Privacy Policy

Yantrax Labs (the "Studio") respects your privacy and is committed to protecting your personal information. The Studio is operated by founder Kishan Thankey. This Privacy Policy explains what the Studio collects, why, how the Studio uses and shares it, and the choices and rights you have. The Studio operates https://yantraxlabs.com (the "Site") from Toronto, Canada, and works with clients worldwide. If you have any questions, email the Studio .

This policy is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), and Canada's Anti-Spam Legislation (CASL). For the purposes of the GDPR, Yantrax Labs is the data controller for personal information collected through the Site.

Personal health information and PHIPA

No personal health information is collected through this Site. The forms on this website exist to start a conversation about a workflow, not to carry patient records. Please do not include patient names, health numbers, chart excerpts, or any other personal health information in the contact form, the newsletter form, or an email to the Studio. If you do, the Studio will delete it and ask you to resend the enquiry without it.

Personal health information reaches the Studio only inside a client engagement, and it is governed by that engagement's written agreement rather than by this policy. Ontario's Personal Health Information Protection Act, 2004 (PHIPA) applies to that work, and the roles matter:

The practice is the custodian. A clinic, hospital, or practitioner is the health information custodian under PHIPA. The Studio is not a custodian and does not become one.
The Studio acts as an agent. Every engagement that touches personal health information is covered by a written agreement naming Yantrax Labs as an agent of the custodian under section 17 of PHIPA. That agreement sets out what the Studio may do with the information, on whose authority, and for what purpose. The Studio does not use personal health information for any purpose the custodian has not authorised.
Records stay in Canada. Personal health information and the processing of it stay within Canadian infrastructure. The international transfer arrangements described below cover website and enquiry data, and they do not apply to personal health information.
Zero retention, and no model training. Personal health information is not retained by the Studio's model providers, is not used to train anyone's model, and is not disclosed to any third party except as the custodian directs or the law requires.
Every access is logged. Access to personal health information is recorded in an audit log available to the custodian, and access is limited to what the specific task requires.
A privacy impact assessment comes first. A PIA is completed before a system touches a live chart, not after deployment.
Breaches are reported to the custodian. If the Studio has reason to believe personal health information has been used, disclosed, lost, or accessed by an unauthorised person, it notifies the custodian at the first reasonable opportunity, so the custodian can meet its own obligations to the individual and to the Information and Privacy Commissioner of Ontario.

Where a practice operates outside Ontario, the equivalent provincial health privacy statute governs and the agreement is written to it.

What PHIPA reaches, and what the Studio takes on

PHIPA protects personal health information about a person. That boundary is not only a compliance detail here, it decides which practices the Studio works with at all:

Practices that are custodians: family practice, dental practices, physiotherapy clinics, mental health practices, multidisciplinary clinics, home care agencies, imaging clinics and labs, and community pharmacies. A regulated practitioner who provides health care is a health information custodian under section 3(1) of PHIPA, so the Studio signs its section 17 agent agreement with the practice itself.
Organisations that are already agents: medical billing. A billing company is not a custodian. It handles personal health information on behalf of the clinics it bills for, which means it inherits their obligations and the Studio becomes a sub-agent under those same agreements. Each client clinic's agreement is confirmed separately rather than assumed from the billing contract.
Work PHIPA does not reach is out of scope. Information about an animal is not personal health information, so a veterinary practice is governed by PIPEDA and its provincial college rather than by PHIPA. The Studio stopped taking that work in August 2026. Every safeguard on this page is a PHIPA safeguard, and offering them to a practice they do not govern would be describing a protection that does not apply.

Two limits stated plainly. A home care agency that is entirely private-pay and employs no regulated practitioner may sit outside the definition of a custodian, so the role is confirmed for each engagement rather than assumed from the segment. And this section describes how the Studio scopes its own work: it is not legal advice, and a practice should confirm its own status with its own counsel.

Information the Studio collects

Information you give the Studio

Contact form: your name, email, practice or company name, the area you want help with, your practice website, a description of the workflow you want to change, budget range, your best time to talk, your time zone (detected automatically from your browser), and anything you write in the message field.
Newsletter and guide downloads: your email address. Please note that downloading a free guide also subscribes you to the Studio's email updates. You can unsubscribe at any time.
Booking a call: if you book a meeting through the Studio's scheduling calendar (Cal.com), you provide your name, email, the meeting time, your time zone, and any answers to the booking questions.

Information the Studio collects automatically

Technical and usage data: your IP address, browser and device type, operating system, referring page, the pages you view, and the approximate location derived from your IP address.
Cookies and analytics: with your consent, the Studio uses cookies and similar technologies for analytics, including privacy-masked heatmaps and session recordings that show how visitors move through pages. Form fields, text you type, and other sensitive content are masked and are not captured. Because these recordings can still relate to an individual, the Studio treats them as personal information (they are pseudonymised, not fully anonymous).

Cookies and similar technologies

The Studio groups cookies and similar technologies into three categories:

Strictly necessary: required to run the Site securely, including hosting, content delivery, spam protection on the Studio's forms (Cloudflare Turnstile), and remembering your cookie choices. These are always on.
Functional: remember your preferences, such as sound on or off, and power the embedded booking calendar. Off until you allow them.
Analytics and session replay: help the Studio understand and improve the Site using Cloudflare Web Analytics and Microsoft Clarity (heatmaps and session recordings). Off until you allow them.

The Studio does not load analytics or other non-essential cookies until you opt in. You can accept all, reject all, or choose categories the first time you visit, and you can change your choice at any time using or the "Cookie settings" link in the footer.

How the Studio uses your information and its legal bases

The Studio uses your information to:

respond to your enquiry, prepare a quote, and discuss a possible engagement (legal basis: the Studio's legitimate interest in responding to you, and taking steps at your request before entering a contract);
schedule and hold meetings you book (legitimate interest and pre-contract steps);
send you the email updates you asked for (legal basis: your consent, which you can withdraw at any time);
measure and improve the Site through analytics and session replay (legal basis: your consent);
keep the Site secure and prevent spam and abuse (legal basis: the Studio's legitimate interest in protecting the Site).

The Studio does not make automated decisions that produce legal or similarly significant effects about you, and it does not sell your information.

How the Studio shares your information

The Studio does not sell your personal information, and it does not "share" it for cross-context behavioural advertising as those terms are defined under California law. The Studio relies on a small set of trusted service providers (its "processors"), who handle data only on its instructions and only to provide their service:

Cloudflare, Inc.: website hosting, content delivery, form spam protection (Turnstile), and privacy-friendly Web Analytics. Cloudflare necessarily processes your IP address in order to serve and secure the Site.
Microsoft Corporation (Microsoft Clarity): heatmaps and privacy-masked session recordings. Clarity sets its own cookies and may associate data with Microsoft and Bing services. Loaded only with your analytics consent.
Resend: delivery of the Studio's transactional email and management of its newsletter list.
Cal.com, Inc.: the Studio's meeting scheduling calendar. If you book a call, Cal.com processes your name, email, and scheduling details.

The Studio may also disclose information where required by law or legal process, to enforce its agreements, or to protect the rights, safety, and property of Yantrax Labs, its users, or others. If the Studio's business is ever involved in a merger or acquisition, information may be transferred as part of that transaction, subject to this policy.

International data transfers

The Studio is based in Canada, and its service providers are located primarily in the United States. When your personal information is transferred outside your country, including to the United States, the Studio relies on the safeguards those providers put in place, such as the European Commission's Standard Contractual Clauses and, where applicable, the EU-US, UK, and Swiss Data Privacy Framework. By contacting the Studio or using the Site, you understand that your information may be processed in these locations.

How long the Studio keeps it

The Studio keeps your information only as long as it needs it:

Enquiry and contact details: up to 24 months after the Studio's last contact with you, then deleted, unless the Studio needs them longer for its records or to meet a legal obligation.
Newsletter subscriptions: until you unsubscribe.
Analytics and session recordings: for the limited retention period set by each provider (Microsoft Clarity currently retains data for up to 13 months).
Booking details: for as long as needed to hold the meeting and keep a record of it.

Your rights

Depending on where you live, you have some or all of these rights over your personal information: to access it, to correct it, to delete it, to receive a portable copy, to restrict or object to certain processing, and to withdraw consent at any time. California residents also have the right to know, delete, and correct their information, and the right not to be discriminated against for exercising these rights.

To exercise any of these rights, email the Studio . The Studio will respond within the time required by law (30 days under PIPEDA, one month under the GDPR). If you are not satisfied, you may complain to a regulator: the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office, or your local supervisory authority in the EU.

Marketing email

The Studio only sends commercial email to people who have asked for it. Every marketing email identifies the Studio and includes a one-click unsubscribe link, and the Studio acts on unsubscribe requests promptly, in line with CASL and applicable law.

How the Studio protects your information

The Studio uses reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS), access controls, and reputable service providers. No method of transmission or storage is completely secure, so the Studio cannot guarantee absolute security. If a breach affects your personal information and the law requires it, the Studio will notify you and the relevant authorities without undue delay.

Children's privacy

The Site is intended for businesses and adults. It is not directed to children, and the Studio does not knowingly collect personal information from anyone under 16. If you believe a child has provided the Studio with information, email the Studio and it will delete it.

Third-party links

The Site may link to third-party websites and services that the Studio does not control. This policy does not cover them, so please review their own privacy policies before providing any information.

Changes to this policy

The Studio may update this policy from time to time. When it does, the Studio will revise the date at the top of this page, and for significant changes it will provide a more prominent notice. The current version is always the one posted here.

Contact

Questions, requests, or complaints about your privacy? Email the Studio .