Instream Privacy Policy  

Last Modified: October 20th 2025

Your privacy is important to us. We will respect your privacy through the protection of your personal information. We take great care to keep both confidential and secure all Personal Information we collect and manage, including by using Public Key Infrastructure (PKI) security and privacy systems. Instream’s computer servers are hosted in secure facilities in Canada. Instream has developed this Privacy Policy to ensure the highest standard of protection for the Personal Information we collect, use, and disclose.

Please read this Policy (the “Policy”) carefully to understand our policies and practices for collecting, processing, and storing your personal information.  

If you do not agree with our policies and practices, your choice is not to use Instream’s Services (as defined herein and in the Terms of Use). By accessing or using our Services, you indicate that you understand, accept, and consent to the practices described in this Policy and the Terms of Use. This Policy may change from time to time.

Your continued use of Instream’s Services after we make changes to the Policy indicates that you accept and consent to those changes, so please check the Policy periodically for updates. Instream will notify you in advance of any material changes to this Policy and, to the extent required by applicable laws, will obtain your consent to any new ways that we collect, use, and disclose your personal information.

About Instream

Instream operates an internet-based electronic insurance claim transaction system, as well as a bulk-payment transaction systems, in a manner that provides security and privacy features. Instream uses digital certificates for insurance claim transactions, and username and password and two-factor authentication for bulk-payments, to provide security and privacy.

 Purpose of Policy

Collecting personal information about you is essential to our ability to offer you a secure, efficient, high-quality internet-based insurance claim transaction system, as well as a bulk-payment transaction systems.

This Policy outlines Instream’s privacy processes with respect to the personal information we collect from you when you use the Services, in accordance with the rules and protections governing such information under applicable law.

We are committed to complying with this Policy and with all applicable provincial and federal privacy legislation.

Scope of Policy

This Policy covers personal information collected through our website, as well as personal information collected through use of our Services.

In this document, the terms “we,” “us” and “our” refer to Instream and its products and Services. The terms “you” and “your” refer to all individuals and organizations who use Instream’s Services, including but not limited to:

• Senders and recipients of insurance claims
• Dental professionals
• Authorized Service Providers (including PaySuite practice management software vendors)
• Organizations facilitating the adjudication and payment of health benefit claims, including financial institutions
• Business partners and affiliates
• Website visitors and users of Instream’s Services

This Policy does not apply to the collection, use, retention, disposal, destruction, and protection of personal information by dental professionals or any other third party that is not included in the Policy. Dental professionals are subject to privacy legislation and professional requirements that govern their management of personal information, including personal information they collect, use and retain in the course of providing Services through Instream’s Services. Please feel free to ask any dental professional to whom you are referred if you have questions about how they will treat your Personal Information.

Definitions

“Consent” refers to the voluntary agreement by an individual to the collection, use, or disclosure of their personal information for specific, identified purposes. Instream obtains Consent in a manner that is clear, informed, and appropriate to the sensitivity of the information involved.

“Dental Professional” refers to licensed and trained Dental Professionals, including dentists, dental hygienists, denturists and any other Dental Professional using Instream’s Services.

“Personal Information” is information about an identifiable individual. In the health care context, Personal Information means information about an identifiable individual that includes any factual or subjective information, recorded or not, about that individual, including health-related information and information about healthcare services accessed by the individual. It may include the name, address, date of birth, telephone number and other contact information, usage requirements, aggregated usage patterns, and verification information. It does not include the name, title, business address, or telephone number of an employee of an organization.

“Authorized Service Providers” are third-party organizations, contractors, software vendors (e.g., Practice Management Software Vendors), or individuals engaged by Instream to perform specific functions or Services on our behalf, such as IT support, payment processing, or data hosting. Authorized Service Providers who have been formally approved by Instream are contractually bound to comply with our privacy and security requirements.

“Services” include Instream’s Services, platforms, and applications, including Instream Claims™, Instream Direct Pay™, Instream PaySuite™, Instream PaySuite Lite™  and any related Services, features, content or materials.

“Authorized Users” refers to any individuals or organizations who access, use, or interact with Instream’s Services in accordance with our Terms of Use. This includes Dental Professionals; dental office Staff, insurance carriers and third-party administrators, Practice Management Software vendors and visitors to Instream’s Website or digital platforms.

“Website” refers to Instream’s publicly accessible online platforms located at  instreamcanada.com, all subdomains of instreamcanada.com, directpaycanada.com, all subdomains of directpaycanada.com, paysuite.ca and all subdomains of paysuite.ca. which provides information about the company’s Services, facilitates access to secure portals, and supports user interactions such as account management, support inquiries, and general inquiries.

Types of Information Instream Collects

Depending on the service used, we may collect information from you directly or indirectly.

Information provided to us directly includes:

• Insurance Claim Transactions: Name, address, telephone number, date of birth, health benefit claim details, and transaction data.
• Bulk-Payment System: Banking information, payment details, and transaction history.
• Verification and Credentialing: Professional credentials, licensing information, and association membership details.
• Consent Records: Documentation of when and how Consent was obtained for collecting Personal Information.
• Communication Records: Emails, messages, or support inquiries, retained for customer service or audit purposes.
• Payment Information: Credit Card information used to bill for Instream paid Services.
• Account Information: Your Instream Account and related account details, as applicable, to access the Services.

Information collected automatically or received from third parties includes:

• Website Usage: IP address, device information, browser type, usage patterns, and cookie preferences.
• Application Usage: Security logs (e.g., login attempts, access history, audit trails), preferences, location data, and settings for user-selected configurations or accessibility options.
• Third-Party Data: Information received from insurers, regulators, or Authorized Service Providers.

Information Instream is Responsible for Protecting

Instream is responsible for protecting your Personal Information in our possession or custody, including Personal Information that has been transferred to or received from a third party or Service Provider for processing or for other purposes for which you have Consented.

Purpose and Consent

We collect Personal Information to:

• Facilitate secure processing of Insurance Claims.
• Enable bulk-payment for assigned benefit payments.
• Verify credentials and facilitate professional association processes.
• Provide you with the Services.
• Bill for paid Services.
• Improve and maintain our Website and Services and other administrative needs.

We will explain the Purpose of collection at or before the time information is collected. “Purpose” refers to the specific, identified reason for which Personal Information is collected, used, disclosed, or retained by Instream. We only collect Personal Information that is necessary to support our Services, including, claims processing, benefit payments, credential verification, and platform optimization.

Consent may be explicit or implied, except where otherwise permitted or required by law, and can be provided directly by the individual or by an authorized representative.  

You may withdraw your Consent to collect, use and disclose your Personal Information at any time, subject to legal and contractual restrictions and reasonable notice. Please note, however, that withdrawing your Consent may affect our ability to provide you with certain features and benefits of Instream’s Services.

Limiting Collection, Use, Disclosure, and Retention

We only collect Personal Information necessary for the identified Purposes. We collect information by fair and lawful means.

Personal Information will only be used, disclosed, or retained for the Purposes for which it was collected, or for a use consistent with that purpose, unless otherwise Consented to or required/permitted by law.

Data is retained only for the period of time necessary for performing the Services offered to you by instream, including updating the product or Services as required by law, and for a reasonable length of time thereafter, in case we need to meet any potential obligations or legal or governmental requirements. When we destroy Personal Information, we will use safeguards to prevent unauthorized parties from gaining access to the information during the process.

Disclosure of Personal Information

Personal Information may be shared with third parties or Authorized Service Providers on an as-needed basis, and only for the Purposes for which it was originally collected, or for a use consistent with that purpose. If the Purpose for collecting Personal Information changes, to the extent required by applicable laws, Instream will obtain your Consent before using or disclosing the information for the new Purpose.

Instream takes privacy and data protection seriously and implements safeguards to reduce the likelihood of unauthorized access or misuse. However, as with any digital service, there are inherent risks associated with the collection, use, and disclosure of Personal Information. These may include:

• Risk of unauthorized access, disclosure, or use by third parties.
• Potential for data loss or compromise during transmission or storage, despite encryption and other security measures.

We continuously monitor and improve our privacy and security practices to mitigate these risks and strive to uphold the trust placed in us by our users and partners.

Cross-Border Transfers of Personal Information

We may transfer Personal Information that we collect or that you provide, as described in this Policy, to contractors, Authorized Service Providers, and other third parties we use to support our business (such as analytics and search engine providers that assist us with Website improvement and optimization) and who are contractually obligated to keep Personal Information confidential, use it only for the Purposes for which we disclose it to them, and to process the Personal Information with the same standards set out in this Policy. Please note that Personal Health Information in Instream’s care is stored within Canada and is not transferred outside of Canada.

We may process, store, and transfer your Personal Information in, and to a jurisdiction outside of Québec and/or Canada. Organizations based outside of Canada may not be subject to privacy laws that provide you with the same rights and protections as in Canada. As a result, when your Personal Information is used or stored in a jurisdiction other than where you are residing, it may be subject to the law of this foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction. Whenever we engage a Service Provider located outside of Québec /Canada, we employ contractual terms to ensure that such Service Provider adheres to this Policy and applicable Canadian privacy legislation.

Responsibilities of Authorized Service Providers

Authorized Service Providers are contractually required to use and retain information only for the specific Purpose for which they are engaged and to maintain confidentiality. Banking information may be shared to enable payment of benefits. Credential information may be shared with professional and regulatory organizations for validation. Depersonalized data extracts may be produced for research purposes, with Consent, ensuring individuals cannot be identified.

Instream’s Security Measures to Safeguard Personal Information

We employ robust security measures to help protect Personal Information from unauthorized access, use, disclosure, alteration, and destruction. These measures include:

• User authentication via digital trust certificates, usernames, passwords and Two Factor Authentication
• Encryption of data in transit and at rest using industry-standard protocols
• Access controls that restrict Personal Information to authorized personnel only
• Regular review and updating of security protocols and infrastructure
• Scheduled and Emerging Threat Vulnerability Scans
• Secure data disposal practices to ensure Personal Information is irretrievably destroyed when no longer needed
• Employee training on privacy and data protection obligations

All employees, Authorized Service Providers, and any other applicable third parties as outlined in this Policy are contractually required to protect the confidentiality and integrity of your Personal Information.

Use of Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to:

• Enhance user experience
• Analyze Website usage and performance
• Remember user preferences
• Support security and authentication

The types of cookies used include:

• Essential Cookies: Required for Website functionality and security (e.g., two-factor authentication).
• Analytics Cookies: Track user engagement and behavior (e.g., via Google Analytics). These may be used to assess user interests and preferences.
• Preference Cookies: Store user settings and preferences

In compliance with Quebec’s Act respecting the Protection of Personal Information in the Private Sector, all non-essential cookies, including those used for analytics and profiling, are disabled by default. Users are presented with a cookie banner upon visiting the site, allowing them to:

• Review the types of cookies used
• Provide express consent for specific cookie categories
• Withdraw consent at any time
• Access information about how their data is used and stored

Your Privacy Rights

You have the right to ask whether we hold any Personal Information about you and to see that information, as provided by law. If you believe any of the information we have collected about you is incorrect or incomplete, you have the right to ask us to change it. Where we have obtained medical information about you from a third party, we will release this information only through your health care provider.

Please make your request for access or correction to Instream’s Privacy Officer (see the contact information below), stating as specifically as possible, which Personal Information you are requesting. We will try to respond to your request as soon as possible and will advise you if, for some reason, we cannot respond right away. Under certain circumstances and subject to legal limitations, we have the right to refuse your request for access or correction to your Personal Information.

Complaints and Contact Information of Privacy Officer

You may register a privacy-related complaint by contacting our Privacy Officer. We will investigate all complaints and take necessary steps to address justified concerns. Information about additional complaint procedures will be provided as needed.

Instream’s Privacy Officer contact details are as follows:
Privacy Officer: privacyofficer@instreamcanada.com