Privacy Policy

Last updated: July 1, 2026

1. Who we are

Stanch is an ABA practice management software platform developed and operated by Nivi Enterprises Inc., an Ontario corporation. We provide software to clinics and therapy practices in Ontario, Canada. We act as an Information Manager under Ontario's Personal Health Information Protection Act (PHIPA). The healthcare practice you interact with is the Health Information Custodian responsible for your personal health information.

2. What data we collect

When a practice uses Stanch, we process information on their behalf. This may include:

  • Client and caregiver names, contact details, and demographic information
  • Clinical session data, therapy notes, assessments (ABLLS-R, AFLS), and program records
  • Appointment schedules, billing codes, and insurance claim information
  • Staff credentials, caseload assignments, and supervision records
  • Account login activity and security audit logs

When you visit our public marketing website, we collect only standard server logs (IP address, browser type, pages visited) — no advertising trackers, no third-party analytics pixels, and no cookies beyond those strictly necessary for our service to function.

3. How we protect your data

  • Encryption in transit: All data is encrypted using TLS 1.3. We enforce HTTPS across every page and API endpoint.
  • Encryption at rest: All databases and storage volumes are encrypted using industry-standard encryption (AES-256). Backups are also encrypted.
  • Data isolation: Each healthcare practice's data is stored in a separate database schema, ensuring that no practice can access another's information.
  • Access controls: Role-based access control (RBAC) limits who can view, edit, or delete information. Every access to personal health information is logged in a tamper-evident audit trail.
  • Canadian hosting: All data is stored on servers physically located in Canada, subject to Canadian privacy law.
  • No third-party trackers: We do not use Google Analytics, Facebook Pixel, or any advertising tracking scripts anywhere on our platform, including on pages where personal information is entered.

4. Data retention and deletion

Clinical data is retained according to the retention policies set by each healthcare practice (the Health Information Custodian), in compliance with Ontario regulatory requirements. Demo requests and marketing inquiries submitted through our public website are automatically deleted within 30 days.

You may request deletion of your personal information by contacting your healthcare practice directly or by reaching out to our Privacy Officer at the contact details below. We will respond within 30 days as required by PHIPA.

5. PHIPA compliance

As an Ontario-based platform serving Ontario healthcare providers, Stanch is designed to comply with the Personal Health Information Protection Act, 2004 (PHIPA) and its regulations. Key compliance measures include:

  • Tamper-evident audit logging of all PHI access, modifications, and disclosures
  • Breach notification procedures aligned with IPC Ontario requirements
  • Information Manager Agreements with all hosting and infrastructure providers
  • Designated Privacy Officer to handle inquiries and complaints
  • Regular privacy impact assessments and security reviews

6. Your rights

Under PHIPA, you have the right to:

  • Access your personal health information held by your healthcare provider
  • Request corrections to inaccurate or incomplete records
  • Be informed of any privacy breach involving your information
  • File a complaint with Ontario's Information and Privacy Commissioner
  • Withdraw consent for the collection, use, or disclosure of your information (subject to legal retention requirements)

7. E-communication consent

When you provide your email address through our platform, you acknowledge that standard email is not a completely secure form of communication. By providing your email and consenting to electronic communication, you accept this risk. We will never send unencrypted personal health information over standard email. All clinical communications occur through our secure, authenticated portal.

8. Contact our Privacy Officer

For privacy-related inquiries, data access requests, or to file a complaint:

Email: privacy@stanch.io

Ontario's Information and Privacy Commissioner: www.ipc.on.ca