Data Processing Terms

Last updated: July 7, 2026

These Data Processing Terms (“DPT”) form part of the agreement between each subscriber (the “Subscriber” — the organization accountable for client personal information) and Cybercana Consulting Inc. (“Cybercana” — the service provider processing that information to deliver the Clientaly platform).

Roles

The Subscriber determines the purposes of collecting client personal information (including health-related information gathered for insurance purposes) and is the accountable organization under PIPEDA and applicable provincial law. Cybercana processes that information solely to provide, secure, support, and improve the platform, on the Subscriber’s documented instructions, and for no other purpose.

Safeguards

Cybercana maintains safeguards appropriate to the sensitivity of the information, including: Canadian data residency (AWS ca-central-1), encryption in transit and at rest, tenant isolation enforced at the database layer (row-level security), role-based access control, logged access to health-related records, multi-factor authentication capability, account-lockout controls, and audit logging of data changes.

Sub-processors

Current sub-processors: Supabase (database and authentication hosting), Vercel (application hosting), Stripe (payment processing), and Google (only for Subscribers who connect Gmail/Calendar). Cybercana will give notice before adding sub-processors that materially change how client information is handled.

Breach notification

Cybercana will notify affected Subscribers without unreasonable delay after confirming a breach of security safeguards affecting their tenant data, and will provide information reasonably required for the Subscriber to meet its own reporting obligations to the Office of the Privacy Commissioner of Canada and affected individuals. Cybercana keeps records of all breaches for at least 24 months.

Assistance with individual rights

The platform provides tools for the Subscriber to fulfil client access, correction, and consent-withdrawal requests, including per-client data export. Cybercana will provide reasonable additional assistance on request.

Return and deletion

On termination, the Subscriber may export tenant data within 60 days. Thereafter Cybercana will delete or anonymize tenant data on request, except where retention is required by law, subject to backup cycles that expire on a rolling basis.

Audit

Cybercana will, on reasonable notice and not more than annually, respond to Subscriber security questionnaires and provide summaries of its safeguards sufficient for the Subscriber’s compliance and E&O requirements.

Questions about these terms: privacy@clientaly.com