Data Processing Terms

These Data Processing Terms (“DPT”) form part of the agreement between each subscriber (the “Subscriber” — the organization accountable for client personal information) and Cybercana Consulting Inc. (“Cybercana” — the service provider processing that information to deliver the Clientaly platform). They are subject to the Terms of Service.

Roles

The Subscriber determines the purposes of collecting client personal information (including health-related information gathered for insurance purposes) and is the accountable organization under PIPEDA and applicable provincial law. Cybercana processes that information solely to provide, secure, support, and improve the platform, on the Subscriber’s documented instructions, and for no other purpose. Cybercana does not sell personal information and does not use client records for advertising or to train models.

Subscriber obligations

The Subscriber warrants that it has the legal right and all necessary consents to collect, store and transmit the personal information it places in the platform, that its instructions comply with applicable law, and that it will honour access, correction and withdrawal requests from its own clients. The Subscriber is responsible for determining that the platform is appropriate for the sensitivity of the information it chooses to store.

Sending of client communications

The Subscriber is the sender of every message addressed to its own clients, including quotes, marketing and review invitations, and is responsible for holding valid consent under Canada’s Anti-Spam Legislation. Cybercana provides the sending tools, records consent and withdrawals, applies suppression lists, and includes sender identification and an unsubscribe mechanism in commercial messages. Cybercana does not send commercial messages to the Subscriber’s clients on its own behalf.

Scope

The platform is provided for use in Ontario, British Columbia, Alberta, Manitoba, Saskatchewan, Nova Scotia, New Brunswick, Prince Edward Island, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut. Processing is subject to PIPEDA and, where the Subscriber operates in British Columbia or Alberta, to those provinces' Personal Information Protection Acts.

The platform is not provided for use in Quebec. It is not designed to meet requirements applicable to the personal information of Quebec residents under the Act respecting the protection of personal information in the private sector, as amended by Law 25, and the Subscriber will not use it to manage clients resident in Quebec.

Safeguards

Cybercana maintains safeguards appropriate to the sensitivity of the information, including: Canadian data residency (AWS ca-central-1), encryption in transit and at rest, tenant isolation enforced at the database layer (row-level security), role-based access control, logging of health-record access through the platform’s compliance and export tools, multi-factor authentication capability, account-lockout controls, and audit logging of data changes. Safeguards evolve; Cybercana will not materially reduce the overall level of protection during the subscription term.

Personnel and confidentiality

Access within Cybercana is limited to personnel who require it to operate and support the service, who are bound by confidentiality obligations that survive the end of their engagement.

Sub-processors

Current sub-processors: Supabase (database and authentication hosting), Vercel (application hosting), Stripe (payment processing), PurelyMail (transactional email such as account, billing and invitation messages), and Google (only for Subscribers who connect Gmail/Calendar). Cybercana will give at least 30 days’ notice before adding a sub-processor that materially changes how client information is handled. A Subscriber who objects on reasonable data-protection grounds may terminate the affected service on notice before the change takes effect, as its sole remedy; fees for the unused portion of the term will be refunded.

Breach notification

Cybercana will notify affected Subscribers without unreasonable delay, and in any event within 72 hours, after confirming a breach of security safeguards affecting their tenant data, and will provide information reasonably required for the Subscriber to meet its own reporting obligations to the Office of the Privacy Commissioner of Canada and affected individuals. Determining whether a breach creates a real risk of significant harm, and making any report to a regulator or to individuals, remains the Subscriber’s responsibility as the accountable organization. Cybercana keeps records of all breaches for at least 24 months.

Assistance with individual rights

The platform provides tools for the Subscriber to fulfil client access, correction, and consent-withdrawal requests, including per-client data export. Cybercana will provide reasonable additional assistance on request; assistance beyond routine support may be charged at Cybercana’s then-current rates.

Return and deletion

On termination, the Subscriber may export tenant data within 60 days. Thereafter Cybercana will delete or anonymize tenant data within 90 days of a written request, except where retention is required by law or for the establishment or defence of legal claims, and subject to backup cycles that expire on a rolling basis and are not individually addressable.

Audit

Cybercana will, on reasonable notice and not more than once in any twelve-month period, respond to Subscriber security questionnaires and provide summaries of its safeguards sufficient for the Subscriber’s compliance and E&O requirements. On-site or third-party audits are not included; where a Subscriber reasonably requires one, the parties will agree scope and the Subscriber will bear the cost.

Liability

Liability arising under or in connection with these Data Processing Terms is subject to the limitations and exclusions in the Terms of Service, which apply to the agreement as a whole and are not increased or duplicated by these terms. The Subscriber’s indemnity in the Terms of Service applies to claims arising from personal information it places in the platform.

Questions about these terms: privacy@clientaly.com — Privacy Officer: Iqbal Mann, Cybercana Consulting Inc.