ImmiPractice processes the client data your firm puts into it — leads, client profiles, case records, documents, agreements and signatures, payments, appointments and messages — only to provide the CRM on your instructions. It is hosted in Canada, encrypted in transit and at rest, visible inside your firm according to roles and branches, and not sold or used for advertising. Meta processes WhatsApp and Lead Ads data only if you connect them.
- ImmiPractice processes leads, client profiles, cases, documents, agreements, payments, appointments and messages on your firm’s behalf.
- Hosting, database, file storage and backups are in Canada.
- Meta processes data only if you connect WhatsApp or Lead Ads.
- ImmiPractice’s back office has no screens for browsing your clients’ records.
Before you can explain your practices to clients — or fill in a vendor questionnaire — you need a clear picture of what your CRM holds. Here is what ImmiPractice processes on your firm’s behalf, where it comes from, and who can see it.
What data does an immigration firm store in ImmiPractice?
| Category | Typical contents | How it gets there |
|---|---|---|
| Leads | Name, contact details, service of interest, source, status, notes, activity timeline | Meta Lead Ads (if connected), WhatsApp, your Form Menu, website forms, reception, manual entry |
| Client profiles and cases | Identity and contact details, family members and dependants, case number, fees, filing status, memos, visa outcome | Staff entry, intake forms, questionnaires in the client portal |
| Documents | Passports, IDs, financial records, certificates — whatever your checklists ask for | Client uploads in the portal, staff uploads, documents saved from WhatsApp |
| IRCC form data | Answers used to fill IRCC PDF forms | Questionnaires and data already on the case |
| Agreements and signatures | Retainer agreements, typed, drawn or uploaded signatures, audit trail of every agreement event | Agreement templates and the signing link |
| Payments and invoices | Installments, payment mode, reference, optional proof file, invoices; ledger entries | Staff in the Accounts module |
| Communications | WhatsApp conversations and files, email notifications and reminders | WhatsApp Cloud API (if connected), automated emails |
| Appointments and tasks | Bookings, reminders, assignees | Staff and client self-booking |
| Your team | Staff names, work emails, roles, branches | Your Business Admin |
Much of this is sensitive. Collect only what each service genuinely needs: a visitor-visa file for a client like Maya does not need the same document list as a family PR application. Per-service document checklists make that easier to enforce.
Why does ImmiPractice process it?
Only to provide the service to your firm: storing records, showing them to the right staff, generating forms and invoices, sending the emails and messages you set up, and keeping the data backed up and recoverable. The privacy policy states that ImmiPractice processes customer data on its customers’ instructions and does not sell it or use it for advertising. The purposes for which your firm uses the data — giving immigration advice, preparing applications, billing — are yours to define and explain to your clients.
Where is the data processed?
- In Canada for hosting, database, file storage and backups.
- Email delivery provider for sign-in codes, notifications, invoices and reminders. Marketing campaigns and automations are sent through your firm’s own verified mailbox.
- Meta Platforms only if you connect WhatsApp or Lead Ads; those messages and leads also pass through Meta’s platform under Meta’s terms.
- Stripe for your ImmiPractice subscription. Card details are handled by Stripe and never stored by ImmiPractice. Recording a client’s payment on a case does not send it to Stripe.
- AI add-ons may use additional providers; these are listed for customers who enable them.
The full list is on the subprocessors page.
Who can see the data?
Inside your firm, access follows the seven built-in roles. Branches do not share data; only the Business Admin sees across branches. Receptionists never see enrolled cases, and Filing Team members see only the cases assigned to them. Only the Business Admin can change the permission grid.
At ImmiPractice, the internal back office shows account, plan and billing information for each business and has no screens for browsing your clients’ records. Access to production systems is limited to the people who operate the service. The written internal access policy is being documented as part of SOC 2 work and can be reviewed on request.
Your clients see only what you share with them in the portal — their checklist, questionnaires and appointments. Internal notes and memos stay inside the CRM.
What should you tell your clients?
Most firms add a short paragraph to their privacy notice or retainer agreement: that client files are kept in a secure, Canada-hosted case management system operated by a service provider on the firm’s behalf, and that messaging channels such as WhatsApp are used only if the client chooses them. Adapt the wording to your regulator and your own practice.
This is general information, not legal advice.
General information about running an immigration practice — not legal advice. Rules change; confirm current requirements with official sources and your regulator.