Privacy Policy

CareLink Technologies Inc. ("CareLink", "we", "us", or "our") operates the CareLink mobile application and web portal (collectively, the "Platform"). We are committed to protecting the privacy and personal information of all individuals who use our Platform, including healthcare workers, employers, and administrators.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

By using the CareLink Platform, you consent to the practices described in this Privacy Policy.

CareLink is a Canadian healthcare staffing platform that connects personal support workers (PSWs), registered practical nurses (RPNs), registered nurses (RNs), and other healthcare professionals with long-term care facilities, home care agencies, hospitals, and other healthcare organizations across Canada.

Our Platform facilitates shift scheduling, credential verification, timesheet management, secure messaging, and payouts between workers and employers.

We collect personal information that is necessary to provide our staffing platform services. This includes:

Information you provide directly: - Identity information: full name, email address, phone number, city, province - Professional credentials: credential type, issuing body, expiry date, uploaded documents (e.g., certificates, immunization records) - Profile photo - Banking or payout information (collected via our payment processor) - Availability schedules and preferences - Organization details: legal name, address, facility locations, GPS coordinates

Information generated through Platform use: - Shift history: clock-in/clock-out times, GPS check-in/check-out coordinates - Timesheet and payout records - Messages sent through the in-app messaging system - Case notes (where applicable, containing Protected Health Information — PHI) - Reliability scores and shift ratings - Device push notification tokens - Audit logs of administrative actions

Technical information: - Device type, operating system, and app version - IP address and approximate location (at time of shift check-in/check-out) - App usage data and crash reports

We use your personal information for the following purposes:

- Platform operation: To create and manage your account, verify your identity, and provide staffing services - Credential verification: To verify professional qualifications before allowing you to claim shifts - Shift management: To match workers with shifts, enforce geofence check-in/check-out, and generate timesheets - Communications: To send shift notifications, system alerts, and welcome messages via email and push notifications - Payouts: To calculate earnings and facilitate payment to workers - Case notes: To enable authorized workers and employers to document and share patient care information securely - Compliance: To maintain records required under applicable healthcare and employment legislation - Platform safety: To detect fraud, abuse, or policy violations - Service improvement: To analyze usage patterns and improve Platform features

We do not use your personal information for purposes other than those listed above without your additional consent.

Certain features of the Platform, including case notes, may involve the creation and storage of Protected Health Information (PHI) about patients or care recipients. CareLink treats PHI with the highest level of protection.

- Case notes are only accessible to the worker who created them and authorized employer personnel - Secure sharing links for case notes are single-use and expire after 48 hours - PHI is stored encrypted at rest in our Canadian AWS infrastructure (ca-central-1 region) - Workers and employers are responsible for complying with applicable healthcare privacy legislation (including PHIPA in Ontario) when creating or sharing case notes through the Platform

We do not sell your personal information to third parties.

We may disclose your personal information to:

- Healthcare employers on the Platform: Workers' profile information, credentials, availability, and shift history are shared with employers for the purpose of staffing - AWS (Amazon Web Services): Our cloud infrastructure provider, hosting data in the ca-central-1 (Canada) region - Expo (Expo.dev): For delivery of mobile push notifications - Payment processors: For processing worker payouts - Law enforcement or regulatory bodies: Where required by law, court order, or regulatory requirement - Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to equivalent privacy protections

We require all third-party service providers to protect your personal information in a manner consistent with this Privacy Policy and applicable law.

We retain your personal information for as long as necessary to provide the Platform services and to comply with our legal obligations:

- Active account data: retained for the duration of your account - Shift, timesheet, and payout records: retained for a minimum of 7 years for tax and audit purposes - Credential documents: retained for the duration of your account plus 2 years - Case notes: retained for a minimum of 10 years, in accordance with Ontario health record requirements - Inactive accounts: personal information is anonymized or deleted within 2 years of account inactivity, upon your written request

You may request deletion of your account at any time (see Section 9).

Your personal information is stored on servers located in Canada (AWS ca-central-1, Montreal region). We implement industry-standard security measures including:

- Encryption of data in transit (TLS 1.2+) and at rest (AES-256) - JWT-based authentication with short-lived access tokens (15 minutes) and refresh tokens - Role-based access controls limiting data access to authorized personnel - Audit logging of all administrative actions - Regular security reviews

No method of electronic storage or transmission is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security.

Under PIPEDA, you have the right to:

- Access: Request access to the personal information we hold about you - Correction: Request correction of inaccurate or incomplete personal information - Withdrawal of consent: Withdraw consent to the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions), with reasonable notice - Deletion: Request deletion of your account and associated personal information, subject to our retention obligations - Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

To exercise any of these rights, please contact our Privacy Officer at privacy@carelinkapp.ca. We will respond to requests within 30 days.

The CareLink web portal uses browser local storage to maintain your authentication session. We do not use third-party advertising cookies or tracking pixels.

The CareLink mobile application uses device storage (AsyncStorage) to store your authentication tokens and preferences locally on your device. We do not share this data with advertising networks.

The CareLink Platform is intended for use by healthcare professionals and employers. It is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately at privacy@carelinkapp.ca.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy in the Platform and updating the "Last Updated" date below. Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

CareLink Technologies Inc. Privacy Officer Email: privacy@carelinkapp.ca

If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada: Web: www.priv.gc.ca Toll-free: 1-800-282-1376