Privacy Policy

This policy explains what BluPage collects, why, and how it's handled. BluPage is booking, charting, and client-management software for solo practitioners.

This policy is issued by BluPage Technologies Inc., Toronto, Ontario, the operator of the BluPage service.

What we collect

• Account information you provide — your name/business name, email, timezone, booking slug, profile photo and bio, and (for regulated professions) the licensing details you enter.
• Client / patient records you create in BluPage — contact details, appointments, treatment preferences, and clinical (SOAP) notes you write about the people you serve.
• Billing information handled by our payment processor (Stripe). We store a Stripe customer reference and subscription status; we never see or store full card numbers.

Practitioners are the custodians of their patients' data

For health professions, the patient records you store in BluPage are health information for which you are the custodian under Ontario's Personal Health Information Protection Act (PHIPA) and your college's rules. BluPage acts as your service provider (an "agent"/processor): we store and process that information on your behalf and under your instructions, and we don't use it for our own purposes. You are responsible for obtaining any consents your regulator requires and for how you use the records.

Where your data lives

BluPage data is hosted in Canada — our database and file storage run in the ca-central-1 region. Our payment processor (Stripe) and transactional email provider may process limited data (billing identifiers, email addresses) outside Canada to deliver their services.

How long we keep it

Clinical records carry regulatory retention obligations that are yours as custodian — for example, your college may require records to be kept for a number of years (the CMTO requires massage-therapy records for at least 10 years). That retention obligation is yours, not a BluPage hosting guarantee. Within the service, signed clinical records are systematically restricted at the database level to prevent alteration, and corrections are handled by append-only amendment. On cancellation you have a 90-day grace period to export your data; after 90 days, BluPage reserves the right to securely delete all account data, including clinical records. Ensuring you meet your professional retention obligations before your account terminates is your responsibility. Account and billing data is kept while your account is active and as required afterward for legal, tax, and audit purposes. See the Data page for what happens on cancellation.

De-identified & aggregated data

BluPage may create and use data that has been de-identified and aggregated such that it removes any information that identifies the individual, or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual. BluPage may use such de-identified, aggregated data to analyze system performance, improve its features, and report on business metrics. BluPage will not attempt to re-identify de-identified data and will not permit others to do so.

Cookies & analytics

We keep this honest: BluPage currently uses no third-party analytics or advertising trackers. We use only the strictly-necessary storage required to keep you signed in. If we add analytics later, we'll update this policy first.

Bot protection

Public forms use Cloudflare Turnstile to block automated abuse. Turnstile receives limited technical signals to make that determination.

Your choices

You can view and edit your account information in Settings, and export or request changes to your data by emailing us. To ask a question or make a request, contact hello@blupage.app.