Canada and Québec privacy supplement

About this document

Version history

1. Scope and accountability

This supplement applies to personal information Alessia handles as controller in Canada. Where an Institution controls a portfolio account, that Institution's notice applies to its purposes and Alessia acts under its instructions, subject to the applicable law and contract.

Alessia remains accountable for personal information under its control, including information processed by a service provider. The person responsible for privacy compliance is:

• Privacy Officer
• privacy@alessiahq.com
• Alessia International Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom; +44 20 4514 5863

2. Purposes, collection and consent

The Privacy Notice describes the information, sources, purposes, recipients, retention and account controls. Alessia will identify purposes at or before collection, collect only what is reasonably necessary and seek meaningful consent where required; consent relating to sensitive personal information, including any health-related information, is requested expressly. A purpose and consent request must be understandable in context and meet the reasonable-person standard.

Portfolio fields are optional unless expressly stated. Patient-identifiable information is prohibited. Alessia does not ask users to provide information about their own health, disability, ethnicity or other sensitive matters as part of an account or portfolio. Do not include that information in free text or attachments.

You may withdraw consent where processing relies on consent, subject to applicable legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already carried out lawfully and may mean that an optional feature can no longer be provided. Processing necessary to provide the requested Service, maintain security or comply with law does not depend on optional consent.

3. Service providers and processing outside Canada

Alessia uses providers for hosting, identity, analytics, email, notifications, payments/subscriptions and optional AI. The Privacy Notice describes the recipient categories; current entity names, roles, processing countries and retention details are maintained in the Subprocessor and Service-provider List.

Alessia will use contractual and organisational measures designed to provide a comparable level of protection while information is processed by a service provider outside Canada. Information processed in another country may be accessible to its courts, law-enforcement or national-security authorities under local law.

Before personal information from Québec is processed outside Québec, we complete the privacy impact assessment required by applicable Québec law. We consider the information's sensitivity, the purpose, the safeguards and the legal framework in the receiving jurisdiction. We proceed only where the assessment supports adequate protection and we put the required written agreement in place.

4. Safeguards, accuracy and retention

Safeguards will be proportionate to sensitivity and include access controls, encryption where appropriate, logging, provider controls, incident response and staff confidentiality. Users are responsible for the accuracy of information they enter. Alessia takes reasonable steps to ensure that personal information it uses or discloses is sufficiently accurate, complete and current for the relevant purpose. Alessia does not independently verify the clinical completeness of portfolio content or a user's professional credentials.

Personal information will be retained only as long as necessary for identified purposes and legal requirements, then securely destroyed or anonymised under the Retention Schedule. We continue to treat pseudonymised information as personal information. We treat information as anonymised only where the process meets applicable legal requirements, including Québec's prescribed criteria where those apply.

The anonymous AI-improvement purpose described in the core Privacy Notice applies only after information has been anonymised in accordance with applicable Canadian requirements. For Québec information, this includes the applicable requirement that it be reasonable to expect, at all times and in the circumstances, that the information irreversibly no longer permits direct or indirect identification, together with prescribed criteria and generally recognised best practices. Until that threshold is met, Alessia treats the information as personal information and does not use it for model development.

5. Access, correction and complaints

Subject to lawful exceptions, a person may ask whether Alessia holds their personal information, obtain access and request correction. Alessia will respond within the period required by the applicable law - normally 30 days under PIPEDA - and explain any refusal and recourse.

To request access or correction, email privacy@alessiahq.com with the subject “Canada Privacy Request”. To make a privacy complaint, use the subject “Data Protection Complaint”. The privacy complaints page explains the complaint process. Do not send patient information or unnecessary portfolio evidence by ordinary email. If an Institution controls the information, Alessia will direct or assist the request to it.

Alessia will investigate privacy complaints. If unresolved, a person may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial commissioner, including Québec's Commission d'accès à l'information.

6. Additional Québec transparency and controls

For users in Québec, privacy settings provide the highest level of confidentiality by default where required by law. Optional functions that identify, locate or profile a person are not activated by default where Québec law requires the user to activate them. Before activation, we explain the technology, its purpose and the available control.

We assess confidentiality incidents and notify affected people and Québec's Commission d'accès à l'information where required, including when an incident presents a risk of serious injury within the meaning of Québec privacy law. Alessia maintains a register of confidentiality incidents and makes it available to the Commission on request.

Subject to applicable conditions, a Québec resident may also request:

• a copy of computerised personal information collected from them in a structured, commonly used technological format; or
• cessation of dissemination, or de-indexation or re-indexation of a link associated with their name, where Québec's statutory criteria are met.

Requests may be sent to privacy@alessiahq.com.

Alessia does not make decisions about a person based exclusively on automated processing. Its AI-assisted features produce drafts and suggestions for human review; users and Institutions remain responsible for training, employment, credentialling and professional decisions.

If Alessia introduces an exclusively automated decision covered by Québec law, we will identify it when communicating the decision. On request, we will explain the personal information used and the principal reasons, factors and parameters, and provide an opportunity to submit observations to someone able to review the decision.