What This Draft Covers
The planned notice covers broad fertility goals and care preferences, generated match inferences, account/contact details if supplied, consent evidence, privacy requests, and necessary security metadata. Exact medical records, lab values, medication lists, insurance identifiers, and free-text health histories are outside the current design.
The final Canadian notice must identify the exact ClaraFerti legal entity, privacy officer, postal contact, accountable organization, processors, processing countries, and province-specific rights.
Meaningful And Separate Consent
Required Clinic Match processing, optional ClaraFerti follow-up, clinic transfer, marketing, research, model training, and any monetized use must be separate choices. Sensitive-data consent must be express and understandable, and withdrawal must be as easy as consent.
Québec launch additionally requires a complete French experience, express separate sensitive-data consent, profiling disclosure, and an approved privacy impact assessment before processing information outside Québec.
Cross-Border Processing
The planned AWS product stack operates in the United States. The final notice must explain that foreign authorities may lawfully access data, identify processor locations, and describe contractual and security safeguards. ClaraFerti remains accountable for processor handling.
Canadian clinic handoff, marketing, research, AI training, and partner data monetization remain disabled. A United States governing-law clause does not remove mandatory Canadian federal or provincial rights.
Rights And Retention
The product design supports access, correction, withdrawal, deletion/disposition, complaint, and appeal paths. Final response periods, record-class retention, backup expiry, provincial health-law roles, and breach ownership require Canadian counsel approval.