Privacy statement

Who we are

MDPay is operated by 17999771 Canada Inc., of Milton, Ontario. MDPay provides billing software and services to physicians and physician groups in Ontario.

Patient information

Physicians and groups use MDPay to bill the Ontario Ministry of Health and other payers. The physician or group remains the custodian of their patients' health information. MDPay handles it only as their agent under Ontario's Personal Health Information Protection Act (PHIPA), on their behalf and under a written agreement.

MDPay uses patient information only to provide the billing services, never sells it, and never uses identifiable patient information to train AI models.

Patients who want to see or correct their information, or who have a privacy question about it, should contact their physician's office first. MDPay refers any such request it receives to the physician or group. Unresolved concerns can go to the Information and Privacy Commissioner of Ontario.

Information about our users

For physicians, group staff and other account holders, MDPay collects the details needed to run the account: name, email address, Ministry of Health billing and group numbers, the agreement version accepted, and sign-in and security records.

MDPay uses these details to provide and secure the account, to communicate about the service, to bill for it, and to meet legal and Ministry obligations. MDPay does not sell them.

Account holders can ask to see or correct their details at any time using the contact below. Concerns about how MDPay handles them can also go to the Office of the Privacy Commissioner of Canada.

Where information is kept

Patient information is stored in Canada. The service providers that handle customer data on MDPay's behalf, and where each operates, are listed on the Security Center.

How long it is kept

Patient information is kept for the term of the physician's or group's agreement and deleted afterwards on the timeline that agreement sets, except records the law or the Ministry requires MDPay to keep. Account details are kept while the account is open and afterwards only as long as needed for legal, contractual and record-keeping purposes.