within 24 hours of becoming aware of it and help them meet their own notification duties.

8. Your rights

You may ask to access or correct the personal information we hold about you as an account holder, or withdraw consent where applicable, by contacting us below. For personal health information in medical records, please contact the Customer that holds your records; we will help them respond. You may also contact the privacy regulator in your province or the Office of the Privacy Commissioner of Canada.

9. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date.

10. Contact us

Privacy Officer, Neopric Inc., Saint John, New Brunswick, Canada  ·  Email: info@neopric.com