Privacy Policy

This Privacy Policy explains how Circle Health Inc. and its operating companies, including Circle Health King Inc. (together, “Circle Health,” “we,” “us,” or “our”), collect, use, disclose, and protect your information through our websites, applications, member portal, the AI tools health companion, and our clinical and wellness services (the “Services”). It is provided together with, and forms part of, our Terms of Use. We are committed to compliance with Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy legislation. By using the Services you consent to the practices described here.

1. How We Handle Your Clinical and Wellness Information

Circle provides both insured medical care and optional uninsured longevity and wellness services, and we keep information from both in a single health record for you. As a health information custodian, we are accountable for the protection of your personal health information. Access is limited to the members of your care team who need it to provide and coordinate your care, on a need-to-know basis, and all of your information is protected by the safeguards described in this Policy. Keeping your clinical and wellness information together supports coordinated, whole-person care while protecting the confidentiality of your medical record.

2. Definitions

• “Personal Information” — information about an identifiable individual, such as name, contact details, age, and gender.
• “Personal Health Information” (PHI) — information about your health or health care, including history, symptoms, diagnoses, medications, biomarker and test results, and treatment plans, as defined in PHIPA.

Where this Policy refers to “your information,” it means Personal Information and PHI, as applicable.

3. Information We Collect

• Information you provide — registration and profile details; intake questionnaires and longevity/pathway assessments; health history, symptoms, and goals; and images or documents you upload.
• Clinical information — assessment notes, diagnoses, prescriptions, referrals, and laboratory and diagnostic results created in the course of your care.
• Biomarker and diagnostic data — results from lab and diagnostic partners, and calculated measures such as biological age, body composition, and cardiovascular-risk scores.
• AI tools interactions — your questions to, and interactions with, the AI tools companion.
• Payment information — processed by our third-party payment processor; we do not store full card numbers.
• Technical and usage data — device, log, and usage information, and cookies/analytics as described in Section 11.
• Clinic security — where our physical premises use video surveillance for safety and security, images may be recorded in common areas (not in examination rooms), with appropriate signage.

4. Why We Collect and How We Use Your Information

We use your information to: provide clinical care and longevity/wellness services; create and manage your account and membership; schedule appointments and communicate with you; order and interpret laboratory and diagnostic testing; operate AI tools and the platform; process payments; meet legal, regulatory, insurance, audit, and security requirements; and, with your consent, improve our services and, in limited circumstances, conduct research. We identify the purpose of collection at or before the time we collect, unless the purpose is obvious.

Research and de-identified information. With your consent, we may use your information for research that has been reviewed and approved by a research ethics board, and you may decline or withdraw from research at any time without affecting your care. We may also create de-identified and aggregated information — data that does not identify you — and use or share it to operate, evaluate, and improve our services and to advance longevity science. We apply recognized de-identification methods, we do not attempt to re-identify you, and de-identified or aggregated information is not treated as your Personal Information or PHI. We do not sell your Personal Information or PHI.

5. Consent

You may give consent expressly or, where permitted, implicitly through your use of the Services. You may withdraw consent, or ask us to delete your account, at any time and without penalty, subject to legal and professional record-keeping obligations that require us to retain clinical records for defined periods. Withdrawal of consent does not affect the lawfulness of any collection, use, or disclosure that occurred before withdrawal. You may withdraw consent to the use of your information for research or marketing without affecting your care. To exercise these choices, contact our Privacy Officer at info@circlehealth.ca.

6. AI tools and Automated Processing

AI tools process your information to provide general information and surface longevity context for you and your care team. AI tools do not make clinical decisions and do not, on their own, diagnose or determine your care. We minimize the identifiable information processed by automated tools, and we may retain de-identified logs of interactions for quality, safety, and improvement. We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

7. Laboratory, Diagnostic and Pharmacy Partners

To provide care, we work with licensed laboratory and diagnostic partners. Where testing is clinically indicated and ordered through OHIP, results flow into your clinical record at no charge to you. If you choose an optional integrated pharmacy experience through Circle Pharmacy, information necessary to fulfil a prescription is shared with the licensed partner pharmacy only with your opt-in; you may always choose your own pharmacy. Please note that prescriptions dispensed through provincial pharmacy systems may be recorded in provincial medication records accessible to other providers involved in your care.

8. How We Disclose Information

• Within your circle of care — to the clinicians and staff involved in providing your care, on a need-to-know basis.
• To family or others involved in your care — where you identify a family member or friend involved in your care, we may share information relevant to that involvement; in an emergency, or where you are unable to consent, we may disclose information in your best interest and will tell you afterward so you can object to further disclosure.
• To service providers (processors) — who perform functions on our behalf under contract, bound to equivalent safeguards (see Section 9).
• With your direction or consent — for example, to share your record with another provider you choose.
• For legal reasons — to comply with law, regulatory and professional-college obligations, court orders, subpoenas, or valid governmental requests; to make disclosures required or permitted by law, such as mandatory public-health and communicable-disease reporting and the reporting of suspected child abuse or neglect; or to protect the rights, safety, or vital interests of you or others.
• Business transactions — in connection with a merger, financing, or sale of assets, the information may be disclosed to, and used by, a successor for the purposes described in this Policy.

We do not sell your Personal Information or PHI.

9. Service Providers and Data Location

Your Personal Health Information is stored in Canada. We use the following categories of service providers to operate the Services. Where a provider processes limited technical data outside Canada, we put appropriate contractual and security safeguards in place; PHI remains hosted in Canada.

10. Safeguards

We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the information, including encryption of data in transit and at rest, access controls on a need-to-know basis, staff privacy and security training, and contractual safeguards with our service providers. These measures include regular risk assessments and security reviews. No system is perfectly secure; while we take reasonable steps to protect your information, we cannot guarantee the security of information transmitted over the internet.

11. Cookies, Analytics, and Advertising

Our websites and apps use cookies and similar technologies to operate the Services, remember your preferences, understand usage, and measure our marketing. This includes first-party analytics and third-party advertising tools provided by companies such as Google and Meta. When you arrive from an online ad, we may receive and store advertising identifiers (for example, Google’s gclid and Meta’s fbclid) and campaign parameters associated with your visit, and we may share conversion events — such as joining our waitlist or becoming a member — with these platforms to measure and improve our advertising. These identifiers can be linked to you as an individual for attribution purposes; we do not share your health information with advertising platforms.

You can control cookies through your browser settings, and you can opt out of interest-based advertising through the tools offered by Google and Meta, though some features may not function without cookies. We keep marketing and advertising data separate from your clinical records.

12. Retention

We retain clinical records for the periods required by PHIPA and CPSO — generally at least ten years after the last entry for an adult patient, and, for a patient who was a minor, ten years after the patient would have reached the age of majority. Membership and wellness information is retained only as long as necessary for the purposes described here or as required by law. Where we use Personal Information to make a decision that directly affects you, we retain it for at least one year so you can request access.

13. Your Rights — Access, Correction and Accounting

Subject to limited legal exceptions, you may: access the information we hold about you; request correction of inaccurate or incomplete information (and if we refuse, you may attach a statement of disagreement to your record); request an accounting of certain disclosures; ask that we communicate with you confidentially by a reasonable alternative means or at an alternative address; and withdraw consent or request deletion of your account. Requests that concern information created by a Circle clinician in your clinical record are handled through your clinician and our health-records process. To make a request, contact our Privacy Officer at privacy@circlehealth.ca; we will respond within the timelines required by law.

14. Privacy Breaches

If a privacy breach affecting your information occurs, we will investigate, take steps to contain and remediate it, and notify you and the Information and Privacy Commissioner of Ontario at the first reasonable opportunity where required by law.

15. Marketing Communications

With your consent, we may send you information about our products and services. You can opt out of marketing communications at any time using the unsubscribe link or by contacting us. This does not affect essential transactional or care-related messages — such as appointment reminders, results-ready notices, membership and billing notices, and other service messages — which we send as part of providing the Services and which are not marketing.

16. Children and Family Plans

Family plans may include minor children. A parent or guardian provides and manages consent for a minor’s participation, consistent with the minor’s evolving capacity to consent to their own health care under Ontario law. We will not knowingly provide services to a minor without the permission of their parent or guardian, except where the minor is capable of consenting to a health service under the Health Care Consent Act, in which case the minor may also consent to the collection, use, and disclosure of the related personal health information. Clinical records are kept private between spouses on a family plan, and adult children are not added to a family profile.

17. Changes to This Policy

We will review this Policy regularly and may update it to reflect changes in our practices or the law, but we will not reduce your rights without your consent. We will post changes here and, where the changes are significant, provide more prominent notice.

18. Privacy Officer and Complaints

Our Privacy Officer is responsible for our compliance with this Policy and applicable privacy law. If you have questions, requests, or complaints, please contact:

If our Privacy Officer cannot resolve your concern, you may contact the Information and Privacy Commissioner of Ontario (ipc.on.ca).

Effective Date: July 1, 2026
Last updated: August 12, 2026