This policy applies to meringuehealth.com, the app.meringuehealth.com web application and related Meringue services. Meringue is operated in Quebec, Canada.
We recognize that health information is particularly sensitive. Meringue is designed to help you bring your own health information together while limiting its collection, use and access.
Meringue is responsible for personal information under its control.
For questions, privacy requests or complaints, you may contact Meringue’s Privacy Officer:
If you previously submitted a earlier access request, we collected the information you provided through that form, including your first name, email address, country of residence, preferred language, main device, intended use and confirmation that you accepted the applicable Terms. We may retain limited records from that earlier program where needed for support, security, privacy, legal or audit purposes.
If you create a Meringue account, we collect information necessary to create and secure that account, together with information you choose to add to Meringue. This may include your email address, display name or other profile information you provide, as well as health information such as:
You may also choose to upload health documents, images or other files.
If you send product feedback or a support request, we collect the information you choose to submit through that form, including contact information when you provide it. We ask you not to include unnecessary health information, medical records, passwords or other secrets in feedback or support messages.
Meringue may retain application preferences and a limited amount of technical and security information needed for authentication, abuse prevention, troubleshooting and protection of the service.
You decide what health information you add to Meringue.
We use your information to:
We may use product feedback to improve Meringue. We do not sell your personal information and we do not use your health information for advertising.
Health information is sensitive personal information.
When you create a Meringue account, we ask separately for your express consent to collect, use and retain the health information you choose to add in order to provide Meringue.
You may withdraw consent, subject to applicable legal or contractual restrictions. In some circumstances, withdrawing consent may mean that we can no longer provide some or all of the service.
Meringue uses technology providers to operate the service.
Supabase provides services including authentication, database infrastructure and private file storage. Meringue’s primary project is currently configured in the Canada Central region.
Vercel hosts and deploys the public website and web application. Meringue is designed so that the contents of your health information and private files flow directly between your browser and Supabase rather than being intentionally submitted to Vercel application functions, analytics or logs.
Azure Communication Services is used to send operational Meringue email and support messages. The email provider processes the addressing and message information needed to deliver those emails. Meringue may retain a limited legacy email-delivery ledger containing lifecycle and delivery state; it does not copy health records, health-file metadata or free-text health information into that ledger.
Service providers entrusted with personal information are expected to use it only as necessary to provide their services and to apply appropriate safeguards.
Some technology providers or their subprocessors may process technical or personal information outside Quebec or Canada.
Where personal information may be communicated outside Quebec and applicable law requires it, Meringue assesses relevant privacy factors and applicable contractual and technical safeguards to determine whether the information will receive adequate protection.
Meringue uses only essential browser technologies needed to run the service. These include session storage and certain local settings used to keep you signed in and to remember your language and preferences.
These technologies are necessary for Meringue to work and are not used to advertise to you or to build a profile of your activity. Because we use only essential technologies, Meringue does not display a cookie consent banner.
Meringue does not use behavioural advertising or third-party analytics. If we later introduce non-essential cookies or tracking technologies, we will update this policy and ask for your consent before using them.
Meringue does not use artificial intelligence to process your health information without your choice.
We do not use your health information to train artificial intelligence models, and we do not send your health information to third-party AI services as part of normal use of Meringue.
We may, in the future, offer optional features that use artificial intelligence, for example to help you read a document or summarize your own information. Any such feature will be something you choose to turn on. Before introducing it, we will update this policy and obtain any consent required, and it will apply only to the information you decide to include.
We retain personal information only for as long as necessary to provide Meringue and satisfy applicable legal, security and privacy obligations. Different categories of information may have different retention periods depending on why the information is needed.
You may request deletion of your account. Meringue’s deletion process removes health data and private files associated with the account, subject to information that must temporarily be retained for legal or security reasons.
Deleted information may remain for a limited period in controlled backups until normal backup rotation. It is not used for normal service operations during that period.
When personal information is no longer required, it is appropriately destroyed or anonymized.
Meringue applies safeguards appropriate to the sensitivity of health information. These include authenticated accounts, isolation between users’ data, database-level access controls, private file storage, session protections, automated security checks, encrypted portable backups when you use that feature, and multi-factor authentication for certain administrative access to production systems.
No transmission or storage method can guarantee absolute security.
Depending on applicable law, you may request access to personal information we hold about you; correction of inaccurate or incomplete information; information regarding the use or disclosure of your information; withdrawal of consent where applicable; deletion where continued retention is no longer permitted or necessary; a portable copy of certain computerized information you provided; or review of a complaint about our privacy practices.
We may need to verify your identity before fulfilling a request. To exercise your rights or ask us a privacy-related question, contact:
Meringue maintains a privacy-incident response process. If an incident involving personal information occurs, we take reasonable steps to limit its consequences and reduce the risk of a similar incident occurring again. Where required by law, we notify the appropriate authorities and affected individuals.
We may update this policy as Meringue evolves or our obligations change. Material changes will be brought to your attention when required by law. The effective date at the top of this page identifies the current version.