Privacy policy

Last updated November 7, 2026

Chiro is run by Rec-Safe (RECSAFE), a Washington corporation ("we" and "us"). This policy says what Chiro keeps about you, why, who else sees it, and what you can do about it. It covers Chiro only; our other sites and apps have their own.

What we keep

When you use Chiro, we keep:

• for each person who signs in: your email address, name and time zone, the practices you work in and your role in each, how you're named on records (credentials, registration and provider numbers), and your passkeys
• each practice's details: its name, address and contact details, business number, fee schedule and diagnosis codes, appointment types, hours, and settings
• the patient records the practice enters: patients' names, birth dates, contact details, addresses, emergency contacts, health card numbers, insurance and claim details, intake and health history, alerts, cases and diagnoses, treatment plans, visit notes and addenda, outcome measures, appointments, charges and payments, and the documents, x-rays and photos uploaded to their charts
• an audit log of who opened, changed, printed, downloaded or exported each record, when, and from which IP address
• a sign-in log (the time, IP address, and browser), to keep accounts safe

You sign in with a one-time link emailed to you, or a passkey; for patients' privacy, a session ends after the practice's chosen time without activity, and after 12 hours.

Documents, x-rays and photos are encrypted when they arrive and are only ever decrypted for the practice's own staff. Photos other than x-rays and imaging are re-saved, which removes the location and other camera details saved in them; x-rays and imaging are kept exactly as uploaded.

Like any website, our servers also keep a short log of the pages asked for (with the IP address, the browser, and the time), to keep the site running and safe. We don't use analytics, advertising, or tracking services.

Why we keep it

Only to run Chiro for you: to keep the practice's patient records and show them to its staff, according to each person's role; to work out plans, scores, balances and reports; to send sign-in links and the staff invitations the practice asks for; and to keep it working and secure. Chiro never emails a patient or sends their records anywhere. We don't sell or rent your information, we don't show ads, and we don't use it for anything else.

Who else sees it

A practice's records are open only to the people it has invited, and front desk staff don't see clinical notes, health histories, outcome measures or clinical documents. Nothing is ever shown publicly. The people who run Chiro don't look at a practice's patient records; the most sensitive fields (health card and insurance numbers, health histories, visit notes, alerts, plan goals and notes) and every uploaded file are encrypted where they're stored, and only the server decrypts them, for the practice's own staff. Patients' records are stored on servers in the United States.

We use these services to run Chiro, and each sees only what it needs:

• Amazon Web Services, which hosts our servers in the United States, where everything the app keeps is stored
• Postmark, which sends our emails, so it handles your email address and the message

We'd share information if the law makes us (a court order, for example), or to protect someone's safety. If Rec-Safe ever handed Chiro to someone else, this policy would go with it.

Cookies

Chiro uses one cookie, to keep you signed in until you close your browser, are idle for the practice's chosen time, or 12 hours pass. It isn't used for advertising or tracking.

How long we keep it, and deleting it

We keep your information while you use Chiro. A practice can correct its records, and its administrators can export a patient's record or everything the practice keeps and delete a chart made by mistake; its owner can delete the practice and every record in it. You can delete your own account under "You" (the notes you wrote stay in the practice's records) and we'll do it, apart from anything the law makes us keep (such as payment records). Server logs are kept only as long as they're needed to run and protect the site, and backups are overwritten in time.

Keeping it safe

Every page uses an encrypted connection (HTTPS). Sign-in links work once and expire, passkeys can't be guessed or phished, sessions end when idle, every look at a record is logged, and the most sensitive records and every file are encrypted at rest with a key for each practice. No website is perfectly secure, but if something ever goes wrong in a way that puts your information at real risk, we'll tell you, and the authorities when the law requires it.

Children

Chiro is for practices and their staff, not for patients to use. A practice may keep records of patients who are children, with a parent's or guardian's consent as the law requires; we keep them only for that practice.

Your choices and rights

You can ask us what we keep about you, ask us to correct it, or ask us to delete it, by emailing info@rec-safe.com. We'll answer within 30 days. Depending on where you live (for example in Canada, a US state such as Washington or California, the UK, or the EU), the law may give you more rights, and we honour them for everyone.

Our servers are in the United States, so if you're elsewhere, your information is stored and handled there, under US law. In Canada, if you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

The practice is responsible for its patients' records. When a practice uses Chiro, the practice decides what goes in its patients' records and who sees them, and it answers to its patients and its regulators for them. Patients who want to see, correct or get a copy of their record should ask their practice. We keep the records only to run Chiro for the practice, and we would only ever hand them to anyone else if the law forced us to, and then we'd tell the practice unless we were legally barred from doing so.

No certification is claimed. Chiro hasn't been certified, audited or approved under any health privacy law or standard (such as Ontario's PHIPA or the United States' HIPAA), and we don't sign agents' agreements or business associate agreements. A practice must decide for itself whether Chiro meets the rules that apply to it.

Changes and questions

If we change this policy, we'll change the date at the top, and if a change is big, we'll say so on Chiro first. Questions? Email info@rec-safe.com.