Privacy Policy

Version 2.0 · Effective September 24, 2026

1. Who we are and our commitment

CUB Suite ("CUB", "we") builds tools for regulated health practitioners in British Columbia. We collect only what we need to run our services, and we aim to meet the BC Personal Information Protection Act (PIPA) and, where it applies, the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our privacy contact is Jamie, reachable at privacy@getcubsuite.com.

2. Our role: practitioners are responsible for patient information

When a practitioner uses CUB Line to communicate with patients, the practitioner is the organization responsible for that patient information. CUB acts as their service provider. We handle patient information only to provide the service, on the practitioner's behalf and under our Terms of Service. Patients who want to access, correct or delete their information should contact their practitioner, and we will help the practitioner respond.

3. Information about patients (CUB Line)

  • Phone number, to send and receive texts and calls.

  • Name, if the practitioner adds one to the contact.

  • Message content, stored so the practitioner can see the conversation history.

  • Call details, such as time and length. Calls are not recorded.

We do not build patient profiles, use patient information for marketing, or share it between practitioners.

4. Information about practitioners

  • Account details: name, email, clinic name, phone number, profession, regulatory college and registration number.

  • Sign-in: through Google. We receive your name and email from Google, never your password.

  • Settings: status, auto-reply messages, days off and notification preferences.

  • Device notification details: a technical address that lets us send notifications to your device. Notifications never contain patient names or message content.

  • Support and feedback: bug reports, screenshots you attach, survey answers and feedback. Screenshots may show patient information, so please avoid including it.

5. Payment information

Billing is handled by Stripe. CUB never sees or stores your card details. We keep only your subscription or purchase status.

6. Where your information goes

Your messages, contacts and account data are stored in Canada. To run the service, we use the providers below. Some are based in the United States, so information may be processed or stored there and may be subject to US law.

Supabase (Canada): database, sign-in and file storage. Holds messages, contacts, account data and screenshots.

Twilio (United States): sends and receives texts and calls. Handles phone numbers, message content and call details.

Vercel (United States): hosts the CUB app and its servers. Handles phone numbers and messages while they're being sent.

Apple and browser push services (United States): deliver notifications. Receive a notification address only, never patient information.

Sentry (United States): error monitoring. Receives technical error details; phone numbers are removed automatically.

Google (United States): practitioner sign-in and CUB's own email. Receives practitioner name and email.

Stripe (United States and global): billing. Handles practitioner billing details.

Squarespace (United States): our website and newsletter. Handles website visits and newsletter email addresses.

7. How we protect information

  • Encryption: data is encrypted in transit (TLS) and at rest.

  • Separation between practitioners: database rules ensure each practitioner can access only their own records.

  • Access by CUB staff: CUB staff access practitioner or patient information only when needed to provide support, fix a problem, or meet a legal requirement.

  • No selling: we never sell practitioner or patient information.

  • Text messages: SMS is carried by phone networks and is not end-to-end encrypted. CUB protects messages once they reach our systems.

8. Patient consent and opting out

Practitioners are responsible for telling their patients that they use CUB Line and for obtaining consent. Patients can reply STOP at any time to stop receiving texts from a CUB clinic number.

9. Keeping and deleting information

  • Practitioners can export their message history at any time, and permanently delete any conversation from within the app.

  • After cancellation, we keep account and message data for a reasonable period so you can export it, then delete it, except where we must keep it by law.

  • Twilio keeps its own delivery records according to its retention practices.

  • To request full account deletion, email privacy@getcubsuite.com. We will respond within 30 days.

10. If something goes wrong

If we learn of a privacy breach affecting your information, we will notify affected practitioners without unreasonable delay, help them notify patients where needed, and report to regulators as the law requires.

11. Our website

Our website uses Squarespace, which collects basic visit information, such as pages viewed and how you arrived, using cookies. If you join our newsletter, we keep your email address until you unsubscribe.

12. Changes to this policy

We will post updates here with a new version number and date, and notify active practitioners of material changes by email.

13. Contact

privacy@getcubsuite.com