Privacy Policy

Your privacy is of vital importance to us. Shoshin uses your data in the following ways:

1. 1 We do not collect government-issued identifiers such as health card numbers (MSP), Social Insurance Numbers (SIN), or official legal names.
2. 2 We do not link nicknames to individual assessments in any way that could identify you.
3. 3 Age (birth year and month) and gender are used solely to improve medical assessment accuracy.
4. 4 Medical history, current medications, and allergy information are collected to refine follow-up questions and provide consistent triage assessments.
5. 5 Your home province is used to apply the correct regional medical guidelines.
6. 6 Your current location (when travelling) helps provide triage actions appropriate for local healthcare services.
7. 7 Health data submitted for assessments and report insights is processed by Google's Gemini Enterprise Agent Platform under an enterprise agreement. Because the Gemini model we rely on is not yet offered from Google's Canadian regions, this processing may take place on Google servers outside Canada, including the United States. Under our enterprise agreement, your data is not used to train Google's models and is not retained for training.
8. 8 Your email address is collected at sign-up and is used for authentication and to respond to feedback you submit. While you have a Shoshin account, and for two years after a paid subscription ends, we may also email you news about new features, product updates and our monthly newsletter, unless you have told us not to. You can tell us at sign-up, at any time in Settings, or with the unsubscribe link in any such email. Your email address is never included in public-facing communications.
9. 9 Assessment, report insight, physiotherapy plan and nutrition plan records are retained for up to two years from creation, then automatically deleted. Personal health record entries are kept for the life of your account and can be deleted one at a time. You may delete your records or your entire account at any time from Settings.
10. 10 De-identified assessment and report data may be analyzed to improve the accuracy and safety of the product. Since September 2026 this can include the names of medications, tests and findings, and eye prescription values, from your personal health record as an assessment saw them. It never includes your nickname, your email, your precise location or the text of a document, and it carries no account identifier: the details that identify you are removed before anything is kept.
11. 11 Your account is held in Firebase Authentication. The details of every account you hold, and your assessments, report insights, plans, feedback and personal health record (encrypted with a key held for your account) are stored in Google Firestore databases hosted in Canada (Toronto region).
12. 12 We share personal information with service providers only as needed to run Shoshin: Google (AI processing, hosting, fonts, and Google Analytics and Google Ads for page views and conversion measurement, which never receive health information), PayPal (payment processing, which receives your name, billing address, and country to complete a subscription), and OpenStreetMap (optional location lookup). If you submit feedback, its contents are forwarded to our private issue tracker on GitHub. MailerLite sends our product emails and receives only your email address, and the time you said yes if you did so in Shoshin. MailerLite, Inc. is a United States company and stores this data in the European Union. Some of these providers process data outside Canada. We never sell your personal information.
13. 13 When you use Fill in the form on a personal health record entry, what you typed is sent to the same AI service that reads your uploaded documents, which fills in the entry's fields. What you typed is not stored; only the entry you save is kept.
14. 14 When you start a symptom assessment, a physiotherapy plan, a nutrition plan or a report insight for an account, the medications, lab results, imaging reports and eye prescriptions you have confirmed for that account are included as context for that run: the names, the prescriber or clinic named on them, the month of care, whether a medication entry was a prescription, a pharmacy dispensing or a medication list, the result or findings text as printed on your document, and for an eye prescription the lens type and each eye's values as printed. Doses, directions and reference ranges are never included. You can leave your personal health record out of any run with the checkbox on that form. The text read from a report you analyse is also kept, encrypted, as an unconfirmed personal health record entry that you confirm or delete.
15. 15 On a Family plan, the person who pays forms a caregiver group of up to seven people and pays for its shared allowance. People join only through an invite link an admin of the group makes, which works once, for one hour. A person who signs up or signs in through it is shown the invitation in their own account and joins only if they accept it there. Everyone in the group sees each person's nickname, account email and role, and the group's shared allowance as a whole. Every account in the group is managed by the group's admins, except a second group admin, whom the payer invites with a link of its own and whose assessments, plans, report insights and personal health record stay in their own account and are never visible to the others. A No Sign-In account has no sign-in and is kept in the paying account, for a child or for an adult who does not use a computer. Before one is made for anyone 12 or older, or before documents are read into one whose person has turned 12, an admin confirms that they look after this person and have their permission, or are their legal representative. We keep that declaration with the account, with the version and language of its words, who confirmed it and when. A No Sign-In account and everything recorded on it can be moved, at any age, into an account the person signs in to themselves, through a link they sign up or sign in with and accept. The move waits until an admin of the group sees the new account's nickname and email and confirms it; the paying account then keeps none of it, the new account stays in the group as a managed account, and a record of the move is kept for ninety days. A person with an account of their own who joins the group, other than a second group admin, authorizes the group's admins, now or later, to act for them by accepting: to see, add to, change and delete their assessments, plans, report insights and personal health record, to run Shoshin's AI features for them, and to change their health details, but never their name, birth date or gender, their Settings, billing or export, or the authorization itself. They can leave the group at any time, which ends the admins' access at once. We keep the authorization, with the version and language of the words they agreed to and when, the time an admin last opened their account and which admin it was, and, for each day an admin acts, counts of how many items that admin added, changed and deleted and how many runs they made, with no health content, for as long as that person's account exists. If an admin's account is deleted, these stay with the person and no longer name the admin. We keep the group for as long as the paying account exists. If the Family plan or its trial ends, the group stays: its admins can still open every managed account but cannot change anything on one until the plan is renewed, nothing on a No Sign-In account is deleted because the plan ended, and a person with a sign-in of their own keeps using their account on the free tier. For each invite link we keep who made it, for which group, when, and who used it, with only a fingerprint of the link and never the link itself, for fourteen days.