What we collect, what we do with it, how long we keep it, and what we will not do. Written to be read — if anything here is unclear, that is a fault in the document and we would like to know.
Effective July 29, 2026
MedPathways is a licensure-pathway guidance service for internationally trained physicians considering practice in Canada. It is operated by Canada's Sunshine Inc. (Business Number 735974735), a Canadian corporation based in Richmond Hill, Ontario.
This policy covers the MedPathways website at canadamedpathways.ca and the services delivered through it: the free eligibility check, the paid pathway assessment, and consultations booked with our clinical advisor. It is governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
If you read nothing else on this page, these are the four things that matter most, and each is expanded on below.
We do not use advertising cookies, third-party tracking pixels, or analytics that build a profile of you across other websites.
We do not store the files you upload.
When you upload a degree, transcript, certificate or licence, the file is held in memory only for as long as it takes to read it. It is sent to our AI provider to extract a specific, narrow set of facts, and then it is gone. It is never written to our database or to any file storage, and no copy exists after your assessment is generated.
This means there is nothing for us to return to you and nothing to delete. It also means a breach of our systems cannot expose your credentials, because they were never there.
Uploading is optional and requires you to tick a consent box first. Until you do, the upload control does not work. You can complete an assessment using the screening questions alone, or by describing your situation in writing.
We pull only the facts that change licensure advice: your medical degree institution, country and year; your postgraduate programme, country and years completed; your specialty and subspecialty; your certifying body, certification status and year; your language test result; and your current clinical role.
We do not extract passport or identity numbers, dates of birth, home addresses, photographs, or family information, because none of those change the answer. Those details may well appear on a document you upload — they are simply not read out of it, and the document itself is not kept.
Everything extracted is treated as reported, never verified. Source verification of medical credentials runs through the Medical Council of Canada and is an entirely separate process that we play no part in.
We do not use your information to train AI models, and neither does our AI provider — that is a contractual term of our commercial agreement with them, not merely a setting.
Everything we store about you is stored in Canada.
Your answers, your assessment, your email address and your booking record all sit in Montréal, Canada, on Canadian infrastructure. That is where your file lives, and it does not live anywhere else.
Producing an assessment requires a brief AI processing step, and that computation happens outside Canada — there is currently no provider that performs it here. It is transient: the text is processed and the result comes back, and nothing is stored where it ran. Uploaded documents are not stored anywhere at all.
We would rather be precise about this than use the phrase “full Canadian data residency”, which is what a lot of services say and which would not be accurate here. While your text is being processed abroad it is subject to the law of that country, and the protections of PIPEDA do not travel with it. Our agreement with that provider prohibits using your data to train models, requires deletion of inputs and outputs within 30 days, and applies enterprise security controls throughout.
We use a small number of providers to run MedPathways. Each is bound by confidentiality and data-protection obligations and may use your information only to provide its service to us.
Database and application hostingCanada
Your answers, assessment, email address and booking record.
Website delivery and request handlingGlobal edge network
Requests in transit, plus operational logs containing IP address and browser details.
AI processing that produces your assessmentOutside Canada
Your answers, anything you write in the intake, and the contents of any document you upload — transiently, for as long as the request takes.
Payment processingCanada and the United States
Your card details, which go directly to the processor and never reach our servers. We receive only a payment identifier and whether it succeeded.
Scheduling and video for consultationsOutside Canada
Your name, email address, time zone and appointment time.
A current list of the specific providers behind each of these is available on request from privacy@canadamedpathways.ca. We keep it that way rather than naming them here so the answer you get is always the current one.
Deletion runs automatically every night. It is not a manual process that depends on someone remembering.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
Under PIPEDA you can ask us to do any of the following, and we will respond within 30 days:
Write to privacy@canadamedpathways.ca. If you are not satisfied with our answer, you can take it to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
If you are in the United Kingdom or the European Economic Area, you also have rights under the UK GDPR or GDPR, including data portability and the right to object to processing. The same address handles those requests.
MedPathways is intended for qualified physicians and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a minor has submitted information to us, write to privacy@canadamedpathways.ca and we will remove it.
We use one essential cookie: a random session token that links your browser back to your own assessment so you can see it after paying. It carries no personal information and cannot identify you to anyone else. We use no advertising cookies and no third-party tracking.
We may update this policy as the service changes. Where a change is material and we have your email address, we will tell you at least 30 days before it takes effect. The effective date at the top of this page always reflects the current version, and earlier versions are available on request.
Our Terms of Service set out the rules for using MedPathways and should be read alongside this policy.