Privacy Statement
Advanced Medical
Effective date: July 9, 2026 · Last reviewed: July 9, 20261. Who We Are
Advanced Medical ("we", "us", "our") provides attendant care coordination services for individuals receiving workers' compensation benefits under the Workplace Safety and Insurance Act (Ontario). We operate the FormOne platform, which includes a web application used by agency administrators and a mobile application used by Personal Support Workers (PSWs/attendants).
Privacy Officer
Advanced Medical
Email: privacy@form1solutions.ca
2. Scope
This privacy statement applies to personal information and personal health information collected through the FormOne Web Application (agency administrators and supervisors), the FormOne Mobile Application (attendants/PSWs), the FormOne Timesheet Signing Page (clients), and our API and back-end services. It covers both Personal Information under PIPEDA and Personal Health Information under PHIPA, 2004.
3. What Information We Collect
3.1 Client / Claimant Information (Personal Health Information)
Identity (name, date of birth, gender); contact details; insurance (claim/policy number, insurer); date of accident; health assessment details (assessment dates, assessing professional's name, profession and college registration number); care plan (approved activities, duration, frequency, notes); authorized monthly allowance; and timesheet approval records. This is classified as personal health information under PHIPA.
3.2 Attendant / PSW Information (Personal Information)
Identity and contact details; account credentials (email, hashed password, MFA settings); work records (timesheet submissions, clock-in/out times, dates of service); location data (see 3.4); uploaded documents (ID, certifications, background checks, direct deposit forms); and device information (device name and a one-way cryptographic trusted-device token).
3.3 Agency / Administrator Information
Name, email address, phone number, and role within the agency.
3.4 Location and Photo Data
When an attendant submits a timesheet, the app may capture device GPS coordinates at submission and, if a photo is submitted, the GPS coordinates and timestamp embedded in the image's EXIF metadata. Location data supports verification of attendant presence and is stored with the timesheet record, accessible to agency administrators. To prevent this, disable location permissions for the FormOne app and GPS tagging in your camera settings; some features may require location to function.
3.5 Automatically Collected Information
We log the date, time and nature of each action (audit log); authentication events (login attempts, MFA outcomes, device-trust registrations); and the user account associated with each action. We do not use advertising identifiers or third-party analytics tracking, and we do not use cookies or browser storage to track you across other websites. For the strictly necessary cookies and browser storage the app does use, see 3.6.
3.6 Cookies and Local Storage
We use only strictly necessary cookies and browser storage — the items below are required for the app to function securely. We do not use advertising or third-party analytics cookies, so no consent banner is required. Specifically:
Authentication cookie (
FormOne.Admin.Auth) — a secure, HttpOnly session cookie that keeps you signed in. Cleared when you sign out.Trusted-device token (browser local storage) — an optional, one-way token stored only if you choose "Remember this device," so you can skip MFA on that device for the period shown at login.
Interface preferences and page state (browser local/session storage) — remembers display settings (such as theme colour) and restores your place in a list after editing. Not used for tracking.
We use Microsoft Application Insights for server-side operational and error telemetry; it does not place tracking cookies in your browser. You can clear these cookies and storage items at any time through your browser settings, though doing so will sign you out and require MFA on your next login.
4. Why We Collect This Information
To coordinate and document attendant care; process and submit WSIB attendant care timesheets; verify attendant presence and hours; send signature requests to clients; register and authenticate accounts (including MFA); send account, password-reset and MFA messages; import Form 1 assessment data from PDFs; maintain a PHIPA audit trail; and communicate service and operational notices. We do not use this information for marketing.
5. How We Share Information
We do not sell personal information. Client information is accessible to agency administrators and supervisors; attendants see only their assigned clients. Clients receive timesheet records via a secure signing link by email.
5.3 Technology Service Providers (Subprocessors)
Each provider is bound by a data processing agreement and may not use your information for any other purpose: Microsoft Azure (cloud hosting, file storage, database — Canada Central / Canada East); Postmark (email delivery; United States); Twilio (optional — SMS delivery of MFA codes; United States); Anthropic (optional — AI-assisted Form 1 PDF data extraction; United States — see 5.4).
5.4 Anthropic and the PDF Import Feature
The optional PDF import feature sends uploaded Form 1 documents to Anthropic's API (servers in the United States) for automated data extraction; data may be processed outside Canada. Anthropic's consumer privacy policy does not apply to API customers — our use is governed by a separate agreement, and we have opted out of Anthropic's model-training programme, so your data will not be used to train its models. To avoid this, do not use PDF import; all data can be entered manually.
5.5 Legal Disclosures
We may disclose personal information without consent if required by law, court order, or to comply with WSIB legislation, notifying the individual where permitted.
6. How Long We Keep Your Information
Client health records and care plans: 10 years from last entry, or until the individual turns 18, whichever is later (PHIPA s.13). Timesheet records: 10 years. Attendant employment records: 7 years after employment ends (ESA). Audit logs: 10 years. Account credentials: duration of account, then deleted on verified written request. Location/GPS data: retained as part of the associated timesheet record (10 years). After the retention period, information is securely deleted or anonymized.
7. How We Protect Your Information
Encryption in transit (HTTPS/TLS); encryption at rest (database TDE; Azure-encrypted file storage); role-based access controls; multi-factor authentication (mandatory for agency administrators per agency policy); audit logging of all access to and changes of personal health information; and data residency in Microsoft Azure data centres in Canada.
8. Your Rights
You have the right to access the information we hold about you (we respond within 30 days; a reasonable fee may apply for large requests), to request correction of inaccurate or incomplete information, to withdraw consent where we rely on it (which may limit our ability to provide services), and to make a complaint. Complaints may be directed to our Privacy Officer, the Information and Privacy Commissioner of Ontario (ipc.on.ca), or the Office of the Privacy Commissioner of Canada (priv.gc.ca). Submit a written request to the Privacy Officer including your name, contact information and a description of your request; we may verify your identity first.
9. Breach Notification
In the event of a privacy breach creating a real risk of significant harm, we will notify the Information and Privacy Commissioner of Ontario and/or the Office of the Privacy Commissioner of Canada as required, notify affected individuals as soon as reasonably possible, and take steps to contain and remediate. All breaches are recorded in our internal breach register.
10. Changes to This Statement
We may update this statement from time to time. Material changes will be communicated by posting a notice in the application and updating the effective date above. Continued use of the platform after the effective date constitutes acceptance of the updated statement.
11. Contact Us
Privacy Officer — Advanced Medical. Email: privacy@form1solutions.ca.