Patient information, protected by design.
Your patients trust you with their details. Here's exactly how Magyc looks after them, in plain language.
Encrypted in transit
Every connection to Magyc, the dashboard and our booking integrations uses HTTPS (TLS). Nothing is sent over plain HTTP.
Hashed passwords, signed sessions
Passwords are never stored, only salted scrypt hashes. Logins use signed, expiring, HTTP-only session cookies that scripts on a page can't read.
One practice, one view
Each practice has its own login and sees only its own receptionist, calls and recordings. Access is checked on every page and every request, not just at sign-in.
Private receptionists
Each receptionist is private: a web call can only start with a short-lived link issued by our server, so keys never reach a browser.
Authenticated booking tools
When a receptionist checks availability or books mid-call, the request carries a secret only our servers know. Requests without it are refused.
Guardrails on every call
Receptionists are kept on topic and protected against callers trying to override their instructions. They never diagnose or give medical advice.
We collect what a booking needs. Nothing more.
Magyc's receptionists are instructed to ask only for the details your practice needs to book or call a patient back, typically name, phone number, date of birth, email and the reason for the visit. They don't ask for health card numbers or payment details.
What's kept
For each call: the recording, a transcript, and a short summary with the details your team needs. Your practice can review all of it in the dashboard.
Who can see it
Your practice's team, through your own login, and a small number of Magyc staff when you ask for help or when needed to keep the service running.
Where it's processed
Magyc uses carefully chosen infrastructure providers for telephony, speech and hosting, some of which process data outside Canada, including in the United States. Our privacy policy explains this in full.
Deleting it
Ask us to delete a call, a patient's information or your practice's data at any time, and we'll confirm when it's done.
Built around PIPEDA and PHIPA.
Your practice remains responsible for your patients' information, and Magyc acts on your behalf as a service provider. We design the product around Canada's federal privacy law (PIPEDA) and provincial health privacy laws such as Ontario's PHIPA: collecting only what's needed, using it only to serve your practice, protecting it, and letting you access and delete it.
Need a data processing agreement, a privacy impact assessment or answers for your regulator? Email hello@magyc.ca.
Found a security issue?
If you believe you've found a vulnerability or that information has been exposed, email hello@magyc.ca with “Security” in the subject. We'll acknowledge it promptly and keep you updated. Please don't access other people's data or disrupt the service while investigating.
If a breach affects your practice's patients, we'll tell you without delay and give you the information you need to meet your own reporting obligations.
Questions from your privacy officer?
We're happy to walk your team through how Magyc handles patient information before you sign anything.