How Xorvya handles personal information.
This statement explains how 1001491084 Ontario Inc. operating as Xorvya collects, uses, discloses, protects, and retains personal information.
1001491084 Ontario Inc. operating as Xorvya ("Xorvya") and its affiliates (collectively, "we", "our" or "us") recognize the importance of privacy. The purpose of this privacy statement ("Privacy Statement") is to inform you about our privacy practices, including how we collect, use and disclose your Personal Information.
This Privacy Statement applies to all of our operations in Canada or operations in connection with Canada, unless we have provided you with a separate privacy statement for a particular product, service or activity.
Privacy Statement Updates
This Privacy Statement is current as of the "updated" date which appears at the top of this page. We may make changes to this Privacy Statement from time to time, which will become immediately effective when published in a revised Privacy Statement posted on our website unless otherwise noted. We may also communicate the changes through our services or by other means.
Please review this Privacy Statement carefully. By submitting your Personal Information to us, by registering for or using any of the services we offer, by using our website, or by voluntarily interacting with us, you consent to our collecting, using and disclosing your Personal Information as set out in this Privacy Statement, as revised from time to time.
Meaning of Personal Information
"Personal Information" means information about an identifiable individual as described under Canadian privacy laws, which may include, but is not limited to, your name, e-mail address and telephone number. Personal Information does not include any business contact information that is solely used to communicate with you in relation to your employment, business or profession, such as your name, position name or title, work address, work telephone number, or work e-mail address. Personal Information also does not include information that has been anonymized or aggregated in such a way that there is no serious possibility it can be used to identify an individual, whether on its own or in combination with other information.
Your Consent to Collection, Use and Disclosure
We collect, use and disclose your Personal Information with your consent or as permitted or required by Canadian privacy laws. How we obtain your consent may be express or implied and will depend on the circumstances, as well as the sensitivity of the information collected. If you choose to provide Personal Information to us, we assume that you consent to the collection, use and disclosure of that Personal Information as outlined in this Privacy Statement.
If you wish to withdraw your consent to our collection, use or disclosure of your Personal Information, please contact us using the contact information in the "How to Contact Us" section below at privacy@xorvya.com and we will respond within 30 days. In some cases, withdrawal of your consent may mean that we will no longer be able to provide certain products or services.
Personal Information We Collect
Products and Services. For individuals located in Canada, we may collect information from you or from your use of our products or services. Xorvya operates as a service provider/processor to its customer organizations, and those customer organizations remain responsible for determining what information to enter into the platform and for meeting their own regulatory obligations.
We collect account information for authorized users that you submit through your use of our products or services, such as name, job title, email address, phone number and other professional contact.
We collect operational incident data that authorized users enter into the platform, such as incident descriptions, event dates and times, names of employees involved or witnesses, corrective actions, investigation notes, and close-out records. Free-text incident fields may include personal health information about residents, such as descriptions of falls, behavioural events, or medication-related incidents.
We may automatically collect usage and log data that is identifiable with you when you use our products and services, including login timestamps, session identifiers, actions taken within the platform, and related audit trail metadata.
We may aggregate and anonymize certain data collected in connection with your use of our products and services, which is not considered to be Personal Information and may be stored and used separately from the data and Personal Information referred to above.
Website. For individuals located in Canada who visit our website located at xorvya.com or any of our related websites (collectively, "our website"), we may collect information from you or from your activities on the site.
Like most websites and other Internet services, we may collect certain technical and device information about your use of our website, which may include your Internet protocol address, information about your device, browser and operating system, and the date and time of your visit, as well as the region or general location where your device is accessing the internet, and other information about the usage of our website, including a history of the pages you view.
We use essential and functional cookies for purposes such as authentication, CSRF protection, and storing roles and preferences. We also use website analytics, including analytics cookies or similar technologies, to help us understand how visitors use our website, which pages are viewed, and how the site performs. We do not currently use advertising cookies.
If you enter information in the "Contact Us" section, we collect your name, email address, company you represent and details of your inquiry to enable us to respond to a general inquiry made by you.
How We Use Your Personal Information
We may use your Personal Information for purposes such as:
- Account administration and access control, including account creation, identity verification/authentication, and authorized-user management.
- Provide, operate, maintain, and improve our products and services, including usage monitoring, troubleshooting, system integrity, service improvement, and audit trails.
- Communicate with you about your account and our products and services, including responding to inquiries/requests, and sending administrative messages, service notices, and updates.
- Customer insights and research, including analyzing customer needs and activities, collecting feedback, and generating de-identified data for business, product, and service research and analysis.
- Marketing and promotional communications, including developing marketing materials and providing information we think may interest you about our products and services.
- Operational incident management, including incident documentation, investigation, corrective action assignment, and close-out workflows.
- Operational and regulatory reporting, including generating documents and reports for compliance and operational purposes, such as WSIB Form 7, OHSA s. 51 notifications, RHRA reports, and JHSC reports.
- Optional AI-assisted drafting features, where enabled by a customer, with human review before submission and customer ability to disable the feature.
- Billing and payments, including invoicing and payment processing when live.
- Security and fraud prevention, including detecting, preventing and responding to fraud, abuse, and security incidents.
- Legal and compliance, including investigating legal claims and complying with applicable legal requirements.
We may use your Personal Information for purposes for which we have obtained your consent, and for such other purposes as may be permitted or required by applicable Canadian privacy laws. We process information received through our website to respond to your queries, establish communication with you and your company, and to support and improve our services.
Opting Out of Communications
If you have opted in to receive emails from us and you no longer want to receive non-essential communications, such as marketing-related emails, if any, you may opt-out of receiving emails by clicking the "unsubscribe" link at the bottom of any email you receive from us. You may also opt-out by contacting us directly using the contact information in the "How to Contact Us" section below.
We will endeavour to respond to your opt-out request promptly, but we ask that you please allow us a reasonable time to process your request. Please note that if you opt-out from receiving non-essential communications, such as marketing-related emails, if any, we may still need to send you communications about your use of our products or services, or other matters.
Retention of Personal Information
We will use, disclose or retain your Personal Information only for as long as necessary to fulfill the purposes for which that Personal Information was collected and as permitted or required by Canadian privacy laws.
In general, we retain account data for the duration of a subscription. Unless otherwise required by law, incident packs and related records are retained for 7 years after incident closure, user account data is deleted within 60 days of termination or cancellation, system logs are retained for approximately 12 months, and payment and tax records are retained for 7 years.
International Transfer and Storage of Information
Your Personal Information may be stored and processed at our offices in Canada or at the offices of our third party service providers. Other jurisdictions may have different data protection rules than Canada. While your Personal Information is outside of Canada, it is subject to the laws of the country in which it is located. Those laws may require disclosure of your Personal Information to authorities in that country. Primary storage is in Canada. Limited exceptions may include optional AI processing, optional speech-to-text processing, certain cloud infrastructure services, website analytics, and operational SaaS providers, such as email delivery or payment processing, that may involve processing of limited metadata outside Canada. For written information about our policies and practices regarding service providers outside of Canada, contact our Privacy Officer at the email address below.
Information Security
We have implemented physical, organizational, contractual and technological security measures with a view to protecting your Personal Information and other information from loss or theft, unauthorized access, disclosure, copying, use or modification. We have taken steps to ensure that the only personnel who are granted access to your Personal Information are those with a business "need-to-know" or whose duties reasonably require such information.
Despite the measures outlined above, no method of information transmission or information storage is 100% secure or error-free, so we unfortunately cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, for example, if you feel that the security of any information that you provided to us has been compromised, please contact us immediately using the contact information in the "How to Contact Us" section below. If we become aware of a breach of security safeguards involving Personal Information, we will notify affected customer organizations promptly and provide available information regarding the incident and mitigation steps, as required by applicable law.
Accessing and Updating Your Personal Information
We expect you, from time to time, to supply us with updates to your Personal Information, when required. We will not routinely update your Personal Information, unless such a process is necessary.
You may make a written request to review any Personal Information about you that we have collected, used or disclosed, and we will provide you with any such Personal Information to the extent required by applicable laws. You may also challenge the accuracy or completeness of your Personal Information in our records. If you successfully demonstrate that your Personal Information in our records is inaccurate or incomplete, we will amend the Personal Information as required. Requests may be submitted to privacy@xorvya.com, and we will respond within 30 days, subject to applicable legal requirements and retention obligations.
If your request relates to resident personal health information or other information entered by a customer organization, please direct your request to the applicable customer organization, and Xorvya will assist that customer organization as appropriate.
We may require that you provide sufficient identification to fulfill your request to access or correct your Personal Information. Any such identifying information will be used only for this purpose.
Third Party Websites and Services
This Privacy Statement does not extend to any websites or products or services provided by third parties. We do not assume responsibility for the privacy practices of such third parties, and we encourage you to review all third party privacy policies prior to using third party websites or products or services.
How to Contact Us
All comments, questions, concerns or complaints regarding your Personal Information or our privacy practices should be sent to our Privacy Officer as follows:
Attention: Vivian Xie, Privacy Officer
50 Acadia Avenue, Unit 120
Markham, Ontario
Canada
By e-mail: privacy@xorvya.com