Legal
Privacy Policy
How AIP Innovations Inc. collects, uses, stores and protects information when you use Lithaya.
1. Who we are
Lithaya is operated by AIP Innovations Inc., a company based in Ontario, Canada ("we", "us"). This policy explains what information we handle when you use the Lithaya website, the Lithaya Clinical Workspace and Guided Review, and Lithaya Academy (together, the "Platform"), and the choices you have.
The Platform is intended for qualified healthcare professionals, trainees, healthcare students and educators. It is not intended for patients or the general public, and it offers no patient-facing services.
2. Information we collect
- Account information: your name, email address, profession or program, username, password (kept only in a scrambled form that cannot be read back), plan, the dates your trial or plan starts and ends, when you last signed in, and the internet (IP) addresses you signed in from.
- Billing information: your plan and payment records. Card payments are handled by a PCI-DSS compliant payment processor; we do not store full card numbers.
- Messages: what you send us through the contact or trial forms, or by email.
- Technical information: standard web server logs, such as IP address, browser type, pages requested and time of access.
3. Case text, answers and dictation
When you run a report, use Guided Review or submit an Academy answer, Lithaya first removes common identifiers from the text (such as phone numbers, ID numbers, dates of birth, addresses and common names), and asks you about any word that may be a name. The text is then sent over an encrypted connection to Lithaya's server, which passes it to our AI provider, a third-party service in the United States, only to produce your response. Neither Lithaya nor our AI provider stores it after the response is returned, and it is not used to train AI models.
Dictation. The Dictate feature, and “Speak your answer” in Lithaya Academy, use the speech recognition built into your web browser. In Google Chrome, audio is sent to Google to be converted to text and is handled under Google's terms and privacy policy, which we do not control. Lithaya does not receive or store the audio. Do not dictate patient names or other identifying information. If you prefer, type your case instead. Lithaya does not accept audio files.
To find sources to cite, Lithaya searches PubMed, run by the U.S. National Library of Medicine (NCBI). Only short search terms are sent, such as the name of a condition (“asthma”), never the case text. The search goes through Lithaya's server, which keeps the terms and results for up to 7 days to avoid repeat searches and records the connection's address for one hour to limit misuse. If Lithaya's server cannot do the search, it goes straight from your browser to NCBI.
To check the medicines in a report against their drug labels, Lithaya looks them up in openFDA, run by the U.S. Food and Drug Administration. Only the medicine names and their route are sent, never the case text. The lookup goes through Lithaya's server, which keeps the labels found for up to 7 days to avoid repeat lookups and records the connection's address for one hour to limit misuse. If Lithaya's server cannot do the lookup, it goes straight from your browser to openFDA.
Cases, analyses, libraries and Academy progress you save are stored on your own device, in your browser and in the Lithaya folder you choose. We do not receive a copy.
Do not enter names, ID numbers, addresses, dates of birth or other information that identifies a patient. Lithaya removes common identifiers automatically and asks about possible names, but it cannot find every one (for example an uncommon name), so you remain responsible for any personal health information you choose to enter. Lithaya Academy uses fictional cases only and removes identifiers from practice cases and answers the same way.
4. Professional-use confirmations
Each time the Clinical Workspace opens you confirm that you are a qualified healthcare professional or a trainee, and Lithaya Academy asks learners to confirm their educational use on each new day of use. These confirmations, and your confirmation that you reviewed a report before exporting it, are recorded with the date and time in your own browser. They are not sent to us.
5. How we use information
- To create and manage your account
- To provide, secure and improve the Platform
- To process payments and keep billing records
- To answer your questions and send service notices
- To meet legal obligations and prevent fraud or misuse
We send marketing email only with your consent, and you can withdraw it at any time. We do not sell personal information, and we do not use your cases or answers to train AI models.
6. Sharing
We share information only with service providers who help us run the Platform (such as hosting, AI processing, email and payment processing) under confidentiality obligations, when the law requires it, to protect the rights and safety of users or the public, or as part of a merger or sale of the business with notice to you.
7. Security
The Platform is served only over encrypted HTTPS connections. Access to account data is limited to the people who need it to operate the service. No system is completely secure; tell us immediately at [email protected] if you believe your account has been compromised.
You are responsible for protecting your own devices, passwords and the Lithaya folder where your libraries are stored.
8. Retention
- Account information: while your account is active and for a reasonable period afterwards
- Billing records: at least seven years, as required for tax and accounting
- Server and security logs: as long as needed for security and legal purposes
9. Your rights
You may ask to access, correct or delete your personal information, to receive a copy of it, or to withdraw consent, subject to legal requirements. Email [email protected]. We acknowledge requests within two business days and respond within thirty days.
10. Cookies and browser storage
The website does not use advertising or tracking cookies. When you sign in, it sets one cookie that keeps you signed in until you sign out. The apps use your browser's storage to keep your settings and work on your device. See Cookies & Storage.
11. Where information is processed
Our account systems are operated from Canada. Case text is processed by our AI provider in the United States to produce your response and is not kept. Dictation in Chrome is processed by Google under its own terms. PubMed searches are processed by NCBI, and drug label lookups by the U.S. Food and Drug Administration (openFDA), in the United States. Where we use service providers outside Canada, we use contractual safeguards.
12. Age
The Platform is for adults. We do not knowingly collect information from anyone under 18.
13. Changes
We will post any change to this policy on this page and update the version and date above. For significant changes we will also notify members by email before they take effect.
14. Governing law and contact
This policy is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there.
Privacy Officer, AIP Innovations Inc., Ontario, Canada · [email protected] · Mailing address available on request.