Politique de confidentialité

The Services are operated by Aryunisi Inc., carrying on business as Stowe Health, a federally incorporated corporation headquartered in Ontario, Canada.

The Services are offered only to individuals who:

• are at least 18 years old;
• are acting on their own behalf and have capacity to consent;
• reside in Canada, other than Québec; and
• meet any other eligibility requirements in our Terms and Conditions.

The Services are not currently offered to Québec residents. We collect and use eligibility information, including a user's stated province or territory, date of birth, approximate location, to confirm that a user is eligible. Eligibility is primarily self-reported. If we reasonably believe that a user is under 18, resides in Québec, is using the Services on behalf of another person, or is otherwise ineligible, we may request verification, restrict access, or suspend or close the account. We will handle any information already provided in accordance with this Privacy Policy and applicable law.

Stowe is a consumer health-information management service. Stowe is not a health care provider, hospital, clinic, pharmacy, laboratory, insurer, or government health service, and is not a health information custodian under Ontario's Personal Health Information Protection Act in its current direct-to-consumer configuration.

Stowe is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Stowe does not provide medical advice, diagnosis, treatment, or emergency services and does not create or modify official clinical records. Information made available through the Services are for informational and organizational purposes only. They are not a substitute for advice from a qualified health care professional. Users should consult an appropriate health care professional about medical questions and call emergency services when urgent assistance is required.

Stowe handles personal information in accordance with applicable Canadian private-sector privacy laws, including the Personal Information Protection and Electronic Documents Act, 2004 (PIPEDA) and, where applicable, the private-sector privacy laws of Alberta and British Columbia. PIPEDA continues to apply to interprovincial and international information flows.

The information we collect depends on the features a user chooses to use. You are not under any obligation to provide your personal information to us. Please note however, that most functionalities of our Services rely on information about yourself and specifically your health. Without providing this information you might not be able to use those functionalities at all or to a limited extent.

The information we collect may include the following categories:

3.1 Account and contact information

• name, preferred name, and email address;
• account identifier, login and verification records, authentication information, and consent records;
• communication preferences and notification settings; and
• information needed to respond to support, privacy, or security requests.

We do not store a readable copy of a user's password. Authentication credentials are protected using appropriate technical controls.

3.2 Profile and preference information

• date of birth and confirmation that the user is at least 18;
• sex assigned at birth;
• province or territory of residence;
• preferred measurement units;
• optional height, weight, health or wellness goals, and other profile information; and
• onboarding and profile-completion status.

3.3 Health and wellness information

• medical, dental, optical, pharmacy, paramedical, mental health, laboratory, imaging, treatment, medication, symptom, and other health or wellness information;
• information manually entered by a user, including symptoms, experiences, notes, categories, tags, dates, and descriptions;
• reminders a user creates, including titles, dates, times, frequency, and any associated notes;
• information contained in documents, images, photographs, reports, files, and other content a user chooses to upload;
• file names, file types, dates, source labels, and other metadata associated with uploaded content; and
• information that may incidentally appear in an uploaded record, such as health card information, provider information, contact details, signatures, or information about another person.

Users should upload only their own information, information they are legally entitled to provide, and information necessary for their use of the Services. Users must not create an account for another person or upload another person's records.

3.4 Subscription and transaction information

• subscription product, status, renewal and expiry information;
• app-store transaction identifier, purchase history, entitlement status, and limited billing metadata; and
• records needed for accounting, fraud prevention, customer support, and legal compliance.

Payments are processed by Apple, Google, or their payment partners. Stowe does not receive or store full payment-card numbers entered through the Apple App Store or Google Play.

3.5 Device, usage, and security information

• Internet Protocol address, device and app identifiers, operating system, app version, language, and time zone;
• approximate location derived from an Internet Protocol address and, where the user grants permission, device location information used to verify Canadian eligibility and protect the Services;
• login, session, authentication, upload, and feature-interaction records;
• push-notification token and delivery status, if notifications are enabled;
• diagnostic, crash, performance, error, and security-event data; and
• access and audit records showing actions taken in an account and, where applicable, access by authorized Stowe personnel or service providers.

We do not use health information for advertising or cross-service tracking.

3.6 Device permissions

Depending on the feature used and the user's device settings, the app may request access to:

• the camera, photo library, or files selected by the user for record upload;
• device location for eligibility and security purposes; and
• notifications for service, security, subscription, and product-function messages.

The app does not access Apple HealthKit, Google Health Connect, contacts, advertising identifiers, or biometric information. Device permissions can be managed through the device settings, although disabling a permission may prevent the related feature from working.

3.7 Website and communications information

When a person visits our website, joins a waitlist regarding product launches, subscribes to communications, or contacts us, we may collect contact information, submitted messages, IP address, browser and device information, referring page, pages viewed, and cookie or similar-technology information. We use essential technologies needed to operate and secure the website. If we use optional analytics or marketing technologies, we will provide any notice and choice required by applicable law.

We collect personal information:

• directly from users during registration for an account with us, onboarding, profile management, document upload, manual entry, support, and in relation to access to information or related privacy requests;
• automatically from the app, website, device, and supporting systems when the Services are used;
• from Apple, Google, and subscription-management providers in connection with purchases and entitlements; and
• from service providers acting on our instructions, including document-processing, authentication, email, infrastructure, and technical-service providers.

Stowe does not receive health records directly from health care providers, provincial health record systems, or other health information custodians.

We use personal information only for identified and reasonable purposes, including to:

• create, verify, authenticate, secure, and administer user accounts;
• determine eligibility for the Services, including province and age requirements;
• receive, store, organize, display, search, retrieve, provide copies of, and delete user health records and related information;
• provide onboarding, profile, record-management, reminder, subscription, notification, and customer-support functionalities;
• process subscriptions, maintain entitlements, reconcile transactions, detect and prevent fraud, and meet accounting obligations;
• send service, security, privacy, subscription, and support communications;
• investigate errors, maintain availability, protect users, prevent misuse, detect security threats, and respond to incidents;
• maintain consent, access, transaction, and compliance records;
• understand and improve the reliability, accessibility, security, and performance of the Services using information that is minimized, aggregated, de-identified, or otherwise used with appropriate consent; and
• comply with applicable law, valid legal process, regulatory requirements, and enforceable agreements.

We do not sell or rent personal information. We do not use health information for advertising, behavioural advertising, insurance underwriting, employment decisions, data brokerage, or unrelated marketing. We do not disclose health information to advertisers, employers, or insurers for their own purposes. Stowe does not use, or permit its service providers to use, user documents or health information to train artificial intelligence models. We do not track users across third-party apps or websites. Any materially different secondary use, including research, benchmarking, advertising, or model training involving identifiable or reasonably re-identifiable information, would require a separate assessment, clear notice, and express opt-in consent and would not be a condition of receiving the Services.

This Privacy Policy is a transparency document. Where we ask for consent, we do so through a clear affirmative action in the app or another appropriate interface. For example, we seek express consent through affirmative user action. During account creation, users are required to review and accept the Terms and Conditions and acknowledge this Privacy Policy before using the Services. A feature-specific notice may provide additional details at the point where information is collected or used. If a feature-specific notice conflicts with this Privacy Policy, the more specific notice will apply to that processing.

Certain processing is necessary to provide the Services a user requests. A user who does not consent to the collection and use of information required for account security, storage, record management, and subscription administration cannot use those parts of the Services.

Users retain control over the personal information and other records and content they provide and certain device-level choices. Users may:

• decide which documents and information to upload or enter;
• create, edit, or delete reminders;
• enable or disable push notifications through the app or device settings;
• opt in to or withdraw from non-essential communications; and
• delete individual uploaded records or their entire account using available in-app controls.

Consent may be withdrawn at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not invalidate processing already lawfully performed. If withdrawing consent means we can no longer provide a feature, we will explain that consequence before the withdrawal takes effect.

Acceptance of the Terms and Conditions and acknowledgement of this Privacy Policy are mandatory prior to uploading any data or records to Stowe. By selecting and confirming a file upload, the user instructs Stowe to store and process that file to deliver the Services.

The original records, and any associated information added by the user such as document tags or manual notes, are stored in Stowe's Canadian Amazon Web Services (AWS) environment. In handling these records:

• Stowe uses only the information reasonably necessary to provide the Services;
• Stowe's service providers may handle personal information only to provide services to Stowe, under contractual obligations to protect it and not use it for their own purposes; and,
• users can correct, update, or delete the records, tags, and notes they have uploaded or added, as described in Sections 11 and 13.

Stowe does not currently use artificial intelligence or automated document processing to read, extract, or summarize users' records. Before introducing any such feature, Stowe will update this Privacy Policy and obtain the user's consent before applying it to their records.

Stowe remains accountable for personal information transferred to a third-party service provider for processing on its behalf. Section 8.1 describes our service providers, and Section 9 addresses processing outside Canada.

We disclose personal information only as described below, with consent, or as permitted or required by law.

8.1 Service providers

We may transfer your personal information to third-party service providers acting on our instructions to operate the Services. Material providers include:

• Amazon Web Services (AWS) for Canadian cloud hosting, databases, file storage, backups, authentication through Amazon Cognito, and transactional email through Amazon Simple Email Service;
• RevenueCat for subscription entitlement and billing orchestration; and
• Apple and Google as the exclusive payment processors for purchases made through their respective app stores.
• Google Workspace for business email, including support and privacy requests sent to Stowe;

We may also use limited security, monitoring, logging, error-detection, professional-advisory, and technical-service providers, and authorized engineering and technical contractors working under confidentiality, access-control, and data-protection obligations.

Service providers receive only the information reasonably needed to perform their assigned services. Stowe remains accountable for information transferred for processing and contractually requires service providers to provide a comparable level of protection consistent with this Privacy Policy and applicable law. Providers are not authorized to sell the information, use it for their own marketing or other purposes, or use it to train artificial intelligence models.

Current information about material service-provider categories, purposes, and processing countries is available by contacting tech@stowehealth.com. This information may change as providers and their subprocessors change. If a change materially affects how health information is handled, we will update this Privacy Policy and provide any additional notice or consent as required by law.

8.2 Authorized Stowe personnel

Access by Stowe employees and contractors is limited according to role and need. Authorized personnel may access information when reasonably necessary for security, support, troubleshooting, incident response, legal compliance, or maintaining the Services. Access is subject to confidentiality, least-privilege controls, and logging where appropriate. Production access is not permitted for routine development or testing.

8.3 Legal and safety requirements

We and our service providers, in Canada or elsewhere, may disclose your personal information in response to a search warrant or other legally valid inquiry or order; to another organization where reasonably necessary to investigate a breach of an agreement or a contravention of law, or to detect, suppress, or prevent fraud; or as otherwise required or permitted by applicable Canadian or other law or legal process, which may include lawful access by foreign courts, law enforcement, or other government authorities. Your personal information may also be disclosed where necessary to establish, exercise, or defend legal claims, or to investigate or prevent actual or suspected loss or harm to persons or property. We review each government or legal-process request and disclose only the information we reasonably determine is legally required.

8.4 Corporate transactions

Stowe does not sell users' personal or health information and does not treat it as an asset separable from the Services.

If Stowe is involved in a proposed or completed merger, acquisition, reorganization, or sale or transfer of all or part of its business or assets, including in a bankruptcy or insolvency proceeding, personal information may be disclosed only to the extent necessary to evaluate or complete the transaction, and only under written confidentiality and use restrictions. In connection with any financing, Stowe will share only aggregated or de-identified information and will not disclose users' records.

If personal information is transferred to a successor:

• it will be transferred only to a successor that continues to provide the Services, and not separately from them;
• the successor must handle it in accordance with this Privacy Policy as in effect at the time of transfer, and must obtain the user's express consent before using it for any new purpose; and
• where permitted by law, Stowe will notify users at least 30 days before the transfer takes effect, and users may export or delete their records before it does.

Stowe stores its primary application databases, uploaded files, and backups in Canadian AWS regions. Amazon RDS, Amazon S3, Amazon Cognito, and the other AWS services used for the Stowe production environment are configured in Canada.

Some processing and access occur outside Canada:

• Apple, Google, RevenueCat, and their subprocessors may process limited subscription, transaction, device, support, or account information in the United States or other countries where they operate;
• Google, as Stowe's email provider, may process the contents of emails users send to Stowe in the United States or other countries where it operates; and
• authorized Stowe personnel and contractors may securely access Canadian-hosted systems from outside Canada, when reasonably necessary for operations, security, support, troubleshooting, or incident response.

Remote access from another country is subject to authorization, confidentiality duties, access controls, and security monitoring. Remote access does not change the location of Stowe's primary databases or file storage, but it constitutes processing in the country from which the access occurs.

When personal information is processed in another country, it may be subject to that country's laws and may be accessible to courts, law enforcement, or national-security authorities in that jurisdiction. Stowe assesses service providers and transfers, limits the information involved, applies access controls, and uses contractual or other measures intended to provide a comparable level of protection.

You may request further information about Stowe's policies and practices concerning service providers outside Canada, including the countries in which information may be processed and the purposes for which a provider is authorized to handle it, by contacting our Privacy Officer as set out below.

We recognize that health information is highly sensitive and apply heightened protections to help safeguard it. Stowe maintains administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including measures such as:

• encryption of personal information in transit and encryption of stored health information and backups;
• multi-factor or multi-step account verification and protections against unauthorized login attempts;
• role-based access, least-privilege permissions, tenant separation, and time-limited elevated access;
• logging and monitoring of account, system, and administrative access;
• secure software-development, vulnerability-management, patching, and incident-response practices;
• restrictions on the use of production health information in development, testing, logs, error traces, and support tools;
• confidentiality, security, and offboarding requirements for personnel and service providers; and
• encrypted backups, restoration testing, and business-continuity controls.

No system can be guaranteed to be completely secure. Users also have a role in protecting their information and should maintain control of their email account and devices, use strong and unique credentials, enable available device protections, and notify Stowe promptly of suspected unauthorized access.

Stowe is designed to maintain a longitudinal health record. We therefore retain account information and user-selected health content while the account remains active, unless the user deletes particular content sooner.

Users may delete individual records or their whole account through available in-app controls. When a user deletes their account, Stowe will:

• disable user access promptly;
• automatically delete or de-identify account content from active systems; and
• remove remaining copies from routine backups through the normal backup cycle, normally within 35 days.

Service providers are required to delete information in accordance with their agreements and applicable retention cycles. Information scheduled for deletion is not used for new purposes.

We may retain limited information for longer where reasonably necessary or legally required, including:

• transaction, tax, and accounting records, generally for up to seven years;
• consent, complaint, and legal-compliance records;
• security logs and records of privacy or security incidents;
• information subject to litigation, investigation, preservation, or other legal hold; and
• information needed to establish, exercise, or defend legal claims, prevent fraud, or enforce agreements.

When information must be retained after account deletion, we restrict it to the permitted purpose and delete or de-identify it when that purpose ends. We describe information as de-identified or anonymized only where appropriate measures have been applied and the term accurately reflects the residual risk of identification.

Deleting a Stowe account and cancelling an app-store subscription are separate actions. Cancelling a subscription does not delete the account or its health records. Account deletion may not automatically cancel billing managed by Apple or Google. Before deleting an account, users should cancel an active subscription through the Apple App Store or Google Play account used to purchase it.

Subject to applicable law, users may request:

• access to personal information Stowe holds about them, including account data, consent records, and relevant access information;
• correction of inaccurate or incomplete personal information;
• a copy of the records, tags, and notes they have uploaded or added, in a portable format where available;
• deletion of particular information or the account;
• withdrawal of consent for optional processing; or
• information about Stowe's privacy practices and service providers outside Canada.

Users can review their information and delete individual uploaded records through available in-app controls. Requests for an account-level correction, a copy or export of available records, or another privacy request may be sent to privacy@stowehealth.com from the email address associated with the account. These requests are fulfilled manually. To protect health information, we may need to verify the requester's identity. We will respond within the period required by applicable law, generally within 30 days, and will explain any lawful limitation or refusal.

If Stowe becomes aware of a privacy or security incident, we will take reasonable steps to contain, investigate, remediate, and document it. Where required by applicable law, we will report the incident to the appropriate privacy regulator, notify affected individuals, and notify other organizations that may be able to reduce the risk of harm.

We may send communications necessary to administer and secure the Services, including account verification, security, privacy, subscription, service, and support notices. These communications are part of the Services and cannot always be opted out of while an account remains active.

Stowe does not display advertising in the Services and does not use personal information or health information to target advertising. If we send promotional or product-news communications, we will do so only as permitted by law and will provide an unsubscribe method. Unsubscribing from those communications does not stop necessary service communications.

We may update this Privacy Policy to reflect changes to the Services, providers, technology, law, or our practices. We will post the current version on our website and make it accessible in the app, with the effective date shown at the top.

If a change is material, we will provide additional notice through the app, email, or another appropriate channel. Where a change introduces a new purpose or disclosure requiring consent, we will obtain that consent before applying the change to existing personal information.

The Privacy Officer is accountable for Stowe's privacy program and responds to questions, access requests, complaints, and concerns.

We will investigate privacy complaints and explain the outcome. If a concern is not resolved, an individual may contact the Office of the Privacy Commissioner of Canada or, where applicable, the Office of the Information and Privacy Commissioner of Alberta or British Columbia.