Privacy policy

Your employer pays us. You are still our patient. Those two facts do not conflict, because the employer buys a service and never buys your file.

We do not give an employer, an insurer or anyone else your individual results unless you have specifically and separately consented to that release, and you can withdraw that consent later.

Employers receive aggregate reporting only, and only above a minimum group size. Where a group is small enough that a reader could work out who a figure belongs to, we suppress the figure instead of publishing it.

Identity and contact: name, work email, employer, department or job title, and preferred language.

Health information you give us: relevant medical history, current symptoms, pain location and intensity, medication where relevant to safe testing, prior injuries, and anything else you choose to tell the clinician.

Measurement data: force values per muscle and per movement, left and right symmetry, endurance and repetition data, range of motion, and the date, device and protocol used. This is generated by equipment such as an isometric frame or a handheld dynamometer.

Care record: assessment findings, clinical reasoning, the exercise programme prescribed, retest results, and correspondence about your care.

Website data: pages viewed and aggregate usage through Vercel Analytics, which does not use cookies for tracking and does not build a profile of you, plus your language preference stored locally in your browser. See the Cookie Policy.

We do not collect your salary, performance ratings, attendance records, or disciplinary history, and we do not want them.

To assess you safely and decide whether a test or a load is appropriate for you on the day.

To produce a measurement that can be compared to published norms for your age and sex, and to your own earlier results.

To prescribe an individual programme and to check, on retest, whether it worked.

To meet our record keeping obligations as regulated health professionals.

To produce de-identified aggregate reporting for your employer about the site as a whole.

We do not use your information for advertising, we do not sell it, and we do not use it to train machine learning models.

We obtain your knowledge and consent before collecting, using or disclosing your information, except where the law allows or requires otherwise, for example in an emergency or where disclosure is required by a court order.

Consent to be assessed is separate from consent to release a result. Agreeing to be tested does not authorise us to send your number to anyone.

You may withdraw consent at any time, subject to legal and professional record keeping limits. Withdrawing means we stop using your information for the purposes above; it does not erase a clinical record we are required to retain.

If you withdraw, we will tell you plainly what stops as a result, for example that we can no longer track your progress against your own baseline.

Declining to participate has no effect on your employment. Your employer is contractually barred from treating it as a performance matter.

You: everything in your own record.

Your treating clinician and, where clinically necessary, another clinician on your care team.

Your employer: aggregate reporting only, above the minimum group size, with no individual identifier and no field from which one could be inferred.

An insurer, disability case manager, workers' compensation board or physician: only what you have specifically consented to release, and only within our scope of practice.

Service providers who host or process data on our behalf, under written contract, limited to what they need, and bound to protect it to a comparable standard.

A regulator, court or public authority where the law compels disclosure. Where we are legally permitted to tell you, we will.

We store personal health information on servers located in Canada wherever we can.

Where a service provider processes data outside Canada, that information may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. We name our providers and the applicable jurisdiction on request.

Quebec residents: we assess whether information receives adequate protection before any transfer outside Quebec, as Law 25 requires.

Every provider is bound by written contract to security and confidentiality obligations comparable to our own.

Clinical records are retained for the period the regulatory college of the province of care requires, which is commonly ten years from the last interaction for an adult, and for a minor commonly ten years from the date they reach the age of majority.

Records are kept for the longest applicable period where more than one rule applies, then securely destroyed.

Aggregate, de-identified reporting is retained without a fixed limit because it no longer identifies anybody.

Booking enquiries that do not lead to care are deleted within twelve months.

Encryption in transit and at rest, role based access, and access limited to the clinicians and administrators who need it for your care.

Access logging on clinical systems, so an inappropriate look at a record can be detected.

Devices used on site are encrypted and locked, and measurement data is uploaded and removed from local storage promptly.

Staff and subcontractors sign confidentiality undertakings and are trained on privacy obligations before they attend a site.

We assess every suspected privacy breach for real risk of significant harm.

Where that threshold is met we notify affected individuals and the Office of the Privacy Commissioner of Canada as soon as feasible, and any provincial commissioner or health regulator with jurisdiction.

We maintain a record of breaches as required by law, whether or not they were reportable.

Access: ask for a copy of your record. We respond within thirty days, and will tell you if we need an extension and why.

Correction: ask us to correct an error. Where we disagree, we attach a statement of your disagreement to the record.

Withdraw consent: as described in section 4.

Portability, where the law provides it: ask us to send your information to another organisation in a structured, commonly used technological format.

De-indexing, where the law provides it: ask us to stop disseminating information or to de-index it.

Quebec residents also have the right to be informed when a decision about them is based exclusively on automated processing, and to submit observations to a person who can review it. We do not currently make any decision about a Participant by automated processing alone.

Complain: to our privacy officer first, and to the Office of the Privacy Commissioner of Canada or your provincial commissioner if you are not satisfied.

Where a Participant is under the age of majority in their province, we obtain consent in the manner that province's law requires, which may mean consent from a parent or guardian, and we explain the assessment to the young person in language they can follow.

This website is not directed at children and we do not knowingly collect information from them.

We post any change here with a new effective date. Where a change is significant we take reasonable steps to notify current Clients and Participants.

Privacy officer, wereset, Toronto, Ontario, Canada. privacy@wereset.ca

Office of the Privacy Commissioner of Canada: priv.gc.ca. Ontario: Information and Privacy Commissioner of Ontario. Quebec: Commission d'acces a l'information. British Columbia and Alberta: the Office of the Information and Privacy Commissioner in that province.