Privacy policy

Who we are

The service is operated by [ registered legal entity name ], at [ registered business address ], Newfoundland and Labrador, Canada. Privacy questions go to [ privacy contact email ]. That address reaches the person responsible for our compliance with this policy.

What the service stores

Resident records. Names, photographs, room numbers, dates of birth, health-care numbers, care plans, medication records, daily care and welfare-check logs, incident and fall reports, weights, uploaded documents, and billing arrangements.

Family, emergency and payer contacts. The names and contact details of the people a facility lists for a resident — family members, substitute decision-makers, emergency contacts, and whoever pays the resident’s account — and, for payers, the billing details the facility records.

Staff records. Names, contact details, photographs, role and permissions, schedules, clock-in and clock-out records, training, pay rates, tax withholding details, pay statements and — where a facility runs payroll through the service — social insurance numbers and bank account details.

Clock-in photographs. Where a facility uses the shared clock-in kiosk, the kiosk takes a photograph of the person clocking in and attaches it to that clock-in record so a manager can confirm who it was. The photograph is used for that check only. It is not used to recognise faces automatically, and no biometric template is made from it. The kiosk does not record location.

Account and usage. Sign-in credentials, two-factor settings, the date and time of sign-ins, and audit records of sensitive actions — for example revealing a health-care number, viewing bank details, or changing someone’s permissions. An audit record names the person who acted, what they did, when, and the network address and browser it came from.

Assistant conversations and memory. What you type to the AI assistant, its replies, and — if you leave assistant memory switched on — short notes it keeps about your preferences so it can pick up where you left off. You can turn memory off and clear it from your own profile page.

Diagnostics. When something goes wrong in the service we record the error, the page it happened on, the version of the app, your browser type and, if you were signed in, your account, so we can fix it. Error records are not used for anything else.

How it is used

To operate the facility: showing care staff what a resident needs, recording what was done, building schedules, running payroll, sending the notifications a facility turns on, and producing the reports an operator or a regulator asks for. We also use records in aggregate, with names removed, to keep the service secure and to understand how its features are used. We do not sell personal information, we do not share it with anyone for their own marketing, and we do not use resident, family or staff records to advertise anything.

Care records, clock-in records and audit logs are collected for care, payroll and security respectively. We do not use them for any other purpose without telling the facility first.

Artificial intelligence

The service includes an AI assistant and background agents that summarise, draft and flag things for attention. Content sent to them is processed by Anthropic as our service provider, under terms that prohibit using it to train their models, and is not retained by them beyond what is needed to return a response. Anything an agent produces that would reach a person or change a record is proposed for a manager to approve, edit or decline; nothing is published or written automatically. No decision with a legal or similarly significant effect on a resident or a staff member is made by the AI alone.

Who can see what

Access inside a facility is governed by the role its administrators assign. Roles gate every screen and every action, and the database enforces facility boundaries independently of the application, so one facility’s records are not reachable from another. Health-care numbers and bank details are masked by default, and revealing one is recorded against the person who did it.

Our own staff see a facility’s records only to support that facility at its request, to investigate a security or reliability problem, or where the law requires it. We will disclose information to a court, regulator or law enforcement only where legally compelled, and we will tell the facility unless the law forbids it.

Service providers

We use a small number of processors to run the service, each bound by a written agreement to use the data only to provide their service to us:

• Supabase — database, authentication and file storage. Hosted in [ Supabase project region ].
• Render — application hosting. Hosted in [ Render service region ].
• Anthropic — the AI assistant described above. United States.
• Resend — transactional email: sign-in links, invitations, notifications a facility turns on, and account notices. United States.
• Cloudflare Turnstile — protects sign-up and sensitive account changes from automated abuse. It sees your network address and browser characteristics for that check only.
• Google Places — address autocomplete when an address is typed into a form. Only the characters you type into an address field are sent, from our server, so Google does not see who you are. Where a facility has not enabled it, OpenStreetMap’s Photon geocoder is used instead.
• VoPay — payroll payments, where a facility uses them. Canada.

Some of these providers are outside Canada, so some information — assistant conversations, email addresses and the contents of emails, and address searches — may be stored or processed outside Canada, where it is subject to the laws of that country. We give facility administrators notice before adding a provider that would handle resident or staff records.

Cookies

The service sets only the cookies it needs to work: one that keeps you signed in, one that records when you were last active so an idle session can be signed out after 15 minutes, one that remembers your light or dark theme, and one that remembers your time zone. None of them is used for advertising or to follow you across other sites, and we run no third-party analytics or tracking scripts.

How long it is kept

Records are retained for as long as the facility’s account is active and for the period its regulator requires afterwards. For a personal care home in Newfoundland and Labrador that is 15 years for resident records and 7 years for administrative and staff records, which is what the service applies by default. A facility can set a longer period in its settings to match its own regulator. The service refuses to permanently delete a record before its retention period has ended; once it has, an administrator can delete it, and that deletion is audit-logged.

Deleting an account or a facility. Both are self-service and both run on a schedule rather than at the press of a button. For 30 days the request can be undone by the person who made it; for 30 days after that only our support can restore it; after 60 days the data is permanently deleted, subject to the retention period above for care records that are still owed. A facility being deleted goes read-only for the whole window so its records can still be read and exported. Deleting your own account never deletes a facility. Audit records of the deletion itself are kept.

Export. A facility can export everything it holds, at any time, from its settings.

Your rights

Under the Personal Health Information Act (Newfoundland and Labrador), the Personal Information Protection and Electronic Documents Act, and the equivalent laws of other provinces, you may ask what personal information is held about you, ask for it to be corrected, withdraw consent where consent is the basis for holding it, and complain about how it has been handled. Residents, families and staff should raise these with their facility, which holds the records; we will support the facility in answering within the time the law allows. If you are not satisfied you may complain to the Office of the Information and Privacy Commissioner of Newfoundland and Labrador, to the Office of the Privacy Commissioner of Canada, or to the privacy commissioner for your own province.

The service is for facilities and the adults who work in and are cared for by them. It is not directed at children, and we do not knowingly collect information from anyone under 18 except as part of a resident’s record entered by a facility.

Security

Access requires a password and, for privileged roles, a second factor. Sessions sign out after 15 minutes idle. Sensitive fields are masked in the interface and unmasking is audit-logged. Traffic is encrypted in transit and data is encrypted at rest by our hosting providers. Payroll bank details are held only for the purpose of paying staff. No system is perfect: if a breach creates a real risk of significant harm to you, we will notify the facility without undue delay so that it can notify you and the Commissioner, and we will notify the Privacy Commissioner of Canada ourselves where the law requires it.

Changes

If this policy changes materially we will tell facility administrators before the change takes effect. The date at the top of this page is when it was last revised.