Trust isn't a feature.
It's the foundation.

This policy covers coldstream.info and the Coldstream products at coldstream.app and its sites. It explains what information we handle, why, and the choices you have. It reflects the same commitments we document across this Trust Center. Coldstream currently operates in Canada; access from outside Canada is intended only for Canadian patients and clinicians who are travelling or living abroad.

Who we are

Coldstream Informatics builds software for medicine and life from Vernon, British Columbia, Canada. Our privacy contact is Brett Poulin — contact@coldstream.info.

What information we handle

• Account information — your name, email address, and profile photo when you sign in with your Google account.
• Content you create — the records, documents, and files you or your care team add to a Coldstream product.
• Patient health information — where a clinician or clinic uses Coldstream, we process patient information on the clinic's behalf. The clinic remains the custodian of that information under applicable law; Coldstream is a service provider responsible for the security of the platform.

We keep third-party advertising and tracking analytics disabled across our products. We collect the operational logs needed to run and secure the service, and our own internal usage measures to improve it (see below).

How we use it

To provide, support, secure, and improve the service. We do not sell or rent personal information, we do not share it for others' advertising or marketing, and we do not use your data to train AI models.

To understand how our products are used and make them better, we keep our own internal, first-party analytics — aggregated, de-identified usage measures (which features are used, and how our tools are performing). This stays inside Coldstream; we do not use third-party advertising or tracking services, and we will never share this information with outside groups without your consent. Where we handle patient information on a clinic's behalf, any such analysis is aggregated and de-identified so it does not identify individual patients.

AI features

AI that processes health information runs only through providers under healthcare-grade data-protection terms — Google Vertex AI under Google's Cloud Data Processing Addendum, and OpenAI under a business associate agreement with zero data retention. Provider data-logging is disabled and customer data is never used for model training. Details are on our Subprocessors page.

Where your data lives, and how it's protected

Health records are stored in Canada (Google Cloud regions in Montréal and Toronto). Some processing — serverless functions, application hosting, and AI features — currently runs in United States regions under the contractual terms above; see Data protection & residency. We protect data with encryption in transit and at rest, restrict ourselves to HIPAA-eligible services, apply least-privilege access controls, and audit-log access to sensitive records.

Sharing

We share data only with the vetted subprocessors needed to run the service, under contractual data-protection terms, and where the law requires it. Payments are handled by Stripe; card details never touch our servers.

Retention and deletion

We retain information while your account is active or as the custodian clinic instructs, and honor deletion requests subject to the clinic's legal record-keeping obligations. To request deletion, contact us or ask your clinic.

Your rights

You can request access to, or correction of, your personal information. For patient records, requests are handled through your clinic, which remains the custodian; we support clinics in fulfilling them. If you have a concern we can't resolve, you may complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

If something goes wrong

If a privacy breach affects information under our care, we will notify the affected custodian(s) without undue delay and cooperate with any mandatory reporting to the relevant privacy authority.

Changes and contact

If this policy changes, we'll post the update here with a revised date. Questions, requests, or complaints: contact@coldstream.info.

These terms are an agreement between you and Coldstream Informatics ("Coldstream") and apply to the Coldstream products at coldstream.app and its sites. By creating an account or using the service, you agree to them.

The service

Coldstream provides software that supports clinical and community workflows. It is a tool that supports professional work — not medical advice, and not a substitute for professional judgment. Clinicians remain responsible for their clinical decisions and professional obligations at all times. The service is currently offered in Canada; use from outside Canada is intended only for users based in Canada who are travelling or temporarily abroad.

Your account

Keep your sign-in credentials secure and your account information accurate. You are responsible for activity under your account, and for ensuring people you invite or grant access to are authorized to see what you share with them.

Acceptable use

Use the service lawfully. Don't attempt unauthorized access, interfere with the service, or misuse it to harm others. Only upload patient information you are authorized to handle, and respect the privacy obligations that apply to you and your organization.

Your data

Your data belongs to you and, for patient records, to the custodian clinic. We process it only as described in our Privacy Policy and any applicable data-processing agreement. You can export your data; contact us and we'll provide reasonable assistance.

Fees and billing

Some products are free; paid subscriptions are billed through Stripe, and card details never touch our servers. Prices and plans may change with reasonable advance notice.

Availability and support

We work to keep the service available and continuously improve it, but availability is provided on a best-effort basis and features may change. Support is available in-app and at support@coldstream.info.

Disclaimers and limitation of liability

The service is provided "as is", without warranties of any kind, to the extent permitted by law. To the maximum extent permitted by the laws of British Columbia, Coldstream is not liable for indirect or consequential damages, and our aggregate liability is limited to the amounts you paid for the service in the twelve months before the claim arose.

Termination

You may stop using the service or cancel a subscription at any time. We may suspend or terminate access for breach of these terms, with notice where practicable. On termination you may export your data, and information subject to a custodian clinic's retention obligations is handled per those obligations and our Privacy Policy.

Changes and governing law

If these terms change materially, we'll post the update here with a revised date, and continued use of the service constitutes acceptance. These terms are governed by the laws of British Columbia, Canada. Questions: contact@coldstream.info.