How We Handle Your Data

Our privacy commitment

Root Metabolic Health is committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law governing how private-sector organizations collect, use, and disclose personal information. Where applicable provincial health privacy legislation applies to a patient or partner organization, we aim to meet those requirements as well.

Where your personal information is stored

Your personal information, including account details, weight and health logs, and wearable device data, is stored on servers located in Canada and accessed by individuals located in Canada.

Cross-border access

While your personal information is stored in Canada, one supporting component of our platform, the authentication server for the mobile companion app, currently runs on infrastructure located in the United States. As a result:

• Login credentials and session information pass through this United States-based server as part of the sign-in process for the mobile app.
• Your health records (weight logs, monitoring data, and related information) are not stored on this server. They remain stored on servers located in Canada, as described above.
• Your information may be accessed by individuals in the United States for the limited purpose of supporting this authentication function.

We are working to move this component to Canadian infrastructure. If Canadian-only data residency is a requirement for your organization's evaluation, contact us directly and we will discuss our current architecture and timeline in detail.

How data moves and who can see it

Data transmitted between patient devices, the mobile app, and our servers travels over encrypted HTTPS connections. Access to patient data within our systems is limited to authorized personnel and integrated care-team tools required to operate the program.

Your rights under PIPEDA

• The right to know what personal information we hold about you
• The right to request correction of inaccurate information
• The right to withdraw consent for certain uses of your information, subject to legal or contractual restrictions
• The right to ask questions about how your information is collected, used, and disclosed

To exercise any of these rights, or if you have questions about how your data is handled, contact us using the details below.