Privacy Policy

1. Information we collect

We collect information you provide directly to us. Account information includes your name, email address, phone number, professional credentials and company information. Profile information includes a professional bio, certifications, areas of expertise and profile photos. Family assessment data covers information about family members, care needs, living situations, relationships and care preferences. Communication data includes messages, feedback, survey responses and other communications with us. Payment information means your billing address and payment method details, which are processed securely through Stripe. Support information is what you give us when you contact customer support.

When you use our Service, we automatically collect certain information. Usage information covers pages viewed, features used, time spent on the platform and interaction patterns. Device information includes your IP address, browser type, operating system and device identifiers. Location information is your general geographic location based on IP address. Log information consists of server logs, error reports and performance data. We also collect information through cookies, web beacons and similar tracking technologies.

We may receive information from third-party sources. Authentication providers, meaning WorkOS and other authentication services, send us information about your sign-in. Payment processors, specifically Stripe, send us transaction information. We may receive publicly available professional information from professional networks, and usage analytics and performance data from analytics providers.

2. How we use your information

We use the information we collect to provide the Service: to create and manage your account, to facilitate connections between advisors and families, to process family assessments and generate AI-powered analyses, to create personalized care reports and recommendations, to process payments and manage billing, and to provide customer support and respond to inquiries.

We also use it to improve the platform. That means analyzing usage patterns to improve our services, developing new features and functionality, conducting research and analytics, testing new services and features, and monitoring platform performance and reliability.

We use your information to communicate with you. This includes sending service-related communications and updates, providing educational content and resources, sending marketing communications where you have consented to receive them, notifying you about platform changes or new features, and conducting surveys and collecting feedback.

Finally, we use information for legal and security purposes: complying with legal obligations and requests, protecting against fraud, abuse and security threats, enforcing our terms of service and policies, resolving disputes and investigating violations, and maintaining audit trails and compliance records.

3. Information sharing and disclosure

We share information when you explicitly consent to such sharing, including connecting you with advisors or sharing assessment results with family members you designate.

We share information with trusted third-party service providers who assist us in operating our platform. Stripe Inc. (USA) processes payments; your payment information is transmitted directly to Stripe and is subject to their privacy policy. WorkOS Inc. (USA) provides secure user authentication using OAuth 2.0 and single sign-on. Google Gemini, accessed through Vertex AI (Google LLC), generates care recommendations and analysis; this processing runs in Google Cloud's Montréal region, except that a Care Forecast Report may be generated outside Canada when that region is overloaded; Google LLC is a US company (see Section 9 for both), and assessment responses are processed by Google's AI systems to provide personalized insights. By submitting an assessment, you consent to this AI processing. Google Cloud Platform hosts the application and databases, running in Canadian regions (Toronto and Montréal). PostHog (hosted in the European Union) provides product analytics and session replay so we can understand how the platform is used and where users encounter difficulty; analytics is only enabled after you grant consent through our cookie banner, and we configure session recordings to mask all form inputs and answers so the content you type is never captured. Brevo (European Union) sends transactional email.

Some of our service providers are located in the United States. We remain accountable under PIPEDA for personal information transferred to these providers and require contractual protections to ensure a comparable level of privacy protection. Section 9 has the full details.

Within our platform, we may share advisor profiles and credentials with families seeking services, assessment results and reports with authorized family members, communication between advisors and families through our platform, and aggregated, anonymized data for research and improvement purposes.

We may disclose information when required by law, or to comply with legal process, court orders or government requests, to protect against fraud, security threats or illegal activities, to enforce our terms of service or other agreements, to protect the rights, property or safety of our users or the public, and to investigate and defend against legal claims.

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and any changes to this Privacy Policy.

4. Data security

We implement comprehensive security measures to protect your personal information. Data is encrypted in transit and at rest using industry-standard protocols. Access is governed by role-based access controls and multi-factor authentication. Our network is protected by firewalls, intrusion detection and a secure network architecture. Security patches and system updates are applied promptly, and we monitor continuously for security threats and vulnerabilities.

Administrative safeguards support these measures. All staff receive regular security and privacy training. Access is strictly controlled and reviewed regularly. We maintain comprehensive incident response and breach notification procedures, apply due diligence and security requirements to all vendors, and carry out regular compliance audits and policy updates.

Physical safeguards include secure data centres with physical access controls, environmental controls and monitoring, secure disposal of storage media, and background checks for personnel with data access.

While we implement strong security measures, no system is completely secure. We cannot guarantee the absolute security of your information. You can help protect your account by using a strong password and not sharing your login credentials.

5. Data retention

We retain your information for as long as necessary to provide our services and fulfil the purposes described in this Privacy Policy. Account information is retained while your account is active and for a reasonable period thereafter. Assessment data is retained to maintain service continuity and historical records. Communication records are retained for customer service and legal compliance purposes. Usage data is retained for analytics and service improvement, typically for 2 to 3 years.

When you delete your account or request data deletion, we will delete your personal information within 30 days, except where retention is required for legal, regulatory, or legitimate business purposes. Some anonymized, aggregated data may be retained for analytical purposes.

We may retain information longer when required by law, to comply with legal obligations, resolve disputes, enforce agreements, or protect our legal rights.

6. Your privacy rights

You have various rights regarding your personal information, subject to applicable law.

• You may request access to your personal information, receive a copy of your data in a portable format, view your account information and settings, and download your assessment data and reports.
• You may update your account and profile information, correct inaccurate personal information, complete incomplete information, and request correction of assessment data.
• You may delete your account and associated data, request deletion of specific information, opt out of marketing communications, and withdraw consent for data processing.
• You may object to certain types of data processing, restrict how we use your information, opt out of automated decision-making, and limit data sharing with third parties.

To exercise these rights, contact us at support@eldercareconcierge.ca or through your account settings. We will respond to your request within 30 days. We may need to verify your identity before processing certain requests.

7. Cookies and tracking technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. Essential cookies are required for platform functionality, authentication and security. Functional cookies remember your preferences and settings. Analytics cookies help us understand how you use our platform. Performance cookies monitor platform performance and user experience.

You can control cookies through your browser settings or, with a family account, on your Account page under Cookies. Disabling certain cookies may limit platform functionality. Essential cookies cannot be disabled as they are necessary for security and basic operation.

Our platform may include third-party cookies from our service providers (Stripe, WorkOS, analytics providers). These third parties have their own privacy policies governing their use of your information.

8. Third-party services

Our platform integrates with several third-party services. We use Stripe to process payments. Stripe has access to payment information necessary to process transactions, and Stripe's privacy policy governs their use of your payment information. We use WorkOS for secure authentication and single sign-on. WorkOS processes authentication information according to their privacy policy.

We use PostHog, a product-analytics service, to understand how people use our platform and to improve it. PostHog data is processed and stored in the European Union. Analytics is off by default and only begins after you accept analytics cookies in our consent banner; you can withdraw consent at any time, which stops collection and clears the related cookies. We capture page views and product events (for example, which assessment question or report section you reached) together with technical metadata. We do not send your assessment answers, report content or written feedback to PostHog. Session replay is configured to mask all form fields and answer content, so recordings show interaction patterns without revealing what you typed. PostHog acts as our data processor under a Data Processing Agreement and honours Do-Not-Track / Global Privacy Control signals.

We use Google Gemini AI to analyze assessment data and generate personalized care recommendations. When you submit an assessment, your assessment responses are sent to Google's Gemini API for analysis, the AI generates insights about care needs, family alignment and recommendations, Google processes this data according to their AI/ML Terms of Service, and data sent to Google is processed in Canada except in the one case described in Section 9, when it may be processed in another country. You may opt out of AI processing by withdrawing consent for your assessment. To do so, contact us at privacy@eldercareconcierge.ca or use the consent management features in your account settings.

Our platform may contain links to other websites. We are not responsible for the privacy practices of external sites. We encourage you to review the privacy policies of any sites you visit.

8A. AI and automated decision-making

Our platform uses artificial intelligence to provide personalized care recommendations. This section explains how AI is used and your rights regarding automated processing. AI analyzes family assessment responses to identify care needs and areas where family members may have different perspectives. It generates evidence-based recommendations for elder care services and approaches, provides estimated costs of care based on location, needs and current market data, and creates personalized reports summarizing findings and recommendations.

Family alignment analyses and Care Forecast Reports that include a clinician visit are reviewed by a person before release. The professional assigned to your file reads the analysis, applies their professional judgment, and may modify, supplement, reframe, or set aside any AI-generated finding before it reaches you.

One product works differently: a Care Forecast Report purchased on its own, without a clinician visit, is produced with automated checks and delivered without professional review. It is educational information rather than professional advice.

Where a professional is involved, the AI is a tool that surfaces patterns and drafts recommendations at scale. The professional is the one who decides what those findings mean for your specific family and how they should be communicated. Final responsibility for the advice rests with the professional.

You have the following rights regarding AI processing.

• You must explicitly consent to AI processing when submitting an assessment.
• You may withdraw consent for AI processing at any time.
• You may request an explanation of how AI conclusions were reached.
• You may request human-only review of your assessment.
• You may challenge and correct inaccurate AI conclusions.

Assessment data sent to AI systems is transmitted securely using TLS 1.3 encryption, is not used to train AI models without additional consent, is subject to Google's AI data handling policies, and is retained by Google for a limited period as specified in their terms.

9. International data transfers

ElderCare Concierge is a Canadian company. Some of the third-party service providers we use to operate our platform are located outside Canada, in the United States and the European Union. When your personal information is transferred to those providers, it may be processed and stored in those countries, which have different privacy laws than Canada.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), we remain accountable for personal information we transfer to third-party processors. We require our US-based service providers to protect your information through contractual commitments that provide a level of privacy protection comparable to Canadian law. The primary destinations for international data transfers are the United States, for Stripe Inc. (payments) and WorkOS Inc. (authentication), and the European Union, for PostHog (product analytics and session replay) and Brevo (transactional email). Application hosting, databases, and AI analysis run on Google Cloud in Canadian regions (Toronto and Montréal). Google LLC is a US company, so information it processes for us may be subject to US legal process even when it is stored in Canada.

There is one exception to AI analysis staying in Canada. When Google's Montréal region is too busy to write a Care Forecast Report, we retry in Montréal, then make one attempt through Google's global service, which may process the assessment in any country where Google operates data centres, including the United States. Your stored information stays in Canada either way; only that one generation request leaves. A report generated this way says so in its record. If the global attempt fails too, nothing is generated and you or your clinician can try again later.

If you are a Quebec resident, Quebec's Act respecting the protection of personal information in the private sector (Law 25) applies to you. Before transferring your personal information outside Quebec, we conduct a privacy impact assessment to confirm that the destination provides an adequate level of protection. The destinations for international transfers are the United States and the European Union, and, for a Care Forecast Report generated through Google's global service as described above, any country where Google operates data centres. You may contact our Privacy Officer for information about these assessments.

By creating an account or submitting an assessment, you are informed that some of your personal information will be processed in the United States (payments and authentication) and some in the European Union (email and analytics), and that your assessment may be processed in any country where Google operates data centres when a Care Forecast Report is generated through Google's global service, as described in this section. If you have questions or concerns about international transfers, please contact our Privacy Officer before using the Service.

10. Children's privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we discover that we have collected information from a child under 18, we will delete it immediately.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately at support@eldercareconcierge.ca.

While our platform focuses on eldercare, assessment information may include details about adult children and their relationships with elderly family members. Such information is collected only with appropriate consent from adults.

11. Canadian residents

If you are a Canadian resident, you have additional rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. We collect personal information only for purposes that a reasonable person would consider appropriate. We obtain your consent before collecting, using or disclosing personal information, we limit collection to information necessary for identified purposes, and we use personal information only for the purposes for which it was collected.

• You have the right to know what personal information we have about you.
• You have the right to access your personal information.
• You have the right to correct inaccuracies in your personal information.
• You have the right to withdraw consent, subject to legal and contractual restrictions.
• You have the right to file a complaint with the Privacy Commissioner of Canada.

If you have concerns about our privacy practices, please contact us first. If you are not satisfied with our response, you may file a complaint with the Privacy Commissioner of Canada at www.priv.gc.ca.

12. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this policy, notify you through email or platform notifications for material changes, provide a summary of changes for significant updates, obtain your consent if required by applicable law, and maintain previous versions for reference.

Your continued use of our Service after changes take effect constitutes acceptance of the revised Privacy Policy. If you do not agree to the changes, you should discontinue use of our Service.

For material changes that significantly affect how we use your personal information, we will provide at least 30 days advance notice and may require your explicit consent.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us. Our Privacy Officer can be reached by email at privacy@eldercareconcierge.ca. General support is available at support@eldercareconcierge.ca and by phone at (844) 977-0050. Our mailing address is:

ElderCare Concierge Inc.
Attention: Privacy Officer
302 Bay Street
Toronto, ON M5H 0B6
Canada

If you are not satisfied with our response to your privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, by phone at 1-800-282-1376, or by mail at 30 Victoria Street, Gatineau, QC K1A 1H3.

We respond to general inquiries within 5 business days and to privacy rights requests within 30 days. Data breach notifications are made as required by law, and urgent security matters are handled within 24 to 48 hours.

When contacting us about privacy matters, please include your full name and the email address associated with your account, a clear description of your request or concern, any relevant account or transaction information, and your preferred method of response. We are committed to addressing your privacy concerns promptly and transparently.