Scope & North American Operations
Pfend Inc. ("Pfend", "we", "our", or "us") operates a specialized health tech Software-as-a-Service (SaaS) platform offering patient engagement workflows, clinical telemetry integration, RPM (Remote Patient Monitoring), and care team coordination software.
Geographic Jurisdiction Notice: Pfend operates exclusively within the United States and Canada. Our platform, cloud infrastructure, and administrative tools are engineered specifically to comply with US federal and state health regulations as well as Canadian federal and provincial privacy mandates.
Target Audience & User Roles:
- US Covered Entities & Healthcare Providers: Hospitals, ACOs, health systems, clinics, and physicians operating in the US.
- Canadian Health Information Custodians (HICs) & Trustees: Provincial health authorities, hospitals, clinics, and allied health professionals across Canadian provinces.
- Patients & Program Participants: Individuals residing in the US or Canada receiving care via Pfend-powered clinician portals or apps.
US & Canada Applicable Legal Frameworks
Our data protection and security policies are designed around statutory mandates in the US and Canada:
🇺🇸 United States Statutes
- HIPAA: Health Insurance Portability & Accountability Act (Privacy, Security, Enforcement, & Breach Rules).
- HITECH Act: Health Information Technology for Economic and Clinical Health Act.
- CCPA / CPRA: California Consumer Privacy Act as amended by California Privacy Rights Act.
- State Health Laws: Washington My Health My Data Act, Nevada SB 370, and related state privacy acts.
- Federal Protections: Children's Online Privacy Protection Act (COPPA) & FTC Act Section 5.
🇨🇦 Canadian Federal & Provincial Statutes
- PIPEDA: Personal Information Protection and Electronic Documents Act (Federal).
- Ontario PHIPA: Personal Health Information Protection Act.
- Alberta HIA & PIPA: Health Information Act & Personal Information Protection Act.
- BC HIA & eHealth Act: Health Information Act (British Columbia).
- Quebec Law 25: Act Respecting the Protection of Personal Information in the Private Sector.
Information We Collect
We categorize collected data based on operational usage and statutory sensitivity:
A. Protected Health Information (PHI / ePHI) & Personal Health Information
Processed on behalf of US Covered Entities or Canadian Health Information Custodians:
- Patient demographics (Medical Record Numbers, name, DOB, state/province of residence)
- Remote physiological monitoring metrics (ECG telemetry, glucose levels, pulse oximetry, blood pressure)
- EHR clinical records synced via HL7 FHIR APIs (encounter history, diagnoses, medications)
- Patient-reported outcomes and care team chat messages
B. Provider & Customer Personal Information
- Clinician & Administrative staff credentials (Name, NPI number, licensing body, work email)
- Institutional billing contact information
- Support tickets and training interaction records
C. Technical Telemetry & Audit Logs
- IP addresses, device identifiers, browser types, and system event logs required for HIPAA security auditing.
How We Use Information
Data utilization is strictly bounded by contract, regulatory consent, and legal authority:
-
Delivering Health SaaS Services: Rendering real-time clinical dashboards, processing vitals alerts, supporting telehealth consultations, and managing clinical integrations.
-
System Operations & Security Safeguards: Enforcing multi-factor authentication, verifying access authorization, maintaining audit logs, and detecting cybersecurity anomalies.
-
De-Identification & Anonymization: Preparing anonymized datasets in strict compliance with the HIPAA Safe Harbor Method (45 CFR § 164.514(b)) or Canadian PIPEDA anonymization standards for health research or system benchmarking.
HIPAA BAA & Canadian Enterprise Agreements
Business Associate & Agent Status
In the US, Pfend acts as a Business Associate under HIPAA. In Canada, Pfend acts as an Information Network Provision Provider, Agent, or Service Provider under provincial health privacy laws (such as Ontario PHIPA or Alberta HIA).
US Business Associate Agreements (BAA)
We execute standardized or custom BAAs with Covered Entities prior to receiving ePHI, outlining permitted uses, breach notification protocols, and subcontractor obligations.
Canadian Service Provider Agreements
We sign Information Manager Agreements (IMAs) or Information Network Provision Agreements compliant with provincial health custodian guidelines (e.g., PHIPA Section 10(4)).
Technical & Physical Safeguards
Pfend maintains a defense-in-depth security architecture mapped to NIST SP 800-53 standards:
AES-256 / TLS 1.3
MFA & SSO (RBAC)
Continuous SOC 2
Canadian Data Boundary Addendum
Strict Canadian Data Residency Guarantee
All Canadian customer records, Personal Health Information (PHI), and Personal Information (PI) ingested, generated, or stored by Pfend are maintained strictly within sovereign Canadian data centers.
A. Sovereign Canadian Infrastructure & Hosting
Primary and backup database clusters, application servers, backup snapshots, and disaster recovery environments provisioned for Canadian healthcare clients reside exclusively within tier-3+ physical infrastructure physically situated in Canada.
Canadian health data never egresses Canadian territory during standard SaaS operations, automated backups, or routine maintenance cycles.
B. Express Prohibition of Foreign Data Transfers & Consent Clause
Pfend explicitly agrees and covenants that no Canadian PHI or PI shall be transferred, routed, stored, or made accessible outside the borders of Canada—including into the United States—without the express prior written authorization and explicit opt-in consent of the subscribing Canadian Health Information Custodian (HIC), health authority, or patient.
This strict prohibition applies across all sub-processors, administrative maintenance channels, and remote diagnostic tools.
C. Provincial Health Legislative Alignment
This Canadian Data Boundary Addendum enforces operational compliance with federal and provincial statutes mandating or prioritizing in-country data sovereignty:
- PIPEDA: Federal Accountability & Cross-Border Guardrails
- Ontario PHIPA: Health Information Network Provider Standards
- Alberta HIA: Information Manager Agreement Mandates
- BC FIPPA & e-Health Act: Public Sector Data Residency Requirements
- Nova Scotia PHIA: Custodial Off-Premises Health Data Rules
- Quebec Law 25: Cross-Border Privacy Impact Assessments
Individual & Patient Rights (US States & Canada)
Depending on your location, you have statutory rights concerning your personal and health information:
*Note: When Pfend operates as a Business Associate or Agent for a healthcare provider, patients should submit access or correction requests directly to their treating healthcare institution.
Contact Privacy Office
For privacy inquiries, BAA requests, or regulatory communications:
Pfend Corp.
1032 E Brandon Blvd #6469
Brandon,
FL 33511
privacy@pfend.com