PRIVACY POLICY

1) About this policy

Infection Control IQ ("we," "us," or "our") respects your privacy. This policy explains how we collect, use, disclose, and protect your personal information when you use our web-based platform for searching infection prevention and control (IPAC) guidance. We are committed to complying with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25, as well as the Canadian Anti-Spam Legislation (CASL).

2) What we do (and what we don't):

• We index and search public IPAC guidance and return cite-backed answers.
• We do not require you to submit personal health information (PHI) or any sensitive personal information to use core features. Please do not include PHI in prompts, uploads, or support tickets.

If you inadvertently provide PHI or other sensitive data, contact us at support@infectioncontroliq.com. We will delete it where feasible and not required for security or legal reasons.

3) Personal information we collect:

a) Information you provide:

• Account and profile
• Communications
• Billing (paid plans)
• Content you submit

b) Information collected automatically:

• Usage and device data
• Cookies and similar technologies

c) Information from third parties:

• Single sign-on (if enabled)
• We may receive business contact details

4) Why we collect and how we use personal information

1. Provide and secure the Services
2. Respond to you
3. Improve the Services
4. Communicate
5. Compliance

5) Our legal authority to handle personal information

In Canada, we primarily rely on your consent to process personal information. For individuals in the EU/EEA/UK, we process your information based on appropriate lawful basis as required under GDPR/UK GDPR.

6) Do not submit PHI or other sensitive data

Our services are not intended to process PHI. Please do not submit PHI, financial information, or other sensitive personal data through the service. Examples of sensitive data include: medical records, diagnostic information, patient identifiers, financial account numbers, Social Insurance Numbers, etc.

7) How we share information

We do not sell your personal information. We may disclose personal information to:

• Service providers
• Your organization
• Authorities
• Business transfers

A list of core service providers is available upon request to privacy@infectioncontroliq.com

8) Cookies and analytics

We use necessary, functional, and analytics cookies to improve your experience and analyze usage. You can manage your cookie preferences at any time.

9) Your choices and rights

You have the right to:

• Access your personal information
• Correct inaccuracies
• Withdraw consent
• Request deletion
• Request a copy
• File a complaint

To exercise these rights, contact us at privacy@infectioncontroliq.com

10) Security

We implement administrative, technical, and physical safeguards to protect your personal information. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

11) Retention

We retain personal information only as long as necessary for the purposes described in this policy. Retention periods vary based on data type:

• Account data: While your account is active
• Support communications: 3 years
• Application logs/analytics: 24 months
• Legal records: As required by law

12) Where we store and process data; international transfers

Your personal information is primarily hosted in Canada. Some of our service providers may process data in other jurisdictions (e.g., the United States). Where data is transferred outside of Canada, we use contractual safeguards to protect your information.

13) How to resolve concerns or file a complaint

If you have concerns about how we handle your personal information, please contact us first at privacy@infectioncontroliq.com. If your concerns are not resolved, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or a provincial privacy regulator if you are in Quebec, British Columbia, or Alberta.

14) Contact us (and Law 25 contact)

Quebec residents: For purposes of Law 25, the person in charge of protection of personal information can be contacted at the above address or email.

15) Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted on our website and, where required by law, we will obtain your consent.