Privacy Policy

Cornerstone Health Management Inc. is a physiotherapy and rehabilitation provider based in Ontario, Canada. The Services let your healthcare team assign home exercise programs, track your symptoms and activity, and monitor your rehabilitation progress between visits.

We treat the health information collected through the Services as personal health information and handle it in accordance with Ontario’s Personal Health Information Protection Act (PHIPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the standards of the regulatory colleges that govern our clinicians, and, where it applies, the U.S. Health Insurance Portability and Accountability Act (HIPAA).

By using the Services you consent to the practices described here. If you do not agree, please do not use the Services and contact your clinic to discuss alternatives for your care.

Account and identity information.Your name, email address, phone number, date of birth, the clinic and clinicians you are associated with, and your login credentials. Patient accounts are created by your clinic; clinician and administrator accounts are created by the clinic’s administrators.

Health and rehabilitation information. Your condition, treatment case details, the exercise programs assigned to you, exercises you mark as completed, and the daily symptom entries you record, such as pain, fatigue, sleep quality and other measures your clinician asks you to track.

Wearable and connected-app data. If you choose to connect a device or app, we receive the data you authorize from it. Supported sources are Garmin, Fitbit and Oura for activity, heart rate and sleep, and Cronometer and MyFitnessPal for nutrition. Connections are optional and can be removed at any time. See sections 4 and 5 for details.

Media you provide.Photos or videos you or your clinician add to the Services, for example a clinician’s exercise demonstration, or progress photos you choose to share with your care team.

Device and usage information. Device type, operating system, app version, unique device identifiers, push notification tokens, the features you use, and security audit logs of sign-ins and access to patient records. We do not use third-party advertising or behavioural tracking tools.

• To deliver your rehabilitation program: assign exercises, record your symptoms and activity, and show your progress to you and your healthcare team.
• To let your clinicians review objective activity, heart rate and sleep data alongside the symptoms you report, so they can adjust your program.
• To send you reminders, program updates and other communications related to your care, which you can control in your device settings.
• To operate, secure, troubleshoot and improve the Services, including audit logging required for health records.
• To comply with legal, regulatory and professional-college obligations.

We do not sell personal information, use it for advertising, or use it to build profiles for any purpose other than your care.

What we collect from Garmin. If you choose to connect a Garmin device, we receive the following categories of data from your Garmin Connect account, only after you authorize the connection: daily summaries (steps, distance, calories, active minutes, heart rate, resting heart rate, stress and similar wellness metrics), activity and workout records, and sleep records. We do not receive your Garmin account password, and we do not collect or store GPS location tracks from Garmin.

Why we use it.Garmin data is used for one purpose: to show you and your Cornerstone healthcare team objective measures of your activity, recovery and sleep so that your rehabilitation program can be monitored and adjusted. It is displayed in the app and in the clinician portal and may be included in reports prepared for your healthcare provider. We do not sell Garmin data, use it for advertising, or combine it with other users’ data for marketing or profiling.

How the data reaches us.Cornerstone uses Terra (Terra API Inc., “Terra”), a health data integration service, to establish and maintain the authorized connection between your Garmin Connect account and the Services. When you connect Garmin you authorize the connection through Terra’s secure authentication screen. Garmin delivers your data to Terra, and Terra delivers it to a server endpoint owned and operated by Cornerstone. Terra acts as our data processor under a written agreement: it transmits and formats the data on our behalf, is contractually prohibited from using it for its own purposes, and maintains HIPAA-aligned safeguards and SOC 2 certification. Terra is the only third party involved in receiving Garmin data on our behalf.

Where the data is stored. Once received, Garmin data is stored in encrypted databases on Amazon Web Services (AWS) infrastructure that we control, located in Canada. AWS is our hosting provider and does not access or use your data for any purpose other than providing infrastructure to us.

Who can see it. Garmin data is visible only to you and to the Cornerstone clinicians and authorized staff who are part of your care. It is not shared with any other third party, except where required by law.

Use of artificial intelligence.We do not use artificial intelligence, machine learning or automated decision-making to process, analyze or interpret Garmin data. Garmin data is never sent to any third-party AI service, and it is never used to train AI or machine-learning models, whether ours or anyone else’s. Any clinical interpretation of your data is made by your human healthcare provider. The limited AI features that do exist in the Services are described in section 6 and do not involve Garmin data or any other patient data.

Garmin API credentials and endpoints. Our access to Garmin data is governed by the Garmin Connect Developer Program. The credentials that authorize this access are held only by the licensed organization and are not shared with, transferred to, disclosed to, or used by any external party. Garmin delivers data only to endpoints approved for the licensed application.

Your control.You can disconnect Garmin at any time from the Devices screen in the app, or by revoking Cornerstone Connect’s access in your Garmin Connect account settings. Disconnecting stops all further data delivery. You may also ask us to delete the Garmin data we already hold by contacting telehealth@cornerstonephysio.com; we will respond within 30 days.

Attribution. Data obtained from Garmin is identified as such in the Services. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries. Cornerstone Connect is not endorsed by or affiliated with Garmin.

Fitbit, Oura, Cronometer and MyFitnessPal connections work the same way as Garmin: you authorize the connection through Terra’s authentication screen, the provider delivers the data you approved to Terra, and Terra delivers it to Cornerstone’s servers. We receive activity, heart rate and sleep summaries from Fitbit and Oura, and food and nutrient logs from Cronometer and MyFitnessPal. The same storage, access, AI and deletion rules described in section 4 apply to all connected sources. Each provider’s own privacy policy governs the data held in your account with that provider.

If you have not used the Services for an extended period, we may disconnect inactive device connections so that no further data is delivered to us. You can reconnect at any time from the app.

The Services use third-party generative AI services for one narrow purpose: helping our clinical team produce content for the shared exercise library, such as written exercise instructions and demonstration videos. A clinician starts each request, supplies the reference material (for example a clip of the clinician performing the exercise), and every result is reviewed by a person before it is published.

No patient data is sent to any AI service. Your name, health information, symptom entries, photos, and wearable or Garmin data are never used as input to, or training material for, any AI or machine-learning system, whether operated by us or by a third party. We do not use AI to make or recommend decisions about your care.

Your healthcare team. The clinicians and clinic staff involved in your care, within the clinic you are registered with, can see your information in order to provide treatment.

Service providers acting on our behalf. We use a small number of providers who process data only under our instructions and under written agreements that restrict their use of it:

• Amazon Web Services (AWS): cloud hosting, databases, file storage and user authentication (Amazon Cognito).
• Terra API Inc.: secure connection and delivery of data from the wearable devices and apps you choose to connect (see sections 4 and 5).
• Apple and Google: app distribution and push notification delivery for the mobile app.

Legal requirements. We may disclose information when required by law, by a court order, or by a regulatory college, or to protect the safety of a patient or others, in each case only to the extent required.

We do not share personal information with any other third party, and we never sell it.

• Personal health information is stored on AWS infrastructure in Canada. Our application servers run on AWS in Canada and the United States; data processed in the United States is encrypted in transit and is not retained there.
• All data is encrypted in transit (TLS) and at rest.
• Access is role-based: patients see only their own records, clinicians see only patients assigned to them, and administrators see only their clinic.
• Sign-ins and access to patient records are logged for audit purposes.
• Patient sessions in the app expire automatically after a period of inactivity.
• Security reviews and dependency updates are performed regularly.

No system is completely secure. If we become aware of a breach affecting your personal health information, we will contain it, assess the impact, notify you and the Information and Privacy Commissioner of Ontario as required by PHIPA, and take steps to prevent a recurrence.

Health records created through the Services form part of your clinical record and are retained for the period required by Ontario health-records law and our clinicians’ regulatory colleges. Wearable and connected-app data is retained for as long as it is part of your active treatment record, and is deleted on request as described in section 10. Account, device and audit-log information is kept only as long as needed for security and legal compliance.

• Access the personal information we hold about you and receive a copy in a portable format.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your personal information, subject to the record-keeping obligations in section 9.
• Withdraw your consent to the collection of wearable data at any time by disconnecting the device in the app, or withdraw consent to the Services entirely by contacting your clinic.
• Control notifications through your device settings.
• Complain to us, and if you are not satisfied, to the Information and Privacy Commissioner of Ontario.

To exercise any of these rights, email telehealth@cornerstonephysio.com. We will respond within 30 days, as required by law.

We may update this policy as the Services or the law change. The date at the top of the page shows when it was last revised. If a change materially affects how we use your health information, we will notify you in the app or by email before it takes effect.

Privacy Officer
Cornerstone Health Management Inc.
telehealth@cornerstonephysio.com