Last updated 3 Aug 2026
What Ailio collects, who can see it, how it is protected, and how to have it deleted.
Ailio is operated by Ailio Health Inc., based in Victoria, British Columbia. We publish an index of clinics and practitioners across Canada — their services, prices and openings — and let you request an appointment. We are not a clinic and we do not provide care.
This notice covers personal information you give us as a patient with an Ailio account. It is written to Canada’s federal privacy law (PIPEDA) and British Columbia’s PIPA.
An email address and a password. If you set up a passkey, the public part of it. We also record when you signed up, and each session records the IP address and browser it was created from.
The medical profile at /profile/medical is optional and can be left blank or filled in a field at a time. When you do fill it in, it can hold: your legal and preferred name, date of birth, phone number, address and pronouns; the reasons you are booking, along with conditions, medications and allergies; whether you are pregnant, have had recent surgery, or want an area avoided, with any note you add; an emergency contact; your provincial health number and family physician; insurer, policy, member and group numbers for up to two plans; a claim number and accident date for an ICBC, WorkSafeBC or Veterans Affairs claim; and your typed consent signature.
A percentage covered, a per-visit maximum, an annual maximum and how much of it you have used, per discipline. You type these in from your own benefits booklet. They are never confirmed with anyone.
The answers you give the setup flow: a city and region, how far you will travel, which disciplines, how much notice you need, practitioner preferences, accessibility needs, and how you expect to pay.
Appointment requests, including the clinic, practitioner, service, time and price, and any note you write for the practitioner. Availability alerts you create, including the coordinates of the area you asked us to watch. Practitioners you save. Your notification settings.
Ailio runs no analytics and no tracking. There is no Google Analytics, no advertising pixel, no session recorder and no third-party script of any kind on these pages. We do not build a profile of what you browse, and we do not sell or rent personal information to anybody, for any purpose.
Your account exists so your profile, bookings and alerts are yours and nobody else’s. Your health profile exists so that a clinic’s intake paperwork can be filled from it rather than typed again in a waiting room, and so a practitioner knows what matters before you arrive. Your insurance terms exist so we can estimate what a visit will actually cost you. Your search preferences exist so results are about the care you are looking for.
We do not use any of it for advertising, and we do not use your health information to decide what to show you beyond the discipline you asked for.
Your health profile and the note you write for a practitioner are encrypted before they reach our database, with a key that belongs to your account alone. The key itself is wrapped by a key we hold in Cloudflare’s secrets service, so the database never holds anything that can open your record on its own. Each encrypted field is bound to your account and to the exact column it belongs in, so ciphertext copied anywhere else simply fails to open rather than quietly decrypting as something it is not.
Every table holding patient data also enforces row-level security in the database itself, and the account our servers connect as cannot bypass it. A query that forgot its filter returns nothing rather than returning somebody else’s row.
Your insurance percentages and maximums are stored unencrypted, because a percentage and an annual maximum identify nobody on their own and we read them on every price estimate. They are protected by the same row-level security as everything else.
No security is absolute, and we would rather say so than imply otherwise. If we ever believe your information has been exposed, we will tell you and the relevant privacy commissioner.
When you request an appointment, the clinic sees your name, the practitioner, service, time and price. If they accept or decline, we email you their answer, and they see the email address on your account for that message only. Clinics never see your health profile, your insurance details or your note to the practitioner — those are encrypted under your key, and the clinic side of Ailio holds no key for them.
Google Places, OpenStreetMap’s Overpass and the language models we use to read clinics’ published prose all receive clinic information only. No patient information of any kind is sent to a language model.
Our database and servers are operated on infrastructure that may store or process data outside Canada, which means it can be subject to the laws of the country it sits in. We may also disclose information where a Canadian law requires it.
We never contact your insurer, and no insurer tells us anything about you. There is no service in Canada that lets a company like ours look up what a person’s plan covers, and we are not building toward one.
Every coverage figure on Ailio is arithmetic over the terms you typed in yourself. It is an estimate you made with our help, not a number anybody confirmed. Whether a clinic bills a payer directly is that clinic’s decision, read from what they publish, and it can be out of date or wrong.
When you tap “use my location” on the search page, your browser gives the coordinate to the page and it stays there. It is not sent to us, not stored and not logged — distances are calculated in your browser against clinic coordinates the page already has. Reloading the page throws it away.
There are two deliberate exceptions. On the setup flow, “use my location” turns a coordinate into a city name, which needs a lookup: the coordinate is rounded to roughly a kilometre first, and it is sent without your account attached. And when you arrive at the search page with no city chosen, we use the rough city Cloudflare derives from your IP address as a starting point. That guess appears in the address bar where you can change it, and it is never printed as a distance — it is often the wrong town.
Ailio sets four cookies and none of them is for advertising or analytics, which is why there is no cookie banner to click through.
We email you to verify your address when you sign up, to reset your password when you ask, to confirm an appointment request you made, and to pass on a clinic’s answer to it. The address always comes from your account — never from anything typed into a form.
Ailio sends no text messages and no push notifications. If a screen offered them as a choice when you made an alert, we have recorded your answer and nothing more: no availability alert has ever been sent, by any channel. We will not start without telling you.
A booking email names the clinic, practitioner, service and time. It deliberately leaves out the note you wrote for the practitioner, because email is not encrypted in transit end to end and that note is a health disclosure.
We keep your account and everything in it until you delete it. There is no automatic expiry today, and we would rather say that plainly than imply a schedule we do not run.
The clinic information we crawl has its own limits: published openings are dropped after 400 days, the raw pages we read are dropped after 180, and cached Google listing details expire after 30. Address lookups are cached for a day, keyed on the question rather than on who asked it. A signed-in session expires after seven days.
When rows are deleted they are gone from our live database immediately. Our database provider keeps a short recovery history so an operational mistake can be undone, and deleted data ages out of that history after it. Write to us if you need the current window in writing.
You can see everything we hold about you on your own screens: your bookings and alerts, your medical profile and your preferences. You can correct any of it in place, and delete your medical profile on its own without closing your account.
Every permission you granted can be switched back off at any time, including in the middle of a booking, on the medical profile screen. Withdrawing one does not delete the record that you had granted it, which is what lets us answer a later question about what you agreed to and when.
If you would rather have a copy in writing, or want us to do any of this for you, write to privacy@ailio.ca.
Delete your account erases it, permanently, as soon as you confirm. There is no grace period and nothing to restore afterwards, because the key your health record was encrypted with is destroyed as part of it.
Your sign-in, password, sessions and passkeys; your medical profile and everything in it; your insurance terms; your search preferences; your alerts and anything they matched; practitioners you saved; your notification settings; and your encryption key.
If you have an appointment still ahead of you, deleting your account does not cancel it. We do not hold clinics’ calendars, so the clinic is still expecting you and we will have no way to reach you afterwards. Call them first — the deletion screen lists each appointment with the clinic’s number.
When this notice changes we update the date at the top. If a change materially affects what we do with information we already hold, we will tell account holders by email rather than relying on you to re-read the page.
Write to privacy@ailio.ca with any question about this notice, to ask for a copy of what we hold, or to have something corrected or deleted. That address reaches the person responsible for privacy at Ailio Health Inc., Victoria, British Columbia.
If we do not resolve something to your satisfaction, you can complain to the Office of the Privacy Commissioner of Canada, or — in British Columbia — to the Office of the Information and Privacy Commissioner for BC. You do not need our permission to do so.
