Secure by design. Built for Canadian law.

Patient health information in norvelle is stored and processed in Canadian data centres, under Canadian jurisdiction, with a separate database for every clinic brand and legal entity. The law that applies is the federal PIPEDA together with the health privacy statute of the province your clinic practises in, and Quebec's Law 25 for private sector information there. Your clinic is the custodian, trustee or holder of that information and norvelle handles it on your instructions under a written agreement, so norvelle is designed to support your obligations under PIPEDA, PHIPA and Law 25 rather than to certify against them: no health privacy statute offers a vendor certification, and we claim none.

Yes. All patient health information is stored and processed in Canadian data centres. We do not publish facility or vendor names. If your evaluation needs deployment detail, ask, and we will take your IT team through the architecture directly.

Only the people your clinic authorizes, with per-location roles and permissions, and a step-up prompt before sensitive fields. Operational logs run through an always-on scrubber that strips patient fields before anything is written.

Who did it, what they did, which record, the location, the time, the IP address and the device. Reads count: opening a patient chart, a patient list or a document is an event, and so is every invoice action, every permission change, every export and every break-glass grant.

The log is append-only and kept for ten years. Your administrators filter it by person, action or date to see what someone did and how often, and can take an encrypted copy away with them.

We restore from backup, and we know that works because we do it every week on purpose. The drill rebuilds the estate in an isolated cluster and checks the result down to database roles, grants and time-series chunks.

We do not publish a recovery time target, and there is no point-in-time recovery. The honest answer is the last good daily backup, restored by a procedure that is exercised weekly instead of written down and hoped for. Your IT team can have the detail.

No. No auditor has issued one, and we will not imply otherwise. What we can show you are the controls on this page: isolation, encryption, the audit trail, access control, a restore we prove every week, and who builds norvelle.

We contain it, we investigate it, and we tell you directly. Your clinic is the custodian, and PIPEDA and provincial health privacy law require notice as soon as feasible, so our job is to give you what you need to meet that duty without chasing us for it.