Privacy Policy

Effective date: September 15, 2026

Purpose

VITR.AI develops orientation software, data visualization software and application programming interfaces (APIs), such as patient orientation tools and clinical relevance filters.

By accessing its software (including NAVIG), you are bound by the user license agreement that your employer has entered into with VITR.AI or by your employment contract with VITR.AI, as applicable, and/or by the Terms of Use of VITR.AI’s website and software, as well as by this Privacy Policy.

The purpose of this Privacy Policy is to inform VITR.AI’s users, patients, clients, employees and consultants about the practices implemented to protect the personal information obtained in the course of providing its services, the use of its websites and software, and the management of its business.

If you do not consent to this Privacy Policy and to VITR.AI’s collection of your personal information, please do not provide us with your personal information.

Application of this Privacy Policy

This Privacy Policy applies to the following situations:

  • The use of NAVIG and VITR.AI’s application programming interfaces (APIs) may involve the processing of personal information, including sensitive medical information, where such information is necessary for the provision of its services. When processed in NAVIG, such information is subject to de-identification measures, in accordance with the Act respecting the protection of personal information in the private sector, so as to no longer allow the direct identification of the individuals concerned. VITR.AI also applies a data minimization principle in order to limit the collection, use and retention of such information to what is necessary for the specified purposes and for the provision of its services;

  • The collection of personal information of employees and consultants.

The following sections detail our personal information management practices for each of these situations.

Personal Information Collected

Personal information is any information that relates to an individual and allows that individual to be identified, directly or indirectly. Note, however, that information relating to an individual's employment or professional duties, such as name, job title and business contact details, is subject to specific rules provided by law.

For the purposes of this Privacy Policy, the expression “de-identified information” means personal information that, at the relevant processing stage, is processed in a form that no longer allows the individual concerned to be directly identified. Such information remains personal information within the meaning of applicable laws.

1. NAVIG and APIs

In the course of providing the services offered through NAVIG and VITR.AI’s APIs, the personal information processed may include, in particular, the answers to questions relating to the patient’s health, in order to better understand the patient’s needs.

This information is necessary to enable VITR.AI to offer services adapted to patients’ needs, in particular for orientation, appointment scheduling and care management purposes.

The use of a VITR.AI API requires your consent to the collection and processing of the personal information necessary for its operation. You must also give your express consent for the information, once de-identified and subsequently anonymized, to be used for the purposes of training and improving artificial intelligence models.

De-identified information is retained for a limited period before being anonymized, where applicable, in accordance with applicable legal requirements. A description of the anonymization process is provided below.

2. Employees and Consultants

At VITR.AI, we collect the following personal information concerning our employees and consultants:

  • Name;

  • Contact details;

  • Telephone number;

  • Social Insurance Number (employees only);

  • Specimen check (banking information);

  • Hourly rate/salary;

  • Job performance information;

  • Emergency contact.

Privacy of Children

At VITR.AI, we do not knowingly collect or solicit personal information from persons under 14 years of age without the prior consent of a parent or legal guardian, subject to the exceptions provided by law. If you are a parent or guardian and you know that your child has provided us with personal information, please contact our Privacy Officer, whose contact details are provided in the next section of this Privacy Policy.

Any personal information collected directly from a person under 14 years of age without the required consent will be removed from our systems as soon as possible, subject to applicable legal obligations.

Purposes for Which Personal Information Is Collected

The personal information processed in connection with NAVIG and VITR.AI’s APIs, as well as the personal information of our employees and consultants, is processed solely for the following applicable purposes:

  • Operation of our business activities;

  • Effective human resources management;

  • Payroll and accounting;

  • Legal obligations;

  • Provision of the services offered through NAVIG and VITR.AI’s APIs, in particular for orientation, appointment scheduling and care management purposes.

Consent and Legal Basis

In order to limit any risk of harm caused by a confidentiality incident, we collect and retain only the personal information that is necessary for the purposes specified above.

If you provide us with personal information concerning other persons, it is your responsibility to have informed them and obtained their consent before providing us with their personal information.

If we wish to use your personal information for other purposes, we will first ask for your consent, where required, except in the cases provided by law or where the new use is compatible with the purposes initially specified.

Disclosure of Your Personal Information

Only the following persons may receive communications from our personnel containing your personal information:

  • You;

  • VITR.AI personnel who require it in the course of their employment and who have signed a confidentiality agreement regarding personal information (for example, in management and accounting);

  • A VITR.AI service provider who requires your personal information in the course of providing services and who has signed a confidentiality agreement regarding personal information or is subject to equivalent professional ethical obligations;

  • The police or another competent authority, if required by law.

Non-Disclosure to Third Parties

VITR.AI does not rent, sell or trade the personal information it processes, including that of its employees and consultants, such as their name, address, telephone number or email address, as well as their financial information, including their hourly rate or salary.

VITR.AI undertakes not to disclose personal information, except where required by law, at the request of a court, or in the course of performing a contract entrusted to an external service provider. Where we use an external service provider, we take all necessary measures to ensure that personal information is protected in accordance with applicable legal requirements and processed in accordance with this Privacy Policy.

Hosting of Personal Information

VITR.AI hosts the personal information it holds, including de-identified information where applicable, on servers located in Québec.

Security Measures

At VITR.AI, we apply high standards and use high-performance security systems in the design, implementation and day-to-day operation of our platforms (websites and applications), as well as our underlying servers and networks. We also strive to detect and block any intrusion on our platforms.

We have put in place various measures to protect your personal information, including information processed in de-identified form, against loss, theft, and any unauthorized access, disclosure, copying, use, modification or destruction. These measures include physical, administrative and technological security safeguards that we consider appropriate given the sensitivity, quantity and format of the personal information collected.

To complement these security measures, our employees, consultants, and suppliers sign confidentiality agreements to ensure the protection of all personal information collected, as well as our clients’ business information.

Access Control to Your Personal Information

Access to information is restricted to authorized employees and consultants who are duly trained and bound by contractual confidentiality obligations. All access to personal information is logged in order to ensure complete traceability and to detect any attempt at unauthorized access. Information is encrypted in transit and at rest, and hosted exclusively on servers located in Québec.

Your Rights Regarding Your Personal Information

The Act to modernize legislative provisions as regards the protection of personal information (hereinafter “Law 25”) and the Act respecting health and social services information (hereinafter “Law 5”) confer various rights regarding your personal information. In particular, you have the following rights:

  • Access: the right to ask whether we hold personal information about you and, if so, to request access to that personal information;

  • Rectification: the right to request the rectification of any incomplete or inaccurate personal information that we hold;

  • Withdrawal of consent: the right to withdraw your consent to the communication or use of the personal information held;

  • Restriction or refusal of access: the right to request that a specific stakeholder, or one belonging to a specified category of stakeholders, not have access to one or more items of information that you have identified;

  • Portability: the right to request that your personal information be communicated to you or transferred to another organization in a structured and commonly used technological format;

  • Complaint: You may file a complaint with our Privacy Officer if you believe that your rights under the Act respecting the protection of personal information in the private sector have been violated;

To exercise any of these rights, please contact our Privacy Officer, whose contact details are provided at the end of this Privacy Policy.

Please note that VITR.AI may refuse any request for rectification, portability or withdrawal of consent if it contravenes applicable laws and regulations on the matter or, in the case of portability, if it would cause serious practical difficulties. We will then provide you with the full justification for such refusal.

Where a request concerns de-identified information processed in NAVIG or through VITR.AI’s APIs, VITR.AI may not have the elements needed to link or isolate an item of information to a specific individual with sufficient reliability. In such a case, the appropriate verifications are carried out and VITR.AI communicates to the individual concerned the conclusions of its analysis and the limitations encountered.

Any complaint or request is handled and followed up in accordance with VITR.AI’s applicable process.

Risks

Aware of the importance of protecting your personal information, VITR.AI has put in place the measures required to comply with the law and with applicable professional and ethical obligations. We thus meet the security standards specific to our industry in order to ensure the protection of the information that we collect and process, including where it is in de-identified form.

Notwithstanding the foregoing, the management of the collection, retention, consultation and communication of personal information through technology involves a number of risks for which VITR.AI cannot be held responsible. If you have reason to believe that personal information has been compromised, please contact our Privacy Officer, whose contact details are provided in the next section of this Privacy Policy.

Management of Confidentiality and Cybersecurity Incidents and Technical Anomalies

In the event of accidental or unauthorized access to personal information, including de-identified information, whether that of patients originating from our clients (medical clinics and call centres), of employees or of any other API user, we proceed as follows:

  • The patient, employee, client or any other user concerned is informed immediately;

  • Personal information obtained in error is deleted without delay and irreversibly, in accordance with the internal procedures in force;

  • The incident is documented in order to ensure traceability and to prevent any recurrence.

In the event of cybersecurity incidents or technical anomalies that may compromise personal information, VITR.AI has an action plan that will be implemented by our Privacy Officer in the event of a security or confidentiality incident. This plan includes, in particular:

  • Immediate notification of all parties concerned;

  • Assessment of the nature and impact of the incident;

  • Corrective measures to limit the consequences;

  • Complete documentation of the incident and the actions taken.

Accordingly, as soon as an incident occurs, you must notify our Privacy Officer as soon as possible using the contact details provided at the end of this Privacy Policy.

Anonymization, Retention Period and Destruction

As previously indicated, certain personal information processed through NAVIG and VITR.AI’s APIs is subject to de-identification measures. Such information remains subject to the protective measures provided in this Privacy Policy.

Anonymization is a process distinct from de-identification. Where applicable, certain de-identified information may subsequently be anonymized for the purposes provided in this Privacy Policy.

Anonymization consists in processing information so that it is reasonable to expect, in the circumstances, that it irreversibly no longer allows a person to be identified, directly or indirectly. At VITR.AI, this process follows a rigorous method that complies with applicable legal requirements, including, in particular:

  • The removal of direct identifiers (name, telephone number, address, etc.);

  • The modification or generalization of indirect information that could be used to trace an identity (date of birth, location, unique codes, etc.).

Only data anonymized in this way is used to train artificial intelligence models, thereby ensuring the protection of users’ privacy while allowing the continuous improvement of our technologies.

You may withdraw your consent at any time. In such a case, the information concerned that has not yet been anonymized will be destroyed within 125 days following collection.

No personal information that is not required should be provided by you unless it is necessary in the course of the provision of services or employment.

VITR.AI also undertakes to ensure that personal information processed through NAVIG and the APIs, including de-identified information, is destroyed no later than one hundred and twenty-five (125) days after the orientation. For employees and consultants, data is retained for six (6) years after the end of employment or of the provision of services, in accordance with the legal obligations of the Canada Revenue Agency.

Our Commitment to Protecting Your Privacy

At VITR.AI, the protection of your personal information is a priority. We ensure that our privacy and security policies and practices are clearly communicated to all of our employees and consultants, and we put in place rigorous measures to ensure that they are applied. We are committed to maintaining high standards of information security and to promoting an organizational culture focused on the protection of personal information.

Training and Awareness

At VITR.AI, we regularly train our employees and consultants so that they fully understand how to protect personal information and secure our systems. This enables them to know what to do, identify risks and follow our security rules on a daily basis. In doing so, we ensure that your personal information is better protected and that our practices meet information security standards.

Review and Update of the Policy

We reserve the right to review and update this Privacy Policy at any time in order to adapt it to changes in our practices, our activities or applicable legal and regulatory requirements. When an update is made, we update the date of the last modification at the beginning of this Privacy Policy and publish the revised version on our website or on any other relevant platform. If the changes are material, we will provide a clear and visible notice in order to inform you appropriately.

We encourage you to review this Privacy Policy regularly in order to remain informed of how we process your personal information. By continuing to use our website, our software or our services after the publication of a revised version, you are deemed to accept the changes made. If you do not agree to the updated terms, we invite you to stop using our services.

Appointment of the Privacy Officer

VITR.AI has appointed Me Arianne Patenaude as Privacy Officer.

Contact details:
Me Arianne Patenaude, Legal and Compliance Counsel
VITR.AI
126 Principale Street (Suite 100)
Granby (Québec) J2G 2V2
[email protected]

Please do not hesitate to contact our Privacy Officer if you have any questions about this Privacy Policy.