NeFora Privacy Notice and Additional Disclosures

Depending on how NeFora is offered, CKCC may provide NeFora directly or together with a participating healthcare organization. Boreal Health may provide technical, operational, implementation, hosting, support, security, analytics, or related services in connection with NeFora.

In many deployments, the participating healthcare organization remains responsible for the patient’s clinical record and for certain decisions about the collection, use, disclosure, retention, and correction of personal health information. CKCC and Boreal Health may act as service providers, agents, contractors, or similar roles supporting the authorized operation of NeFora, depending on the deployment.

If you have questions about your medical record, access rights, correction requests, or a care-team workflow, your participating healthcare organization may be the appropriate first point of contact.

Questions about privacy may be directed to:

Depending on the workflow enabled by the participating healthcare organization, NeFora may collect or receive:

• your name or other basic identity information;
• a patient or record identifier needed to securely launch the app or link you to the correct workflow;
• limited information from Epic, MyChart, or another approved system needed to authenticate you and support the workflow;
• questionnaire responses;
• symptoms, concerns, priorities, goals, and visit-preparation information;
• vitals and biometric measurements such as blood pressure, weight, body-composition values, blood sugar, and related timestamps, whether entered manually or received from a supported device connection;
• educational progress and completion information;
• information entered by a caregiver or authorized representative on your behalf; and
• technical and audit information needed to secure, operate, and improve the service.

NeFora collects only the information reasonably needed for the purposes described in this Privacy Notice.

NeFora may use information to:

• support kidney education;
• support intake and care-navigation workflows;
• store, display, and summarize manually entered or authorized synced readings;
• help patients prepare for appointments;
• generate summaries or structured outputs for review by the patient’s care team when enabled;
• authenticate users and maintain secure operation of the service;
• support implementation, troubleshooting, quality assurance, and legal compliance; and
• improve the safety, usability, and effectiveness of NeFora.

Information entered into or received by NeFora may be shared:

• with authorized members of the patient’s care team;
• with the participating healthcare organization;
• with Boreal Health and other contracted service providers that support hosting, maintenance, security, and authorized operations; and
• with supported third-party connection providers when you choose to authorize or maintain a device-sync relationship; and
• through approved workflows such as summary generation, document transfer, or other configured integrations.

Information will not be sold.

Where permitted by applicable law, CKCC, Boreal Health, and their collaborators may use de-identified or aggregated information for quality improvement, service evaluation, analytics, and research intended to improve kidney care, digital workflows, and patient education.

If NeFora is used for research involving identifiable personal information, that use will be governed by applicable law, institutional approvals, and any additional consent requirements.

NeFora is not intended to:

• provide emergency support;
• continuously monitor patient status;
• guarantee that a care team member is watching device readings in real time;
• provide autonomous treatment decisions;
• replace clinical judgment; or
• provide individualized diagnosis.

Before authorizing NeFora through Epic, MyChart, or another approved workflow, users should review this Privacy Notice and the NeFora Terms of Use.

NeFora is designed to support meaningful, informed authorization by explaining in plain language what information may be collected, how it may be used, who it may be shared with, and what choices may be available.

If NeFora offers a supported device or third-party sync feature, you should be told what types of readings may be imported, whether recent or historical readings may be received, and that sync does not mean continuous provider monitoring.

Depending on the deployment, you may be able to revoke an app connection, disconnect a synced device, or withdraw a future authorization through NeFora settings, your healthcare organization, a patient portal, or another available process. Revocation may stop future sharing, but may not remove information already incorporated into the healthcare organization’s records.

Subject to applicable law, you may have the right to request access to, correction of, or, where required by law, transfer of personal information or personal health information associated with your use of NeFora.

Requests relating to information that has become part of the healthcare organization’s records should generally be directed to that organization. Where applicable, NeFora will support export or transfer requests in a structured, commonly used format.

Personal information is retained only as long as reasonably necessary for the purposes described in this Privacy Notice, to support authorized clinical workflows, to meet legal or contractual requirements, to maintain required records, and to protect the security and integrity of the service.

Retention periods may vary depending on the deployment, the participating healthcare organization, and applicable law. Information that has been transferred into a healthcare organization’s records may be retained according to that organization’s record-retention rules.

CKCC, Boreal Health, and their technical partners maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information involved. These safeguards are intended to protect against unauthorized access, use, disclosure, loss, and misuse.

No method of electronic transmission or storage is completely secure, and no security measure can guarantee absolute security.

Personal information collected by or through NeFora is stored and hosted in Canada.

CKCC and participating healthcare organizations may use Boreal Health and other contracted service providers for hosting, support, maintenance, security, analytics, and related authorized operations. These providers are required to protect information and use it only for authorized purposes.

If a breach of security safeguards, confidentiality incident, or similar privacy incident involving your information occurs, CKCC and/or the participating healthcare organization will respond in accordance with applicable law, including notification to affected individuals and regulators where required.

For Ontario deployments, NeFora may be implemented within clinical and contractual frameworks required by the participating healthcare organization, including privacy, audit, security, and assessment requirements applicable to digital health integrations under applicable law and related arrangements.

NeFora is not currently offered to Québec residents during the English-only launch phase. If and when NeFora is launched in Québec, user-facing terms, privacy materials, and core app interfaces will be made available in French, and Québec-specific privacy compliance steps will be completed.

Questions about privacy, disclosures, or authorized use of NeFora may be directed to:

You may also have the right to contact the privacy office of your participating healthcare organization or the applicable privacy regulator in your jurisdiction.