Data Processing Agreement

1. About this agreement

This Data Processing Agreement (the "Agreement") applies when a firm uses ElderCare Concierge for its own clients. Firms include advisor firms, clinician firms and case management firms (each a "Firm"). It sets out what ECC does with the personal information that the Firm, its people and its clients put into the service, and what ECC owes the Firm in return.

2. Parties and roles

This Agreement is between:

The Firm controls Firm Personal Information: it decides why the information is collected and how it is used, and it remains accountable for it under the Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial privacy law that applies to the Firm. ECC processes Firm Personal Information on the Firm's behalf, only to provide the service and only on the Firm's documented instructions.

If the Firm is a health information custodian under Ontario's Personal Health Information Protection Act (PHIPA), the Firm remains the custodian of the personal health information in its account, and ECC handles that information on the Firm's behalf as its service provider.

This Agreement does not cover information ECC handles for its own purposes. That includes the records ECC keeps to run the Firm's account (the names and contact details of the Firm's account holders, invoices and payment records), ECC's security records, and information about families who buy a Care Forecast directly from ECC. Our Privacy Policy covers that information.

3. Definitions

"Firm Personal Information" means personal information about an identifiable individual that the Firm, its people or its clients enter into the Firm's account, or that the service produces from it, such as reports.

"Processing" means anything done with Firm Personal Information, including collecting, storing, reading, analyzing, changing, disclosing and deleting it.

"Sub-processor" means a company ECC engages that handles Firm Personal Information to provide the service. Schedule A lists them.

"Breach of security safeguards" means the loss of, unauthorized access to or disclosure of Firm Personal Information resulting from a breach of ECC's security safeguards or from a failure to establish them.

4. What we process

Subject matter

The service the Firm uses: Family Alignment questionnaires and reports, Care Forecast reports and the clinician visits that go with them, the Clinician Desk, follow-up reports and the Home Safety Scan where we have switched them on and the Firm uses them, and the emails and in-app notices that go with all of these.

Duration

From the first time the Firm's people enter information until it is erased under section 12.

Nature and purpose

We store Firm Personal Information. We send the parts each report needs to an AI model to write and check the report. We make reports available to the people the Firm and its clients choose. ECC staff and clinicians read reports as section 6 describes. We send email and in-app notices, and we support, secure and fix the service.

The people it is about

The Firm's own people (advisors, assistants, case managers and clinicians). The Firm's clients: the older person a plan is for, and the family members and others who take part. People named in the information, such as emergency contacts, substitute decision-makers and relatives asked to complete part of a questionnaire.

Kinds of information

• Names, email addresses, phone numbers, home addresses and postal codes, and family relationships and roles.
• Family Alignment answers, ratings and notes, and the reports written from them.
• Care Forecast questionnaire answers: health conditions and diagnoses, daily abilities, memory and thinking, mood and mental health, medications, assessment scores, advance care documents, faith, culture and language, living situation, income, savings and investments, home equity and insurance. Also the clinician's visit notes and recommendations, and the reports and PDFs.
• Documents a clinician uploads and the text read from them, and photographs of paper questionnaire pages, which are read and not kept.
• Tracked actions, notes and life events recorded for a family.
• Copies of emails kept under the Firm's compliance policy, if the Firm has turned that on.
• Home Safety Scan room measurements and photographs, with faces blurred on the phone, once we switch the scan on and if the Firm's clients use it.
• Sign-in records, IP addresses and browser details, and audit records of actions taken in the account.

Much of this is sensitive, in particular the health, mental health, financial, religious and cultural information.

5. The Firm's instructions

The Firm's documented instructions are this Agreement, our Terms of Service, the services the Firm orders, and the choices its people make in the service: who they invite, what they order, what they share and what they ask us to delete.

We process Firm Personal Information only to follow those instructions, or where the law requires us to. If the law requires us to process it in some other way, we will tell the Firm first, unless the law forbids that. We do not sell Firm Personal Information, and we do not train AI models on it. We also record usage events and error reports to keep the service working and improve it; Schedule A says what they contain.

6. Who handles the information

Only people who need Firm Personal Information to provide the service can reach it:

• the Firm's own people, according to the roles and access the Firm gives them;
• ECC staff, who support, secure and fix the service, and who read and approve every Family Alignment report before release; and
• the clinician assigned to a Care Forecast visit, who may be one of the Firm's own clinicians or a professional in ECC's network whom ECC engages and pays.

Network clinicians accept our Portal Access Waiver and Terms of Use when they sign in, and it requires them to keep client information confidential. ECC staff with access are bound to keep Firm Personal Information confidential.

7. Security measures

These are the measures in place today.

• The service runs on Google Cloud. The database and file storage are in Google Cloud's Toronto region. The database refuses direct connections from the internet; the service reaches it through Google's authenticated connector.
• Google Cloud encrypts all stored data. On top of that, the database fields that hold health, financial and other sensitive information are encrypted with field-level encryption (Fernet: AES-128 in CBC mode with an HMAC-SHA256 check), using a key kept outside the database. Some working copies kept with reports, such as summaries and generation records, have Google Cloud's storage encryption only.
• Uploaded documents, report PDFs and Home Safety Scan captures are kept in a private storage bucket encrypted with a key we manage in Cloud KMS, rotated every 90 days. Public access to the bucket is blocked, deleted files are not kept as old versions, and every read and write of a file is logged.
• Connections to the service and to the database are encrypted.
• Access depends on each person's role and organization, so the Firm's people see only the Firm's records. Sign-in goes through WorkOS. Multi-factor authentication is available, and ECC can require it for a person, or for every member of a Firm at the Firm's request. It is not required by default.
• Session tokens and Care Forecast intake and share links are stored as hashes rather than as the tokens themselves. Older kinds of link, including Family Alignment questionnaire links, are stored as issued.
• We keep audit records of significant actions, including staff access to family records and to released Care Forecast reports.
• Requests are rate-limited at the load balancer and in the application.
• The database is backed up daily, with point-in-time recovery, and backups are kept for seven days.
• Every code change goes through automated dependency and code security scans, and we carry out periodic internal security reviews.

We do not hold SOC 2 or ISO 27001 certification.

8. Sub-processors

The Firm authorizes ECC to use the sub-processors listed in Schedule A. Each handles only what its part of the service needs, under its own published terms.

Before a new sub-processor starts handling Firm Personal Information, or an existing one starts handling a new kind of it, we will update Schedule A and email the Firm's owner. If the Firm objects, it can end its use of the service as the Terms of Service describe and ask us to delete its information under section 12.

The service can send some AI work to Anthropic or OpenAI by a change of configuration. We do not do so today, and we would treat it as adding a sub-processor.

9. Where information is processed

The database and file storage, and the key that encrypts the file storage, are in Google Cloud's Toronto region. We have not yet set the location of database backups or of our service logs to Canada.

Family Alignment analysis and its quality checks run on Vertex AI's global service, so they may be processed in any Google Cloud location. Follow-up reports, the Home Safety Scan and an automated safety check of Care Forecast questionnaires would run there too; all three are switched off today.

Care Forecast work runs in Google Cloud's Montréal region. The call that writes the main report and the call that plans rehabilitation therapy are retried in Montréal when it is too busy, and then sent once to the global service, where they may be processed in any Google Cloud location. The quality checks, revisions and corrections, the cost check, the search for local care providers and the reading of scanned paper questionnaires stay in Montréal. While it writes a report, the model can search the web with Google Search, which is outside Vertex AI's commitment to keep data in a chosen region. The provider search uses Google Maps and is sent the name and address of the person the report is about, as Schedule A says.

Stripe and WorkOS are in the United States, PostHog is in the European Union, and Brevo may process information outside Canada, as Schedule A says. Information processed outside Canada is subject to the laws of the place where it is processed, and the authorities there may be able to reach it.

If the Firm serves clients in Quebec, we will give it the information it reasonably needs for the privacy impact assessment Quebec law requires before personal information is communicated outside Quebec.

10. Breach notice

If we become aware of a breach of security safeguards involving Firm Personal Information, we will tell the Firm's owner without unreasonable delay. We will tell them:

• what happened and when, as far as we know;
• what information and which individuals are affected, and roughly how many;
• our assessment of whether the breach creates a real risk of significant harm to anyone;
• what we have done, and plan to do, to contain it and reduce the harm; and
• who at ECC to contact about it.

We will send updates as we learn more. We will help the Firm notify affected individuals and the regulators it must notify, such as the Office of the Privacy Commissioner of Canada, Ontario's Information and Privacy Commissioner or Quebec's Commission d'accès à l'information. We do not notify the Firm's clients or regulators about Firm Personal Information ourselves unless the Firm asks us to or the law requires it.

We record every breach of security safeguards involving Firm Personal Information in our breach register, and keep each record for at least 24 months.

11. Requests from individuals

People with an account can download a copy of their information from the My Data page and delete their account themselves. Deleting an account erases the records the service holds about that person, as our Privacy Policy describes. A family that other people still belong to is kept for them, and reports already shared with the family stay.

If someone asks ECC directly to see, correct or delete Firm Personal Information, we will pass the request to the Firm promptly, unless the law requires us to answer it ourselves. When the Firm asks, we will help it answer a request by finding the information we hold about the person, correcting it, or erasing the person's account and, where nobody else still uses it, their family's records.

12. Retention, return and deletion

We keep Firm Personal Information while the Firm's account exists, until the Firm or the person it is about has it deleted, or until the end of the retention periods published in our Privacy Policy, whichever comes first.

If the Firm stops paying, its account becomes read-only. The Firm's people can still view their families and download released reports, and the information is kept until the Firm asks us to erase it.

When the Firm leaves, it can ask us in writing to erase its information. We then close the Firm's account and erase the personal content of every one of its families and Care Forecast orders: answers, reports and PDFs, visit notes, clinicians' drafts and uploaded documents, colleague reviews and the Firm's journal copies of emails. The records themselves remain as empty entries so the system stays consistent. We give the Firm a written confirmation of what was erased, and keep the same record in our audit log. A legal hold on the Firm's account stops the erasure until the hold is lifted.

Some things are not erased this way:

• the accounts of the Firm's own people, which each person can delete or ask us to delete;
• billing and payment records we must keep for tax and accounting;
• audit records of actions taken in the account;
• database backups, until they expire about seven days later; and
• copies held by sub-processors, such as emails already sent, usage and error events, and service logs, which are deleted on those services' own schedules.

Before the erasure, the Firm's people can download its released reports. We do not yet offer a single export of everything in a Firm's account. If the Firm needs more, we will provide copies of its reports and records that we can reasonably produce.

13. Information and audits

We will answer the Firm's reasonable written questions about how we protect Firm Personal Information. On request, we will give the Firm an export of the audit records for its people, covering up to the past two years. If a regulator requires an audit or inspection of how we handle Firm Personal Information, we will cooperate with it, within reason.

14. Liability and precedence

The limitation of liability in our Terms of Service applies to this Agreement. If this Agreement conflicts with the Terms of Service about how we process Firm Personal Information, this Agreement governs. If a written agreement signed by ECC and the Firm says something different on that subject, the signed agreement governs.

This Agreement lasts while ECC holds any Firm Personal Information, including after the Firm stops using the service.

15. Version, acceptance and changes

This is version 2. It replaces version 1, a supplier template under which ECC was the controller. A Firm whose owner accepted version 1 is asked to accept this version at the owner's next sign-in.

A Firm accepts this Agreement when one of its owners accepts it at sign-in. The owner of a new Firm is asked the first time they sign in, and the owner of a Firm already using the service at their next sign-in. We record which version was accepted, when, and by whom, against the Firm.

When we change this Agreement in a way that matters, we publish a new version with a new date, and the Firm's owner is asked to accept it at their next sign-in. We keep the earlier versions on record.

16. Contact

Schedule A. Sub-processors

Current as of November 5, 2026.