Last updated: March 2026
We collect as little data as possible. We don't sell your data. Viewing wait times requires no account and ERstat stores nothing about you, though a small share of visitors see a single Google ad that may use cookies (see Advertising). Alerts and community reports are opt-in only.
No account is required, and ERstat itself sets no cookies and runs no analytics on you. A share of visitors are shown a single Google ad in place of the virtual-care link on hospital pages; for those ad views Google may set advertising cookies and process data under its own policies (see Advertising below). Standard server access logs (IP address, timestamp, page requested) are retained for up to 7 days for security and abuse prevention, then deleted.
If you set up an alert, we store your notification method (browser push, email, or SMS), your contact address or phone number, the hospital and threshold you selected, and a device fingerprint to associate alerts without requiring login.
Email and phone numbers are used solely to send alert notifications. They are never shared or sold.
If you submit a wait time report, we store the reported wait time, timestamp, and a hashed device fingerprint. We do not store your IP address or any personally identifiable information with reports. Reports are anonymous.
If you create an account via Google, Facebook, or email, we store your name, email address, and authentication tokens. Accounts are optional and only required to manage alerts across devices.
No data selling. No location tracking. No analytics profiling of you by ERstat.
We use no third-party trackers such as the Meta Pixel or Google Analytics. The one exception is advertising: a portion of visitors are shown a Google AdSense unit, a third-party ad script that may use cookies to select and measure ads (see Advertising).
ERstat is running an experiment in which roughly one in ten visitors sees a single, clearly labelled Google ad in place of the virtual-care link on hospital pages. Everyone else sees no ads at all.
Google (AdSense) may use cookies and similar technologies to select and measure those ads. ERstat does not receive the personal data Google processes for advertising. You can review or turn off ad personalization at adssettings.google.com, and Google's handling of ad data is described in its advertising privacy policy.
All data is stored on Cloudflare's infrastructure (D1 database, Workers) with servers in North America. Cloudflare's privacy policy applies to infrastructure-level data handling.
Alert notification delivery uses AWS SES (email) and Twilio (SMS). Contact information shared with these services for delivery purposes is governed by their respective privacy policies.
You can request deletion of any data associated with your account or contact information at any time by emailing hello@erstat.ca. We will process deletion requests within 30 days.
If you used browser push notifications without an account, you can revoke them directly in your browser settings.
If we make material changes to this policy, we will update the date at the top of this page. Continued use of ERstat after changes constitutes acceptance of the updated policy.
Questions about privacy? Reach us at hello@erstat.ca