Privacy Policy

1. Introduction

Web Cyte Development Inc. ("we," "us," or "our") operates Incyte, a cloud-based practice management and scheduling platform designed for wellness clinics in Ontario, Canada. This Privacy Policy describes how we collect, use, store, disclose, and protect personal information and personal health information in compliance with the Personal Health Information Protection Act, 2004 (PHIPA), the Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy legislation.

By using Incyte, your clinic acknowledges this policy and agrees to its terms.

2. Definitions

Term	Meaning
Personal Health Information (PHI)	Identifying information about an individual in oral or recorded form, relating to physical or mental health, provision of health care, or payment for health care.
Personal Information (PI)	Information about an identifiable individual that does not constitute PHI.
Custodian	Your clinic, as the health information custodian responsible for PHI under PHIPA.
Service Provider	Web Cyte Development Inc., which provides services to Health Information Custodians and processes PHI on their behalf in accordance with PHIPA and applicable agreements.
Privacy Officer	Michael Buchok, CEO and Software Architect, Web Cyte Development Inc.

3. Information We Collect

3.1 Information You Provide

• Business information: clinic name, address, contact details, tax information
• Team member information: names, email addresses, roles, permissions
• Client / patient records: names, contact information, date of birth, appointment history
• Clinical information: chart notes, SOAP notes, intake form responses, body map annotations
• Billing information: invoices, payment records, insurance claim details
• Digital product and event registration data

3.2 Information Collected Automatically

• Access logs: timestamps, IP addresses, actions performed (retained for security and audit purposes)
• Session information: login times, browser type, device type
• Security event data: failed login attempts, suspicious activity patterns

3.3 Information We Do Not Collect

• Health card numbers or government-issued identification numbers
• Social insurance numbers
• Full payment card numbers (card processing is handled entirely by Stripe)

4. How We Use Information

• To provide, operate, and maintain the Incyte platform
• To process appointments, billing, and client records on your behalf
• To send transactional emails (appointment confirmations, receipts, download links)
• To detect and respond to security threats and unauthorized access
• To generate audit logs required for PHIPA compliance
• To issue invoices and process your clinic's subscription payments
• To improve and develop the platform

We do not sell, rent, or trade personal information or personal health information to any third party for commercial purposes.

5. Legal Basis for Processing

Web Cyte Development Inc. collects and uses PHI only as directed by you (the Custodian) and only for the purposes for which you have collected it from your clients, in accordance with PHIPA and our Data Processing Agreement. We do not use PHI for any purpose beyond providing the Incyte platform.

6. Data Storage and Security

6.1 Where Data is Stored

All data is stored on servers located in Canada (DigitalOcean Toronto region, TOR1). No PHI or PI is transferred outside of Canada.

6.2 Security Measures

• AES-256 encryption of all personal health information fields at rest at the database field level
• MySQL InnoDB tablespace encryption for all database files on disk
• TLS 1.2+ encryption for all data in transit
• Role-based access controls with least-privilege permissions
• Mandatory two-factor authentication for all admin accounts
• Automated security alert monitoring
• Daily encrypted database backups with 30-day retention
• Access logs retained for all administrative actions

7. Data Retention

Data Type	Retention Period
Client / patient records	As directed by your clinic, subject to applicable requirements. Anonymization available on demand.
Access and audit logs	12 months
Billing records	7 years (CRA requirement)
Security event logs	6 months
Backup data	30 days rolling

8. Disclosure of Information

We do not disclose PHI or PI except:

• As directed by you (the Custodian) in the normal course of providing the platform
• As required by law, court order, or regulatory authority
• To our subprocessors listed in Section 9, solely as necessary to operate the platform
• In the event of a privacy breach, as required under PHIPA

9. Third-Party Subprocessors

Provider	Role
DigitalOcean Canada	Cloud infrastructure — Toronto, Canada
Stripe	Payment processing — PCI-DSS Level 1 certified. Card data never touches our servers.
Mailgun (Mailgun Technologies, Inc.)	Transactional email delivery via Mailgun (mail.incyteapp.ca). Clinics may configure their own SMTP sender through Business Settings.
Zensurance / Tokio Marine Canada	Cyber liability and E&O insurance (policy ZMC49504)

10. Individual Rights

Individuals whose PHI is held by your clinic have the following rights under PHIPA: access to their records, correction of inaccurate information, withdrawal of consent (subject to legal exceptions), and notification of a breach affecting their information. These rights are exercised through your clinic as the Custodian.

11. Privacy Breach Notification

In the event of a privacy breach affecting PHI, Web Cyte Development Inc. will notify your clinic without unreasonable delay and no later than 24 hours after discovery. Your clinic, as the Custodian, is responsible for notifying affected individuals and the IPC as required under PHIPA.

12. Contact and Complaints

Field	Detail
Privacy Officer	Michael Buchok, CEO and Software Architect
Company	Web Cyte Development Inc.
Address	67 Spring Creek Drive, Waterdown, Ontario, L8B 0X4
Email	info@webcytedevelopment.com

If you are not satisfied with our response, you may contact the Information and Privacy Commissioner of Ontario at www.ipc.on.ca or 1-800-387-0073.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated with a minimum of 30 days notice before taking effect. The current version is always available at this URL.

Last updated: August 5, 2026