PIPEDA COMPLIANCE

1. Commitment to PIPEDA

When CallHero Technologies Inc. (“CallHero”) collects, stores, processes, or has access to any personally identifiable information or health-related data subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), the company will:

• Acknowledge and apply the requirements of PIPEDA as if they applied directly to CallHero in its role as a service provider to healthcare or clinic clients.

• Not use or disclose personal information for any purpose other than what is legally permitted and contractually agreed to.

• Avoid any use or disclosure that would cause a client to be in violation of PIPEDA.

• Put in place and maintain appropriate administrative, physical, and technical safeguards to protect personal information from unauthorized access, alteration, loss, or disclosure.

• Promptly notify clients of any privacy or security incident involving personal information that is not permitted under this policy.

• Ensure that any subcontractors, agents, or third parties with access to personal information understand these obligations and agree in writing to follow equivalent restrictions and protections.

• Provide individuals with access to their own information, and handle corrections or amendments as required under PIPEDA.

• Keep a record of disclosures of personal information for up to six (6) years, including:

  • the date of disclosure,

  • the recipient,

  • a description of the information disclosed, and

  • the reason the disclosure was made.

• Cooperate with the Office of the Privacy Commissioner of Canada (or other applicable oversight body) in the event of an investigation into compliance with PIPEDA.

2. Breach and Termination

If CallHero materially breaches this policy, the client may immediately suspend further sharing of personal information and may terminate the agreement. Clients may alternatively give written notice of the breach, allowing up to five (5) business days to remedy the issue. If termination is not feasible, CallHero acknowledges that clients may be legally required to report the breach to the appropriate federal authority.

3. Return or Secure Disposal of Data

Upon termination of a client agreement, CallHero will either return all personal information in its possession or securely destroy it, as directed by the client. If return or destruction is not reasonably possible, CallHero will notify the client, explain the reason, and continue to safeguard the data in compliance with this policy for as long as it is retained.

4. No Third-Party Rights

This policy is intended solely for CallHero and its clients. It does not create rights or benefits for any third party.

5. Use of De-Identified Data

CallHero and its subcontractors may use or disclose de-identified, non-personal data for analytics, benchmarking, or product improvement, provided that the information cannot be reasonably re-identified.

6. Amendments

This policy may be updated by written agreement between CallHero and its clients in order to comply with changes to PIPEDA, Canadian privacy law, or other applicable regulations.

7. Interpretation

Any ambiguity in this policy will be interpreted in a manner consistent with the requirements of PIPEDA and its related regulations, with the goal of ensuring full compliance.

8. Definitions

All terms used in this policy, such as “personal information,” “disclosure,” and “use,” have the meanings given to them under PIPEDA and related Canadian privacy guidance.

9. Survival

The responsibilities set out in this policy remain binding on CallHero even after the termination or expiration of a client agreement, for as long as CallHero retains personal information.