Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, professional credentials, company information
• Profile Information: Professional bio, certifications, areas of expertise, profile photos
• Family Assessment Data: Information about family members, care needs, living situations, relationships, and care preferences
• Communication Data: Messages, feedback, survey responses, and other communications with us
• Payment Information: Billing address and payment method details (processed securely through Stripe)
• Support Information: Information provided when you contact customer support

1.2 Information Collected Automatically

When you use our Service, we automatically collect certain information, including:

• Usage Information: Pages viewed, features used, time spent on platform, interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Location Information: General geographic location based on IP address
• Log Information: Server logs, error reports, performance data
• Cookies and Similar Technologies: Information collected through cookies, web beacons, and similar tracking technologies

1.3 Information from Third Parties

We may receive information from third-party sources, including:

• Authentication Providers: Information from WorkOS and other authentication services
• Payment Processors: Transaction information from Stripe
• Professional Networks: Publicly available professional information
• Analytics Providers: Usage analytics and performance data

2. How We Use Your Information

We use the information we collect for various purposes, including:

2.1 Service Provision

• Creating and managing your account
• Facilitating connections between advisors and families
• Processing family assessments and generating AI-powered analyses
• Creating personalized care reports and recommendations
• Processing payments and managing billing
• Providing customer support and responding to inquiries

2.2 Platform Improvement

• Analyzing usage patterns to improve our services
• Developing new features and functionality
• Conducting research and analytics
• Testing new services and features
• Monitoring platform performance and reliability

2.3 Communication and Marketing

• Sending service-related communications and updates
• Providing educational content and resources
• Sending marketing communications (with your consent)
• Notifying you about platform changes or new features
• Conducting surveys and collecting feedback

2.4 Legal and Security

• Complying with legal obligations and requests
• Protecting against fraud, abuse, and security threats
• Enforcing our terms of service and policies
• Resolving disputes and investigating violations
• Maintaining audit trails and compliance records

3. Information Sharing and Disclosure

We may share your information in the following circumstances:

3.1 With Your Consent

We share information when you explicitly consent to such sharing, including connecting you with advisors or sharing assessment results with family members you designate.

3.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform:

• Payment Processing: Stripe Inc. (USA) for secure payment processing. Your payment information is transmitted directly to Stripe and subject to their privacy policy.
• Authentication: WorkOS Inc. (USA) for secure user authentication using OAuth 2.0 and single sign-on.
• AI Analysis: Google Gemini, accessed through Vertex AI (Google LLC), for generating care recommendations and analysis. This processing runs in Google Cloud's Canadian regions; Google LLC is a US company (see Section 9). Assessment responses are processed by Google's AI systems to provide personalized insights. Important: By submitting an assessment, you consent to this AI processing.
• Cloud Infrastructure: Google Cloud Platform for application hosting and databases, running in Canadian regions (Toronto and Montréal).
• Analytics: PostHog (hosted in the European Union) for product analytics and session replay to understand how the platform is used and where users encounter difficulty. Analytics is only enabled after you grant consent through our cookie banner, and we configure session recordings to mask all form inputs and answers so the content you type is never captured.
• Communication: Brevo (European Union) for transactional email

3.3 Platform Users

Within our platform, we may share certain information:

• Advisor profiles and credentials with families seeking services
• Assessment results and reports with authorized family members
• Communication between advisors and families through our platform
• Aggregated, anonymized data for research and improvement purposes

3.4 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process, court orders, or government requests
• Protect against fraud, security threats, or illegal activities
• Enforce our terms of service or other agreements
• Protect the rights, property, or safety of our users or the public
• Investigate and defend against legal claims

3.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and any changes to this Privacy Policy.

4. Data Security

We implement comprehensive security measures to protect your personal information:

4.1 Technical Safeguards

• Encryption: Data encrypted in transit and at rest using industry-standard protocols
• Access Controls: Role-based access controls and multi-factor authentication
• Network Security: Firewalls, intrusion detection, and secure network architecture
• Regular Updates: Security patches and system updates applied promptly
• Monitoring: Continuous monitoring for security threats and vulnerabilities

4.2 Administrative Safeguards

• Employee Training: Regular security and privacy training for all staff
• Access Management: Strict access controls and regular access reviews
• Incident Response: Comprehensive incident response and breach notification procedures
• Vendor Management: Due diligence and security requirements for all vendors
• Policy Compliance: Regular compliance audits and policy updates

4.3 Physical Safeguards

• Secure data centers with physical access controls
• Environmental controls and monitoring
• Secure disposal of storage media
• Background checks for personnel with data access

While we implement strong security measures, no system is completely secure. We cannot guarantee the absolute security of your information. You can help protect your account by using a strong password and not sharing your login credentials.

5. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes described in this Privacy Policy:

5.1 Active Accounts

• Account Information: Retained while your account is active and for a reasonable period thereafter
• Assessment Data: Retained to maintain service continuity and historical records
• Communication Records: Retained for customer service and legal compliance purposes
• Usage Data: Retained for analytics and service improvement (typically 2-3 years)

5.2 Account Deletion

When you delete your account or request data deletion, we will delete your personal information within 30 days, except where retention is required for legal, regulatory, or legitimate business purposes. Some anonymized, aggregated data may be retained for analytical purposes.

5.3 Legal Requirements

We may retain information longer when required by law, to comply with legal obligations, resolve disputes, enforce agreements, or protect our legal rights.

6. Your Privacy Rights

You have various rights regarding your personal information, subject to applicable law:

6.1 Access and Portability

• Request access to your personal information
• Receive a copy of your data in a portable format
• View your account information and settings
• Download your assessment data and reports

6.2 Correction and Updates

• Update your account and profile information
• Correct inaccurate personal information
• Complete incomplete information
• Request correction of assessment data

6.3 Deletion

• Delete your account and associated data
• Request deletion of specific information
• Opt-out of marketing communications
• Withdraw consent for data processing

6.4 Objection and Restriction

• Object to certain types of data processing
• Restrict how we use your information
• Opt-out of automated decision-making
• Limit data sharing with third parties

6.5 Exercising Your Rights

To exercise these rights, contact us at support@eldercareconcierge.ca or through your account settings. We will respond to your request within 30 days. We may need to verify your identity before processing certain requests.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform:

7.1 Types of Cookies

• Essential Cookies: Required for platform functionality, authentication, and security
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our platform
• Performance Cookies: Monitor platform performance and user experience

7.2 Managing Cookies

You can control cookies through your browser settings or our cookie preference center. Disabling certain cookies may limit platform functionality. Essential cookies cannot be disabled as they are necessary for security and basic operation.

7.3 Third-Party Tracking

Our platform may include third-party cookies from our service providers (Stripe, WorkOS, analytics providers). These third parties have their own privacy policies governing their use of your information.

8. Third-Party Services

Our platform integrates with several third-party services:

8.1 Payment Processing

We use Stripe to process payments. Stripe has access to payment information necessary to process transactions. Stripe's privacy policy governs their use of your payment information.

8.2 Authentication

We use WorkOS for secure authentication and single sign-on. WorkOS processes authentication information according to their privacy policy.

8.3 Analytics and Performance (PostHog)

We use PostHog, a product-analytics service, to understand how people use our platform and to improve it. PostHog data is processed and stored in the European Union. Specifically:

• Analytics is off by default and only begins after you accept analytics cookies in our consent banner; you can withdraw consent at any time, which stops collection and clears the related cookies.
• We capture page views and product events (for example, which assessment question or report section you reached) together with technical metadata. We do not send your assessment answers, report content, or written feedback to PostHog.
• Session replay is configured to mask all form fields and answer content, so recordings show interaction patterns without revealing what you typed.
• PostHog acts as our data processor under a Data Processing Agreement and honours Do-Not-Track / Global Privacy Control signals.

8.4 Artificial Intelligence (Google Gemini)

We use Google Gemini AI to analyze assessment data and generate personalized care recommendations. When you submit an assessment:

• Your assessment responses are sent to Google's Gemini API for analysis
• The AI generates insights about care needs, family alignment, and recommendations
• Google processes this data according to their AI/ML Terms of Service
• Data sent to Google may be processed in the United States

8.5 Links to Other Sites

Our platform may contain links to other websites. We are not responsible for the privacy practices of external sites. We encourage you to review the privacy policies of any sites you visit.

8A. AI and Automated Decision-Making

Our platform uses artificial intelligence to provide personalized care recommendations. This section explains how AI is used and your rights regarding automated processing.

8A.1 How We Use AI

• Assessment Analysis: AI analyzes family assessment responses to identify care needs and areas where family members may have different perspectives
• Care Recommendations: AI generates evidence-based recommendations for elder care services and approaches
• Cost Estimates: AI provides estimated costs of care based on location, needs, and current market data
• Report Generation: AI creates personalized reports summarizing findings and recommendations

8A.2 Human Oversight

Family alignment analyses and Care Forecast Reports that include a clinician visit are reviewed by a person before release. The professional assigned to your file reads the analysis, applies their professional judgment, and may modify, supplement, reframe, or set aside any AI-generated finding before it reaches you.

One product works differently: a Care Forecast Report purchased on its own, without a clinician visit, is produced with automated checks and delivered without professional review. It is educational information rather than professional advice.

Where a professional is involved, the AI is a tool that surfaces patterns and drafts recommendations at scale. The professional is the one who decides what those findings mean for your specific family and how they should be communicated. Final responsibility for the advice rests with the professional, not the system.

8A.3 Your Rights Regarding AI Processing

• Consent: You must explicitly consent to AI processing when submitting an assessment
• Withdrawal: You may withdraw consent for AI processing at any time
• Explanation: You may request an explanation of how AI conclusions were reached
• Human Review: You may request human-only review of your assessment
• Correction: You may challenge and correct inaccurate AI conclusions

8A.4 Data Handling

Assessment data sent to AI systems is:

• Transmitted securely using TLS 1.3 encryption
• Not used to train AI models without additional consent
• Subject to Google's AI data handling policies
• Retained by Google for a limited period as specified in their terms

9. International Data Transfers

ElderCare Concierge is a Canadian company. Some of the third-party service providers we use to operate our platform are located outside Canada — in the United States and the European Union. When your personal information is transferred to those providers, it may be processed and stored in those countries, which have different privacy laws than Canada.

9.1 Our Accountability

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), we remain accountable for personal information we transfer to third-party processors. We require our US-based service providers to protect your information through contractual commitments that provide a level of privacy protection comparable to Canadian law.

The primary destinations for international data transfers are:

• United States: Stripe Inc. (payments), WorkOS Inc. (authentication)
• European Union: PostHog (product analytics and session replay), Brevo (transactional email)

Application hosting, databases, and AI analysis run on Google Cloud in Canadian regions (Toronto and Montréal). Google LLC is a US company, so information it processes for us may be subject to US legal process even when it is stored in Canada.

9.2 Quebec Residents

If you are a Quebec resident, Quebec's Act respecting the protection of personal information in the private sector (Law 25) applies to you. Before transferring your personal information outside Quebec, we conduct a privacy impact assessment to confirm that the destination provides an adequate level of protection. The destinations for international transfers are the United States and the European Union. You may contact our Privacy Officer for information about these assessments.

9.3 Notification

By creating an account or submitting an assessment, you are informed that some of your personal information will be processed in the United States (payments and authentication) and some in the European Union (email and analytics), as described in this section. If you have questions or concerns about international transfers, please contact our Privacy Officer before using the Service.

10. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we discover that we have collected information from a child under 18, we will delete it immediately.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately at support@eldercareconcierge.ca.

While our platform focuses on eldercare, assessment information may include details about adult children and their relationships with elderly family members. Such information is collected only with appropriate consent from adults.

11. Canadian Residents

If you are a Canadian resident, you have additional rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws:

11.1 Collection and Use

• We collect personal information only for purposes that a reasonable person would consider appropriate
• We obtain your consent before collecting, using, or disclosing personal information
• We limit collection to information necessary for identified purposes
• We use personal information only for the purposes for which it was collected

11.2 Your Rights

• Right to know what personal information we have about you
• Right to access your personal information
• Right to correct inaccuracies in your personal information
• Right to withdraw consent (subject to legal and contractual restrictions)
• Right to file a complaint with the Privacy Commissioner of Canada

11.3 Complaints

If you have concerns about our privacy practices, please contact us first. If you are not satisfied with our response, you may file a complaint with the Privacy Commissioner of Canada at www.priv.gc.ca.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you through email or platform notifications for material changes
• Provide a summary of changes for significant updates
• Obtain your consent if required by applicable law
• Maintain previous versions for reference

Your continued use of our Service after changes take effect constitutes acceptance of the revised Privacy Policy. If you do not agree to the changes, you should discontinue use of our Service.

12.1 Material Changes

For material changes that significantly affect how we use your personal information, we will provide at least 30 days advance notice and may require your explicit consent.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

13.1 Response Times

• General inquiries: 5 business days
• Privacy rights requests: 30 days
• Data breach notifications: As required by law
• Urgent security matters: 24-48 hours

13.2 What to Include

When contacting us about privacy matters, please include:

• Your full name and email address associated with your account
• A clear description of your request or concern
• Any relevant account or transaction information
• Your preferred method of response

We are committed to addressing your privacy concerns promptly and transparently. Thank you for trusting ElderCare Concierge with your personal information.