Who we are
Yanforms is operated by Yanis Tiam, an individual, at yanforms.com. He is the person in charge of the protection of personal information at Yanforms, and you can reach him at yanis@yanistiam.com.
What we collect about your practice
Your work email address, used to sign you in and to send you messages about your forms. If you sign in with Google, we receive only your email address, your name and picture as shown by Google, and a Google account identifier. Signing in gives us no access to your Google Drive or any other Google data.
Your practice’s name, the people you give access to, your invoices and payments, and a daily count of your visits to your account.
The blank form you upload. It must not contain patient information. If we find patient information in an upload, we delete the file immediately without using it and tell you.
Your time zone, read from your browser, so we can show deadlines in your local time.
Your card
We do not ask for a card to build your form or to start your free month. When we do ask for one, here is what happens to it.
Your card details are entered in a form provided by Stripe, our payment provider, and are stored by Stripe. They never reach our servers. We keep only the identifiers Stripe gives us to charge the subscription you agreed to.
Your patients’ information
When a patient completes one of your forms, the signed document is created on the patient’s device and sent directly to Google Workspace, where it is stored in a folder shared with your practice. Google Workspace is covered by Google’s Business Associate Agreement.
Our own servers never receive the content of a completed form. They receive only a count: which form was used, and when.
We sign a Business Associate Agreement with your practice before your form is used with patients, free of charge.
Proof at signature
If your practice turns on photo uploads, photo at signature or location at signature, the patient’s device asks for permission first. Photos and location travel with the signed form to your practice’s Google Workspace, like every other answer, and never reach our own servers. A patient who declines can still sign, unless your practice requires it.
Yanforms Sign
Yanforms Sign is for your practice’s internal documents: meeting minutes, attendance sheets, supervision records, policies. It is not meant for patient records, and you agree not to upload them.
When you use Sign, our servers keep the document you upload, the names you enter, and for each signer what they type, the drawing of their signature, the date and time, the IP address and browser of their device, and their agreement to sign electronically. This record proves who signed what, and when.
A document is visible only to the person who created it and to Yanforms. Signers open it with a private link and need no account.
If you connect your Google Drive
You can choose to have signed forms saved in your practice’s own Google Drive. Google then asks you to allow access to the files our service creates in your Drive, and only those: we cannot see or change anything else in your Drive.
The access key that Google issues is kept inside Google Workspace, in the script that files your forms, and never on our own servers. Our servers only record that your Drive is connected and which Google account you used.
We use this access only to create your forms’ folder and spreadsheet and to save your patients’ completed forms there. We do not use it for advertising, we do not sell it, and no one on our side reads it unless you ask us to fix a problem. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time from your account page or from your Google account settings. New forms then go back to our secure folder shared with your practice.
Who processes information for us, and where
Google Workspace, in the United States and other countries: completed patient forms, under Google’s Business Associate Agreement, and Google sign-in.
Hostinger, on servers in Paris, France: our website, your account, your uploaded blank forms and your Yanforms Sign documents. No completed patient form is stored there.
Resend, in the United States: the emails we send you. They never contain patient information.
Stripe, in the United States: card payments, once billing by card starts.
Yanforms is run from outside the United States and Canada. Each provider handles information only to deliver its part of the service.
Canadian practices: PIPEDA and Quebec’s Law 25
For practices in Canada, Yanforms acts as your service provider. Your practice stays responsible for the personal information it collects, and we handle it only to provide the service, under a written agreement, as the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector (Law 25) require.
Completed forms are stored in Google Workspace, which may keep them outside Canada, including in the United States. We give you the information you need to tell your patients, and, in Quebec, to carry out the privacy impact assessment the law asks for before information leaves the province.
If a confidentiality incident affects your patients’ information, we tell you without delay, so you can assess the risk of serious injury and notify the Commission d’accès à l’information and the people concerned when the law requires it. We keep a register of every confidentiality incident.
Your rights
You can ask to see the information we hold about you, to correct it, to receive a copy, or to have it deleted, and you can withdraw a consent you gave. Write to yanis@yanistiam.com. We answer within 30 days.
If your request is about a patient’s form, we pass it to the practice that collected it, which decides, as HIPAA and Canadian law require.
In Canada, you can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information.
How long we keep things
Your uploaded blank form is kept while we build and maintain your form. If a form is deleted, we first share its folder of patient records with your practice email. We never delete your patient records.
Nothing in Yanforms Sign is deleted automatically, so your practice never loses a signed document. You can ask us to delete your documents when you no longer need them.
Your account is kept while you use Yanforms. When you ask us to close it, we delete it within 30 days, except invoices and payment records, which we keep as long as tax law requires.
How we protect it
Every page and every exchange is encrypted in transit. Access to our servers and to the Google Workspace account that holds completed forms is limited to Yanis Tiam. Our database is backed up every night, and backups are checked. If something goes wrong, we tell the practices concerned without delay, and within 10 business days at the latest under our Business Associate Agreement.
Changes and contact
Yanforms is a service for healthcare practices, not for children. If we change this policy in a way that matters to you, we email you before the change applies.
For any question, write to yanis@yanistiam.com, or reply to any email you received from us.