We understand that your recovery information is deeply personal. POP was built to protect it. This Privacy Policy explains, in plain language, how we collect, use, and safeguard your information — and the choices you have. If you have questions, contact us at contact@pophealth.ai.
Privacy on this public website
This notice describes the information collected through pophealth.ai. The product-specific sections below concern use of the POP application and arrangements with hospitals and other healthcare organizations; simply visiting this website does not upload a medical record, create a patient account, or enrol you in a study.
What the website collects and why
- Demo requests: your name, professional title, email, language, submission time and follow-up status, to handle your request. POP emails a notification containing these details to its team. A request does not grant demo access or subscribe you to marketing.
- Waitlist: your name, email address, preferred language, and signup time, to manage your request for launch information. You can ask us to remove you at contact@pophealth.ai.
- Study-code requests: your name, email address, preferred language, whether you are a patient or caregiver, and the patient’s name if you are helping someone. These details identify the request and let the study team reply. A notification containing them is sent to the study team by email when you first request a code; to change the details later, write to contact@pophealth.ai. Only provide another person’s details with their permission or appropriate legal authority. A request is not study consent or permission to access their care plan.
- Survey: your selected role, answers, and any written follow-up answers. Health-related experiences may be included. An optional email is stored with your answers only after you opt into a follow-up conversation. It can identify your submission. We do not use survey contact details for marketing. Avoid names and identifying details in free-text answers.
- Technical data: hosting and security services process connection information, including IP addresses and request details, to deliver the website and limit abuse. Optional traffic and performance measurement is controlled separately. These public form endpoints do not send submissions to an AI model.
Submitting a form is voluntary. Contact forms require your name and email; the demo request also requires your professional title so the team can respond to your enquiry. You can contact the team directly instead. The survey requires participation consent and eligibility information; follow-up contact is optional. Refusing optional measurement does not block forms or study enquiries.
Providers, access, and processing locations
The website uses Vercel for hosting and, with your permission, Web Analytics and Speed Insights; Neon for the form database; and Resend to deliver study-code and demo-request notifications. The study team’s email service also processes those messages. POP team members handling these requests and the providers supporting those services may access the information for those purposes. We do not sell website form submissions or use them for targeted advertising.
Providers and their subprocessors may process information outside your province or country, including outside Quebec and Canada, where different laws can apply. This website does not promise Canada-only storage. Contact the Privacy Officer for information about the providers and locations relevant to your request.
Retention and privacy governance
We retain contact information to handle the request or launch notification, survey responses for the disclosed feedback purposes, and records needed for applicable legal obligations or disputes. When information is no longer needed for these purposes, the law requires it to be destroyed or anonymized; backup and legally required records may take longer to remove. Ask the Privacy Officer for the retention period and deletion options for your information. Leaving a page or clearing browser storage does not delete a submitted form.
The Privacy Officer is the contact for access, correction, withdrawal, deletion, portability where applicable, and complaints. Authorized POP personnel handle the request with the relevant service providers. We may need proportionate identity verification, and will explain any legal limits on a request. You do not need to create an account or send a medical record to raise a privacy concern.
Requests and complaints
Write to POP Health Technologies — Privacy Officer at contact@pophealth.ai. Identify the form or interaction and the request you want to make. Quebec access and correction requests receive a written response within 30 days of receipt, as required by law. A survey response without contact information may be difficult to locate; do not send extra sensitive information to try to identify it.
You may also contact the Commission d’accès à l’information du Québec or, where federal law applies, the Office of the Privacy Commissioner of Canada. You can raise a concern without giving up another legal remedy.
Commission d’accès à l’information du Québec (in French) · Office of the Privacy Commissioner of Canada
Read about browser storage or change optional measurement in Cookies & Choices.
Scope and Updates to This Privacy Policy
This Privacy Policy applies to personal information processed by POP Health Technologies (“POP,” “we,” “us,” or “our”), including on our websites, mobile applications, and other online or offline offerings (collectively, the “Services”).
Changes to our Privacy Policy. We may revise this Privacy Policy from time to time. We will show the date of the current version at the top of this Policy and announce material changes as required by applicable law. When a change introduces a new use or disclosure that requires consent, we will obtain that consent before the new practice begins.
An Important Note: This Privacy Policy does not apply to personal information we process on behalf of hospitals, clinics, and other healthcare organizations through their use of our Services (“Customer Data”). That processing is governed by the organization’s instructions, our written agreement with it, and the law that applies to it. Questions about Customer Data should be directed to the relevant healthcare organization.
When POP Acts for a Healthcare Organization vs. Directly for You
Depending on how you access POP, we may act in different legal capacities. Understanding which capacity applies to you is important because your rights and our obligations differ.
A. Hospital or Clinic Deployments
When a hospital, clinic, or other healthcare organization deploys POP and shares your discharge instructions or health information with us, POP processes that information on the organization’s behalf, under its instructions and a written agreement. In this context:
- The healthcare organization remains responsible for that information, its own privacy notices, and your rights over its records, under the health-information law that applies to it. In Quebec, this includes the Act respecting health and social services information; in Ontario, the Personal Health Information Protection Act (PHIPA).
- POP acts as the organization’s service provider: we use the information only to provide the Services to it, under its instructions and our written agreement, and do not use it for our own purposes.
- Requests about information your healthcare organization shared with POP should be directed to that organization. We will help it respond.
B. Direct Service Provider (Independent Patient Use)
When you independently create a POP account and upload your own discharge documents or recovery information — without a healthcare organization deploying POP — POP is responsible for that information. In this context:
- This Privacy Policy governs our collection and use of your information.
- You are in direct control of your account, your data, and the rights described in Section 9 of this Policy.
- You may choose to share your care plan with caregivers or providers, which is your choice and your responsibility.
C. Hybrid Deployments
Some users may be enrolled by a hospital and also use POP independently. In such cases, information provided by the hospital remains governed by the hospital’s instructions and our agreement with it, while information you voluntarily add to your account is governed by this Privacy Policy.
How POP Uses Artificial Intelligence
POP is an AI-native platform. We use artificial intelligence and machine learning technologies to extract, organize, and personalize the health information you submit, turning complex discharge documents into clear, actionable recovery plans.
What AI is Used For
- Parsing and structuring surgical discharge instructions you upload or your provider shares.
- Generating personalized, step-by-step recovery schedules and care reminders.
- Surfacing relevant recovery information in response to your questions.
- Improving the accuracy and relevance of our Services over time.
AI and Your Health Information — Our Commitments
- We use health information to provide the Services to you. We do not use it to train AI models made available to others.
- Any use of de-identified or aggregated data to improve our AI systems is described in Section 6.
- Third-party AI service providers that process information on our behalf do so under written agreements that limit their use of it to providing services to POP.
- AI output can be wrong. Check it against your original instructions and confirm questions with your care team (see our Health & AI Information notice).
If you have questions about a specific AI decision affecting your care plan, contact us at contact@pophealth.ai.
Personal Information We Collect
The categories of personal information we collect depend on how you interact with us. We collect information you provide to us, information collected automatically when you use our Services, and information from other sources.
A. Personal Information You Provide to Us
- Account information. Name, email address, phone number, address, role (e.g., patient, caregiver, healthcare provider), and other account details.
- Health and recovery information. Surgical discharge instructions, symptom reports, recovery check-in responses, medication details, and related health notes. This is sensitive information and is handled as described in Section 2 and the rest of this Policy.
- Support and feedback information. Information you submit when contacting us for support, responding to surveys, or providing feedback about your recovery experience.
- Business development information. Information collected from individuals and organizations to assess potential partnerships or business opportunities.
- Job applicant information. Application materials including CV, cover letter, and employment history for candidates applying to work at POP.
B. Personal Information Collected Automatically
We may automatically collect certain technical and usage information when you interact with our Services, including:
- Internet protocol (IP) address and approximate location (derived from IP)
- Browser type, device type, and operating system
- Cookie identifiers and session data
- Pages visited, features used, links clicked, and frequency and duration of activity
- Referring URLs and search terms used within the Services
C. Personal Information from Other Sources
We may obtain personal information from public sources, third-party service providers, or organizations through co-sponsored events or shared content channels. We combine this information with other data we hold only where permitted by law.
Cookies and Other Technologies
We may use cookies and similar technologies to provide and measure our Services. This public website uses Vercel Web Analytics and Speed Insights for aggregated traffic and performance reporting only after you allow optional measurement. Study and survey pages are excluded. You can change your choice on our Cookies & Choices page. Vercel Web Analytics does not use third-party cookies or associate page-view data with an identified individual.
We do not serve third-party advertising inside POP recovery workflows. Any marketing technologies we use are limited to communications about POP’s own products, features, and research programs.
On Services that use non-essential cookies or similar technologies, we provide consent or refusal controls before activation where applicable law requires them. You may also use your browser controls to block cookies, but doing so may affect some features.
How We Use Your Personal Information
A. Providing Our Services
- Managing your account and providing access to your personalized care plan
- Parsing and structuring discharge instructions using AI (see Section 3)
- Sending recovery reminders, check-in prompts, and health-related communications you have requested
- Answering customer and technical support requests
- Communicating with you about your account and material policy changes
B. Improving and Developing Our Services
- Assessing performance, identifying bugs, and improving platform reliability
- Developing new features, workflows, and recovery programs
- Conducting internal research and analytics on aggregated, de-identified data
- Training and evaluating our AI systems using de-identified data only (see Section 3)
C. Service-Related Communications
We may contact you about product updates, new features, research participation invitations, and clinical program opportunities. We do not use your health information for general advertising or third-party marketing. You may opt out of non-essential communications at any time (see Section 9).
D. Legal, Safety, and Compliance
- Authenticating and verifying your identity
- Detecting, preventing, and responding to fraud, security incidents, and abuse
- Complying with our legal and regulatory obligations
- Enforcing our agreements and policies
- Processing job applications
E. De-identified and Aggregated Information
We may de-identify or aggregate personal information so that it can no longer reasonably be used to identify an individual. Information is treated as anonymized only when it meets the criteria of the law that applies to it; in Quebec, that means it irreversibly no longer allows a person to be identified, directly or indirectly. We do not attempt to re-identify de-identified data. De-identified or aggregated information may be used for product improvement, research, and evaluation of POP.
How We Disclose Your Personal Information
A. Disclosures to Provide Our Services
- Service Providers. We share information with vendors who assist with hosting, IT infrastructure, communications, customer support, and AI processing services. All service providers are contractually bound to use your data only to perform services on our behalf.
- Healthcare Provider Customers. Where you use our Services through a healthcare provider, we may share your information with that provider as necessary to support your care and recovery, consistent with applicable law and your provider’s authorization.
- Third-Party Integrations. If you choose to connect POP with third-party tools (e.g., health apps or wearable devices), information shared with those services is subject to their own privacy policies.
- Business Partners. We may share non-health information with business partners to provide a specific product or service you have requested.
- Affiliates. We may share personal information with POP corporate affiliates for purposes consistent with this Privacy Policy.
B. We Do Not Sell Health Information
POP does not sell, rent, or share health information for advertising or marketing. We do not serve third-party advertisements within recovery workflows or sell health data to data brokers.
C. Disclosures to Protect Us or Others
We may disclose information where we, in good faith, believe it is necessary to comply with law or legal process; protect the rights, property, or safety of POP, our users, or the public; enforce our agreements; or assist with the investigation of suspected illegal activity.
D. Business Transactions
If POP is involved in a merger, acquisition, financing, reorganization, or transition of service, your information may be transferred as part of that transaction, subject to applicable law and contractual protections. We will notify you of any material change in data controller as required.
Data Security Practices
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, designed to protect it from unauthorized access, loss, or misuse. No method of transmission or storage is completely secure.
Our Security Measures Include:
- Encryption of data in transit and at rest.
- Access restricted to authorized personnel who need the information for their work.
- Written agreements requiring service providers to protect the information they process for us.
- Procedures to respond to confidentiality incidents, including notifying regulators and affected people where the law requires it.
Hospitals and enterprise partners may request additional security documentation by contacting contact@pophealth.ai.
Your Privacy Choices and Rights
A. Your Privacy Choices
- Email Communications. You can stop non-essential emails at any time by writing to contact@pophealth.ai. Promotional emails we send will also include a way to unsubscribe. You will continue to receive service-critical communications and care-related messages you have requested.
- Phone Calls. To opt out of marketing calls, follow the instructions on the call or contact us as described in the Contact Us section.
- Cookies. On this public website, use Privacy settings on our Cookies & Choices page to allow or decline optional measurement. A Global Privacy Control or Do Not Track signal keeps it off. Browser settings can also block cookies, which may affect some features.
B. Your Privacy Rights
Depending on your location and applicable law, you may have the right to:
- Request Access. Know what personal information we hold about you, its sources, and how it has been used.
- Request Correction. Ask us to correct inaccurate or incomplete information.
- Request Deletion. Ask us to delete your personal information, subject to legal and contractual obligations.
- Sale or Sharing. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of.
- Request Restriction or Object. Ask us to limit or stop certain processing activities.
- Data Portability. Receive a copy of your information in a portable format.
- Withdraw Consent. Where we rely on consent, you may withdraw it for future processing.
- Quebec Dissemination and De-indexation Requests. Where section 28.1 of Quebec’s private-sector privacy law applies, ask us to cease disseminating personal information or to de-index or re-index a hyperlink associated with your name.
- Lodge a Complaint. You may file a complaint with your applicable data protection authority.
To exercise these rights, contact us at contact@pophealth.ai. For Quebec access and correction requests, we will respond in writing no later than 30 days after receipt. Other requests will be answered within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.
International Transfers of Personal Information
POP is based in Quebec, Canada. Personal information we collect may be transferred, processed, and stored in Quebec, elsewhere in Canada, or in other countries where our service providers operate, as described below.
Canadian Users
For users in Canada, including those at Quebec-based institutions, our handling of personal information is subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, Quebec’s Act respecting the protection of personal information in the private sector, as amended notably by the Act to modernize legislative provisions as regards the protection of personal information (commonly called “Law 25” and formerly Bill 64). Under these laws:
- Our Privacy Officer is the person responsible for the protection of personal information and can be reached at the address below.
- We collect only the personal information needed for the purposes we disclose, and use it only for those purposes unless you consent or the law permits otherwise.
- You can request access, correction, and, where applicable, portability, or ask us to cease dissemination or de-index or re-index a hyperlink in the circumstances set out in section 28.1 of the Quebec statute.
- Quebec law requires a privacy impact assessment and a written agreement before personal information is communicated outside Quebec, and for new or substantially modified information systems. Ask our Privacy Officer about the assessment and providers relevant to your information.
Users in Quebec and other Canadian provinces may direct privacy inquiries to our Privacy Officer at contact@pophealth.ai.
European and UK Users
If personal information originating from the European Economic Area (EEA), Switzerland, or the United Kingdom is transferred to a country without an adequate level of data protection, we use EU Standard Contractual Clauses or other appropriate safeguards, as required by applicable law.
Data Residency
Our providers and their subprocessors may store or process information outside your province or country, including outside Quebec and Canada. We do not promise Canada-only storage. If you require specific data residency commitments (e.g., Canadian-only data storage for hospital procurement), please contact contact@pophealth.ai to discuss enterprise options.
Retention of Personal Information
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, and as required by applicable law.
- Active Account Data. Retained for the duration of your active account and a reasonable period thereafter to support continuity of care and address outstanding requests or disputes.
- Post-Discharge Recovery Data. Retained for the duration reasonably necessary to support your recovery period. Deleted upon request, subject to the exceptions below.
- Backup and Archival Data. Maintained for a limited period for disaster recovery purposes, after which they are securely purged.
- Legal and Compliance Obligations. We may retain certain information for longer periods where required by law, regulation, or contractual obligation, including records a healthcare organization instructs us to retain.
- Secure Deletion. Deletion is subject to applicable retention obligations and backup lifecycles. Contact us for the deletion options and timing that apply to your information.
- Account Deletion Requests. We will delete or de-identify your personal information within the timeframe required by applicable law, except where retention is legally required or necessary to resolve a pending dispute.
Our Lawful Basis for Processing (EU/UK GDPR)
If your personal information is subject to the EU or UK General Data Protection Regulation, our processing is supported by the following lawful bases:
- Performance of a Contract. We process personal information as necessary to perform our agreement with you or to take pre-contractual steps.
- Legitimate Interests. We may process personal information to pursue our legitimate interests — such as improving our Services and preventing fraud — where those interests are not overridden by your rights.
- Legal Obligations. We process personal information to comply with applicable laws and regulations.
- Consent. In some cases, we rely on your explicit consent, which you may withdraw at any time (see Section 9).
Children's Information
Our Services are not directed to children under the age of 18 (or such other age as required by local law). We do not knowingly collect, sell, or share personal information from children. If you believe your child has provided us with personal information without your consent, please contact us at contact@pophealth.ai. If we become aware that a child has provided information in violation of applicable law, we will delete it and terminate the child’s account, unless we have a legal obligation to retain it.
Other Provisions
Third-Party Websites and Applications
Our Services may contain links to third-party websites or applications not controlled by POP. We encourage you to review the privacy policies of each service you interact with. POP is not responsible for the privacy practices of third-party services.
Health Information Shared by Healthcare Organizations
Health information a healthcare organization shares with POP is also governed by our agreement with that organization and the law that applies to it, as described in Section 2.
No Sale of Health Information
POP does not sell health information. This commitment applies regardless of the mechanism, platform, or legal framework through which data might otherwise be transferred.
Do Not Track
On this public website, an enabled Do Not Track (“DNT”) or Global Privacy Control signal keeps optional measurement off, even if you allowed it earlier. This public website does not use third-party advertising trackers or third-party cookies. You may contact us to exercise any applicable privacy right.
Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy or our privacy practices, please contact us:
To make a privacy complaint, include “Privacy complaint” in the subject line and describe the practice at issue. Our Privacy Officer will review the complaint, may contact you for information needed to investigate, and will respond within the timeframe required by applicable law. You may also complain to the privacy regulator in your jurisdiction.
POP Health Technologies — Privacy Officer
contact@pophealth.aiFor EU/UK GDPR purposes: POP Health Technologies is the data controller.
For Quebec Law 25 purposes: Our Privacy Officer is responsible for compliance and can be reached at the address above.