Privacy Policy
Last updated: August 28, 2026
1. Introduction
Praxio ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including Retroact.
2. Information We Collect
We collect information that you provide directly to us, including:
- Account information (name, email address, password)
- Professional information (practice name, specialty)
- Patient data that you enter into our system
- Payment information (processed securely via Stripe)
We also receive limited technical information automatically when you visit our website. Your IP address is used, in memory and only for the length of the request, to work out which country you are connecting from, so the site can be served in the right regional language. It is not stored, not logged and never sent to a third party — the country is looked up against a database held on our own server. It is not used to identify, locate or profile you.
The only cookie we set remembers which language you are reading the site in. Signing in stores a session token in your browser's local storage rather than in a cookie. Neither is used for advertising, and we set no third-party cookie of any kind.
We use Plausible Analytics to count page views and referring sites in aggregate. It sets no cookie and stores nothing on your device; it does not retain your IP address and creates no identifier that persists from one day to the next, so it cannot recognise you between visits or across other sites. No page view is ever reported for the pages of your account, and Plausible is not used in Retroact at all.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process transactions and send related information
- Send technical notices and support messages
- Respond to your comments and questions
4. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All data is encrypted in transit and at rest.
5. Where Your Data Is Stored
The location in which patient records are kept is determined by a setting under the control of the account holder. Under the standard configuration we hold those records, and this section describes that arrangement. The account holder may instead elect to keep every record on a single computer belonging to the practice, in which case the records do not reach us at all: we are unable to read them, to back them up or to restore them. That configuration supports one computer and one user, and accordingly permits neither colleague access nor the sharing of patients.
Your patient records — the clinical data you enter and the patient details attached to it — are stored on Google Cloud infrastructure in Canada (Montreal, Quebec), and backed up in Canada.
Data residency can take up to 48 hours to take effect. If the region for your market does not exist yet, your records are stored in our Canadian region until it does. You can check where your own records are held at any time in your account, under Settings → Data Residency.
Some information is handled outside that storage location by the services we rely on to operate:
- Sign-in information (your email address and account identifier) is held by Google Firebase Authentication in the United States. Firebase Authentication does not currently offer a Canadian storage option.
- Billing information is processed by Stripe in the United States. We do not store card numbers ourselves.
- Email delivery is handled by Resend in the United States, so the contents of any email we send you passes through it.
In accordance with Quebec's Act respecting the protection of personal information in the private sector (Law 25), we disclose that your patient records are stored and processed in Quebec, and that the sign-in, billing and email delivery information described above is stored and processed outside Quebec. We assess the protections available in the receiving jurisdiction before entrusting information to a service provider.
Storage of data in a particular country is not equivalent to placing it beyond the reach of another country’s legal process. Our infrastructure provider is a United States company and may be subject to lawful orders issued by United States authorities irrespective of where data is physically held. We disclose this rather than imply a protection we are not in a position to provide.
6. Your Rights
Under Quebec's Law 25 you have the right to access the personal information we hold about you, to have it corrected, to withdraw consent, and to receive it in a structured, commonly used technical format. You may also ask us how it is being used and to whom it has been communicated.
If you are located in the European Economic Area, the GDPR gives you comparable rights: access, rectification, erasure, portability, and the right to object to or restrict processing. Note that we do not currently store data within the EEA.
To exercise any of these rights, contact us using the form below. You may also export your data yourself at any time from your account.
7. Contact Us
If you have questions about this Privacy Policy, please contact us at: