This Clinic Data Agreement (the "Agreement") is between Clinic or clinician legal name, at address (the "Clinic"), and Between, operated by Jack Hazan (the "Provider"). It takes effect on effective date and covers the Clinic's use of Between for between-visit patient check-ins.
The Clinic decides why and how patient information is used and is the party responsible for it. The Provider processes that information only on the Clinic's behalf and only to run the service described below. The Provider does not use patient information for its own purposes and does not sell it.
Between lets a patient send a short voice or text check-in between visits — and, for physical disciplines, mark where it hurts on a body map and attach a photo of a sore area. Where a patient turns it on, Between produces a short summary and simple trends (mood or pain, and recurring themes) that the clinician can read before the next appointment. It is a between-visit check-in tool. It is not a medical record, not a diagnosis or assessment, and not a crisis service. The clinician's professional judgment always governs clinical decisions.
Each patient confirms at sign-up that they are 18 or older, or that a parent or guardian has agreed to their use, and the Clinic is responsible for obtaining any consent its professional order requires before inviting a patient. AI analysis is off by default and runs only after the patient gives explicit, opt-in consent, which they can withdraw at any time. Check-ins work with AI analysis off.
The Provider uses a small number of service providers to run Between, and patient information — including check-in content — may be stored and processed in the United States and other countries where these providers operate:
The current list, what each provider does, and where it processes data are kept on the Subprocessors & data location page. Because this can involve transferring personal information outside Quebec, the parties handle it with Quebec's Law 25 and the federal PIPEDA in mind. The Provider will keep the Clinic informed of the sub-processors it relies on.
The Provider protects information with, at minimum: encryption in transit (HTTPS with HSTS), hashed clinician and patient passwords, optional multi-factor authentication for clinicians, per-account access scoping, expiring signed links for voice and photo files, and rate limiting on sign-in and sign-up. These measures may improve over time but will not be materially weakened while this Agreement is in effect.
Patient data is kept only while it is needed to provide the service. A clinician can remove a patient, which cuts the patient's access and, after a short window during which the clinician can download the record, permanently deletes that patient's check-ins, summaries, voice notes, photos, and alerts. Patients can delete their own history at any time. On request from the Clinic, or when this Agreement ends, the Provider will delete or return the Clinic's patient data within a reasonable period, except where it must keep something to meet a legal obligation.
If the Provider becomes aware of a security incident affecting the Clinic's patient data, it will notify the Clinic without undue delay, share what it knows, and cooperate on the Clinic's response and on any notification the Clinic must make under applicable law.
Between is not a crisis or emergency service and does not monitor check-ins in real time. Clinicians are never on call through Between and are not expected to respond between visits; a summary waits for the next appointment. Patients are told that Between is not for urgent or emergency issues, and crisis resources are shown to them directly if risk language is detected. The Clinic and its clinicians remain responsible for their own duty of care, triage, and professional obligations.
This Agreement runs while the Clinic uses Between and can be ended by either party in writing. Material changes to this Agreement will be shared with the Clinic in advance. This Agreement is governed by the laws of the Province of Quebec and the federal laws of Canada that apply there.
Questions about this Agreement or about patient data can be sent to jojo11haz@gmail.com.