Itechnocrat Health Privacy Policy
Last Updated: Oct 12 2026
1. Scope and Regulatory Framework
This Privacy Policy applies to Itechnocrat Health Inc. (“Itechnocrat Health,” “we,” “us,” or “our”) and governs the collection, use, disclosure, storage, and protection of personal data, personal health data, and protected health information (PHI) across our AI-powered EHR platform, mobile and web applications, and connected medical and wellness devices (including Garmin smart watches).
This policy is designed to comply with applicable privacy and health data laws, including: United States
HIPAA (Health Insurance Portability and Accountability Act)
HITECH Act
CCPA / CPRA (California)
U.S. Consumer Health Data (CHD) laws (e.g., Washington My Health My Data Act) European Union
GDPR (General Data Protection Regulation – EU 2016/679) Canada
PIPEDA (Personal Information Protection and Electronic Documents Act)
Provincial health privacy laws where applicable (e.g., PHIPA (Ontario), HIA (Alberta)) Cameroon
Law No. 2010/012 on Cybersecurity and Cybercrime
Law No. 2010/013 on Electronic Communications
Applicable CEMAC and OHADA data protection principles
National requirements governing health data confidentiality and electronic records
2. Categories of Data We Collect We collect and process data strictly on a minimum-necessary basis, grouped by service category: 2.1 Activity and Fitness
Steps, activity intensity, distance
Heart rate, HRV, stress metrics
Sleep stages and recovery data
GPS-based activity data (where enabled) 2.2 Nutrition and Weight Management
Weight, BMI, body measurements
Nutrition logs and dietary preferences
AI-generated nutrition insights 2.3 Diseases and Conditions Management
Diagnoses and clinical conditions
Disease-specific metrics and trends
Risk stratification indicators 2.4 Healthcare Services and Management
Electronic health records (EHR)
Clinician notes and care plans
Telehealth, scheduling, and coordination data 2.5 Medical Device Apps
Connected device identifiers
Sensor data and telemetry
Integration and interoperability logs 2.6 Medication and Treatment Management
Prescriptions and dosage schedules
Medication adherence data
Treatment response analytics
3. Lawful Basis for Processing We process personal and health data under one or more of the following lawful bases:
Explicit and informed consent
Provision of healthcare and related services
Compliance with legal and regulatory obligations
Vital interests of the data subject
Public interest in healthcare and research (where permitted) Consent may be withdrawn at any time without affecting prior lawful processing.
4. HIPAA Compliance (United States) Where applicable, Itechnocrat Health acts as a Covered Entity or Business Associate and:
Uses PHI only for treatment, payment, and healthcare operations
Executes Business Associate Agreements (BAAs)
Applies safeguards under the HIPAA Security Rule
Maintains breach detection, notification, and mitigation procedures
5. Canadian Privacy Compliance (PIPEDA & Provincial Laws) For Canadian users:
Personal health information is collected only for identified and appropriate purposes
Consent is obtained and documented
Individuals may access, correct, or withdraw consent
Safeguards align with PIPEDA Principle 7 (Safeguards)
Data residency requirements are respected where provincially mandated
Cross-border transfers are disclosed and protected by contractual safeguards
6. Cameroon Data Protection & Cybersecurity Compliance For users in Cameroon:
Health data is treated as confidential and sensitive
Electronic records are protected against unauthorized access, alteration, and disclosure
Data processing complies with national cybersecurity and electronic communications laws
Security measures are implemented to prevent cybercrime, data breaches, and misuse
Where data is transferred internationally, equivalent confidentiality and security safeguards are applied
7. How We Use Data We use collected data to:
Deliver personalized healthcare, fitness, and disease management services
Support clinicians and care teams
Enable AI-driven insights and predictive modeling
Improve system performance, safety, and accuracy
Meet legal, regulatory, and reporting obligations 🚫 We do not sell personal or health data, including consumer health data, under any jurisdiction.
8. Data Sharing and Disclosure We may share data only with:
Authorized healthcare providers
Approved processors and service providers under strict agreements
Device and integration partners where enabled by the user
Regulatory authorities when legally required All third parties must comply with equivalent privacy, security, and confidentiality obligations.
9. Consumer Health Data (CHD) Protections In compliance with U.S. CHD laws and equivalent international principles:
Explicit consent is required for collection and sharing
No geofencing or health inference without authorization
No discriminatory use of health data
Deletion and access rights are honored promptly
10. Individual Rights Users have rights under applicable law, including: GDPR
Access, rectification, erasure
Data portability and restriction
Objection to automated decision-making CCPA / CPRA
Right to know, delete, correct
Right to limit sensitive data use
Right to opt out (where applicable) HIPAA
Access and amend PHI
Accounting of disclosures
File complaints without retaliation Canada (PIPEDA)
Access and correction
Withdraw consent
Challenge compliance Cameroon
Confidentiality and security of personal data
Protection against unauthorized electronic processing Requests may be submitted to: 📧 privacy@itechnocrathealth.com
11. Data Security We employ industry-standard safeguards including:
Encryption at rest and in transit
Role-based access controls
Security logging and monitoring
Regular audits and risk assessments
Incident response and breach notification procedures
12. Data Retention Data is retained only as long as required to:
Provide healthcare services
Comply with applicable laws
Resolve disputes and enforce agreements Data is securely deleted or anonymized when no longer required.
13. International Data Transfers When data crosses borders, we apply:
GDPR Standard Contractual Clauses (SCCs)
PIPEDA-compliant contractual protections
Equivalent safeguards for Cameroon and other jurisdictions
14. Children’s Privacy We do not knowingly collect data from children under 13 (or higher local age thresholds) without verified parental or guardian consent.
15. Policy Updates This Privacy Policy may be updated periodically. Material changes will be communicated via our website or application.
16. Contact Information
Itechnocrat Health Inc.
📍 111 2845 23rd Street NE, Calgary, AB T2E 7A4
📧 privacy@itechnocrathealth.com
1. Scope
Itechnocrat Health Growth Engine is a digital marketing and customer engagement service operated by Itechnocrat Health.
This section explains how we collect, use, store, protect, and delete information obtained through authorized integrations with Meta platforms, including Facebook, Instagram, and Messenger.
2. Information We Collect
Depending on the permissions granted, connected accounts, and features used, we may process the following categories of information:
Facebook Page and Instagram professional account identifiers, names, and associated account information.
Information about authorized business users and the business assets they connect.
Publicly available comments and related engagement information from connected accounts.
Messages and customer inquiries received through supported Facebook and Instagram business messaging features.
Content identifiers, timestamps, and information needed to manage or respond to interactions.
Authorization tokens and connection information needed to maintain permitted integrations.
Marketing content and related publishing information associated with connected business accounts.
We do not request Facebook or Instagram account passwords.
3. How We Use Meta Platform Data
We process Meta Platform Data to provide services requested by authorized business clients, including:
Connecting and maintaining authorized Facebook and Instagram business integrations.
Displaying and organizing relevant customer interactions.
Identifying customer inquiries and engagement opportunities.
Supporting AI-assisted content preparation and customer communication.
Publishing or responding through supported social media channels when authorized.
Supporting general appointment inquiries and directing customers to secure booking services where applicable.
Maintaining integration security, troubleshooting errors, and complying with applicable requirements.
We do not use one client's Meta Platform Data to provide unrelated services to another client.
We do not use Meta Platform Data to infer sensitive health conditions or create health-based advertising audiences.
4. AI-Assisted Processing
Certain features may use automated analysis to identify topics, summarize interactions, and suggest appropriate marketing or customer service responses.
Where external AI service providers are used, relevant data processing is subject to applicable contractual safeguards, service configurations, and platform requirements.
Automated analysis is intended to support customer engagement and business communications, not to provide medical diagnoses or make clinical treatment decisions.
5. Data Storage and Security
We maintain administrative and technical safeguards designed to protect information processed through the Growth Engine.
Access to connected business data is restricted to authorized personnel and application components with a legitimate operational need.
Authorization credentials and access tokens are treated as confidential information.
Information associated with one business client is managed separately from information associated with other clients.
6. Data Sharing
We process Meta Platform Data on behalf of the business client that authorized the integration.
We may use service providers that support application hosting, infrastructure, security, and authorized platform functionality, subject to applicable agreements and data protection requirements.
We do not sell Meta Platform Data or disclose it to unrelated businesses for their independent marketing purposes.
7. Data Retention
We retain Meta Platform Data only for as long as necessary to provide the authorized service, fulfill legitimate operational requirements, or meet applicable legal obligations, subject to Meta's Platform Terms.
When information is no longer required, an authorized connection is discontinued, or a valid deletion request is received, we delete or de-identify applicable information in accordance with relevant requirements.
Any legally required retention is limited to the information and duration required by law.
8. Disconnecting Facebook or Instagram
Authorized users can revoke the application's access through the relevant Meta account or business settings.
Revoking access prevents future authorized access through the revoked connection, subject to Meta's processing and system behavior.
Previously stored information may still require a separate deletion process.
9. Requesting Access, Correction, or Deletion
Facebook and Instagram users, as well as authorized business clients, may request access to, correction of, or deletion of applicable personal information processed by Itechnocrat Health Growth Engine.
To submit a request, email:
info@itechnocrathealth.com
Subject: Meta Platform Data Privacy Request
Please provide sufficient information to identify the relevant Facebook Page, Instagram account, message, comment, or connected business.
Do not include passwords, access tokens, or sensitive medical information in your request.
We may request reasonable information to verify the requester's identity or authority before processing a request.
We will review and respond to valid requests in accordance with applicable privacy laws and Meta Platform requirements.
For deletion instructions, see our Data Deletion page.
1. Scope and Regulatory Framework
This Privacy Policy applies to Itechnocrat Health Inc. (“Itechnocrat Health,” “we,” “us,” or “our”) and governs the collection, use, disclosure, storage, and protection of personal data, personal health data, and protected health information (PHI) across our AI-powered EHR platform, mobile and web applications, and connected medical and wellness devices (including Garmin smart watches).
This policy is designed to comply with applicable privacy and health data laws, including: United States
HIPAA (Health Insurance Portability and Accountability Act)
HITECH Act
CCPA / CPRA (California)
U.S. Consumer Health Data (CHD) laws (e.g., Washington My Health My Data Act) European Union
GDPR (General Data Protection Regulation – EU 2016/679) Canada
PIPEDA (Personal Information Protection and Electronic Documents Act)
Provincial health privacy laws where applicable (e.g., PHIPA (Ontario), HIA (Alberta)) Cameroon
Law No. 2010/012 on Cybersecurity and Cybercrime
Law No. 2010/013 on Electronic Communications
Applicable CEMAC and OHADA data protection principles
National requirements governing health data confidentiality and electronic records
2. Categories of Data We Collect We collect and process data strictly on a minimum-necessary basis, grouped by service category: 2.1 Activity and Fitness
Steps, activity intensity, distance
Heart rate, HRV, stress metrics
Sleep stages and recovery data
GPS-based activity data (where enabled) 2.2 Nutrition and Weight Management
Weight, BMI, body measurements
Nutrition logs and dietary preferences
AI-generated nutrition insights 2.3 Diseases and Conditions Management
Diagnoses and clinical conditions
Disease-specific metrics and trends
Risk stratification indicators 2.4 Healthcare Services and Management
Electronic health records (EHR)
Clinician notes and care plans
Telehealth, scheduling, and coordination data 2.5 Medical Device Apps
Connected device identifiers
Sensor data and telemetry
Integration and interoperability logs 2.6 Medication and Treatment Management
Prescriptions and dosage schedules
Medication adherence data
Treatment response analytics
3. Lawful Basis for Processing We process personal and health data under one or more of the following lawful bases:
Explicit and informed consent
Provision of healthcare and related services
Compliance with legal and regulatory obligations
Vital interests of the data subject
Public interest in healthcare and research (where permitted) Consent may be withdrawn at any time without affecting prior lawful processing.
4. HIPAA Compliance (United States) Where applicable, Itechnocrat Health acts as a Covered Entity or Business Associate and:
Uses PHI only for treatment, payment, and healthcare operations
Executes Business Associate Agreements (BAAs)
Applies safeguards under the HIPAA Security Rule
Maintains breach detection, notification, and mitigation procedures
5. Canadian Privacy Compliance (PIPEDA & Provincial Laws) For Canadian users:
Personal health information is collected only for identified and appropriate purposes
Consent is obtained and documented
Individuals may access, correct, or withdraw consent
Safeguards align with PIPEDA Principle 7 (Safeguards)
Data residency requirements are respected where provincially mandated
Cross-border transfers are disclosed and protected by contractual safeguards
6. Cameroon Data Protection & Cybersecurity Compliance For users in Cameroon:
Health data is treated as confidential and sensitive
Electronic records are protected against unauthorized access, alteration, and disclosure
Data processing complies with national cybersecurity and electronic communications laws
Security measures are implemented to prevent cybercrime, data breaches, and misuse
Where data is transferred internationally, equivalent confidentiality and security safeguards are applied
7. How We Use Data We use collected data to:
Deliver personalized healthcare, fitness, and disease management services
Support clinicians and care teams
Enable AI-driven insights and predictive modeling
Improve system performance, safety, and accuracy
Meet legal, regulatory, and reporting obligations 🚫 We do not sell personal or health data, including consumer health data, under any jurisdiction.
8. Data Sharing and Disclosure We may share data only with:
Authorized healthcare providers
Approved processors and service providers under strict agreements
Device and integration partners where enabled by the user
Regulatory authorities when legally required All third parties must comply with equivalent privacy, security, and confidentiality obligations.
9. Consumer Health Data (CHD) Protections In compliance with U.S. CHD laws and equivalent international principles:
Explicit consent is required for collection and sharing
No geofencing or health inference without authorization
No discriminatory use of health data
Deletion and access rights are honored promptly
10. Individual Rights Users have rights under applicable law, including: GDPR
Access, rectification, erasure
Data portability and restriction
Objection to automated decision-making CCPA / CPRA
Right to know, delete, correct
Right to limit sensitive data use
Right to opt out (where applicable) HIPAA
Access and amend PHI
Accounting of disclosures
File complaints without retaliation Canada (PIPEDA)
Access and correction
Withdraw consent
Challenge compliance Cameroon
Confidentiality and security of personal data
Protection against unauthorized electronic processing Requests may be submitted to: 📧 privacy@itechnocrathealth.com
11. Data Security We employ industry-standard safeguards including:
Encryption at rest and in transit
Role-based access controls
Security logging and monitoring
Regular audits and risk assessments
Incident response and breach notification procedures
12. Data Retention Data is retained only as long as required to:
Provide healthcare services
Comply with applicable laws
Resolve disputes and enforce agreements Data is securely deleted or anonymized when no longer required.
13. International Data Transfers When data crosses borders, we apply:
GDPR Standard Contractual Clauses (SCCs)
PIPEDA-compliant contractual protections
Equivalent safeguards for Cameroon and other jurisdictions
14. Children’s Privacy We do not knowingly collect data from children under 13 (or higher local age thresholds) without verified parental or guardian consent.
15. Policy Updates This Privacy Policy may be updated periodically. Material changes will be communicated via our website or application.
16. Contact Information
Itechnocrat Health Inc.
📍 111 2845 23rd Street NE, Calgary, AB T2E 7A4
📧 privacy@itechnocrathealth.com
Facebook, Instagram, and Meta Platform Data
Last updated: October 12, 20261. Scope
Itechnocrat Health Growth Engine is a digital marketing and customer engagement service operated by Itechnocrat Health.
This section explains how we collect, use, store, protect, and delete information obtained through authorized integrations with Meta platforms, including Facebook, Instagram, and Messenger.
2. Information We Collect
Depending on the permissions granted, connected accounts, and features used, we may process the following categories of information:
Facebook Page and Instagram professional account identifiers, names, and associated account information.
Information about authorized business users and the business assets they connect.
Publicly available comments and related engagement information from connected accounts.
Messages and customer inquiries received through supported Facebook and Instagram business messaging features.
Content identifiers, timestamps, and information needed to manage or respond to interactions.
Authorization tokens and connection information needed to maintain permitted integrations.
Marketing content and related publishing information associated with connected business accounts.
We do not request Facebook or Instagram account passwords.
3. How We Use Meta Platform Data
We process Meta Platform Data to provide services requested by authorized business clients, including:
Connecting and maintaining authorized Facebook and Instagram business integrations.
Displaying and organizing relevant customer interactions.
Identifying customer inquiries and engagement opportunities.
Supporting AI-assisted content preparation and customer communication.
Publishing or responding through supported social media channels when authorized.
Supporting general appointment inquiries and directing customers to secure booking services where applicable.
Maintaining integration security, troubleshooting errors, and complying with applicable requirements.
We do not use one client's Meta Platform Data to provide unrelated services to another client.
We do not use Meta Platform Data to infer sensitive health conditions or create health-based advertising audiences.
4. AI-Assisted Processing
Certain features may use automated analysis to identify topics, summarize interactions, and suggest appropriate marketing or customer service responses.
Where external AI service providers are used, relevant data processing is subject to applicable contractual safeguards, service configurations, and platform requirements.
Automated analysis is intended to support customer engagement and business communications, not to provide medical diagnoses or make clinical treatment decisions.
5. Data Storage and Security
We maintain administrative and technical safeguards designed to protect information processed through the Growth Engine.
Access to connected business data is restricted to authorized personnel and application components with a legitimate operational need.
Authorization credentials and access tokens are treated as confidential information.
Information associated with one business client is managed separately from information associated with other clients.
6. Data Sharing
We process Meta Platform Data on behalf of the business client that authorized the integration.
We may use service providers that support application hosting, infrastructure, security, and authorized platform functionality, subject to applicable agreements and data protection requirements.
We do not sell Meta Platform Data or disclose it to unrelated businesses for their independent marketing purposes.
7. Data Retention
We retain Meta Platform Data only for as long as necessary to provide the authorized service, fulfill legitimate operational requirements, or meet applicable legal obligations, subject to Meta's Platform Terms.
When information is no longer required, an authorized connection is discontinued, or a valid deletion request is received, we delete or de-identify applicable information in accordance with relevant requirements.
Any legally required retention is limited to the information and duration required by law.
8. Disconnecting Facebook or Instagram
Authorized users can revoke the application's access through the relevant Meta account or business settings.
Revoking access prevents future authorized access through the revoked connection, subject to Meta's processing and system behavior.
Previously stored information may still require a separate deletion process.
9. Requesting Access, Correction, or Deletion
Facebook and Instagram users, as well as authorized business clients, may request access to, correction of, or deletion of applicable personal information processed by Itechnocrat Health Growth Engine.
To submit a request, email:
info@itechnocrathealth.com
Subject: Meta Platform Data Privacy Request
Please provide sufficient information to identify the relevant Facebook Page, Instagram account, message, comment, or connected business.
Do not include passwords, access tokens, or sensitive medical information in your request.
We may request reasonable information to verify the requester's identity or authority before processing a request.
We will review and respond to valid requests in accordance with applicable privacy laws and Meta Platform requirements.
For deletion instructions, see our Data Deletion page.