Privacy Policy

1Information We Collect

In order to create an account and use the Services provided by Elderella, you will be required to provide specific information about yourself, such as your name, address, telephone number and e-mail address. We will always inform you when we need information that personally identifies you, and we will keep this information in strict confidence. To fully use the Services, you may also voluntarily provide Elderella with information that can be classified as personal information relating to you or to third parties, such as the elder or another individual to whom you are providing care – all such personal information will be stored and maintained in accordance with this privacy policy.

We collect personal information in the following ways:

As part of the use of Elderella's Services

Whether you are a Primary Caregiver or part of an Elder's Care Team, Elderella will require a certain amount of personal information to enable the Services to be provided, including communication between members of an Elder's Care Team. You are completely in control over how much or how little personal information you disclose in your use of the Services, but be aware that your usefulness of the Services will depend on the information that you input.

Each user of Elderella's Services is solely responsible for respecting and protecting the personal information of any person with whom they interact through Elderella's Services and/or of any person whose information they disclose through, or upload into, the Services. Please refer to the below sections, "Information relating to Elders" and "Information relating to minors".

We may also require your name, address, telephone number and certain financial account or credit card information, for billing and payment purposes. This information is kept confidential and stored securely by Elderella and its third party payment provider; for greater certainty, only the third party payment provider will have access to your financial account or credit card information, and security of such information shall be subject to such third party payment provider's terms and conditions.

Elderella also reserves the right to monitor messages sent by you, or data posted by you, through the Services, in order to ensure that your use of the Services is appropriate, lawful, and in accordance with Elderella's Terms of Service.

Automatically by Elderella's Services

Elderella's Services contain features that automatically collect information from users, such as usage statistics and other tracking information. Although this information will not identify you personally, it nevertheless provides certain information about you, and we therefore will not use it in a non-confidential manner unless it is fully anonymized. Additionally, use of Elderella's website and/or Services may result in the collection of technical information such as your computer's IP address, operating system, browser name/version, the referring web page, requested page, date/time, and sometimes a "cookie" (which can be disabled using your browser preferences); such information is used to help us understand the overall usage pattern of our website and Services.

You contact Elderella directly

When you contact Elderella by telephone, e-mail, in person, or through our website, you will be asked to provide consent to the collection of personal information if your personal information will help us deliver the information, products, or services you require.

You respond to communications from Elderella

From time to time, Elderella may invite you to provide us with information for specific purposes. We may ask for this information through feedback features on our website or Services; we may send out e-mail inviting feedback or offering products and services; or we may ask you for information concerning support of our products or services. Your response to these communications may require you to submit personal information and opinions.

Your information is obtained through a third party

Occasionally, Elderella may obtain information about you from third parties, such as mailing list providers, third party service providers, ISPs, or third party application or account providers. Third-party providers are responsible for obtaining consent for the release of personal information to us from those individuals identified on mailing lists, surveys, or through other collection methods.

Information relating to Elders

If you are using the Services as a caregiver to an elder or another individual to whom you are providing care (an "Elder"), you are in control of, and are responsible for, any collection and disclosure of personal information relating to the Elder in accordance with all applicable data protection laws, including obtaining their informed consent to the disclosure of such personal information to Elderella and its use in the Services. This includes any third party documentation relating to the Elder. For any Elders that do not have the legal capacity to provide consent to such disclosure and use of personal information, you must ensure that you have the appropriate consents from the Elder's guardian, person holding the appropriate power of attorney, or other legal representative with the authority to provide such consents. For any Elders that are minors, Elderella expects parents or guardians to be the primary contact with respect to any use of Services obtained through Elderella; personal information of any minor must not be disclosed except with the parent's or guardian's consent. Further details are set forth in the section below, "Information relating to minors".

Information relating to minors

Elderella Services are designed to be provided to and used by adults, and not children. We do not collect or retain any personal information from children. Elderella Services and content on its website are not directed at children under 18 years of age, and Elderella does not knowingly collect personally identifiable information directly from children under 18 years of age online. For purposes of using the Services respecting a minor, parents or guardians may supply information respecting their children just as they would an Elder; however, Elderella expects the parent or guardian to be at all times the party supervising and responsible for such child's use of Elderella Services, if any, and to solely be controlling the information disclosed respecting such child.

2How We Use Your Information

2.1 General Principles

We comply with all applicable privacy laws respecting our processing and storage of any personal information that may be used in conjunction with the Services, and we deal with personal information under these general principles:

• Lawfulness, fairness and transparency: We may not reveal the granular details of how we protect the data in the Services, because that would compromise its security – but we will let you know why we need the information we request, what we need it for, and process it securely and in accordance with applicable laws. If you have any questions respecting your personal information and how it's being used, you need only ask us, and we will answer.
• Limitations of purpose: We will limit use of your personal information to the extent necessary to provide you with our Services, with the clear exceptions that are set out in this Privacy Policy
• Minimization of data: We only collect personal information that we need, and that you choose to give to us. We will not collect personal information gratuitously from you for no reason.
• Accuracy: We make reasonable efforts to keep your personal information accurate and up to date, based on your input; if you notify us of any changes to your personal information, we will make sure to change it in our systems in a timely manner.
• Limitation of data retention: We believe in streamlining the way that we handle personal information so that it minimizes data redundancy and unnecessary retention. We have instituted processes to delete personal information from our systems when it is no longer required.
• Integrity and confidentiality: We process your personal information using appropriate technical or organizational measures designed to ensure appropriate security of your personal information, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.

2.2 Use of Your Data

Elderella uses reasonable precautions to protect your personal information and store it securely. Access to your personal information is restricted to those persons who need it (including those in an Elder's Care Team, as applicable), and Elderella takes reasonable steps to prevent the unauthorized use or disclosure of your personal information. We expect to process your information generally to provide the Services that you request, and we will comply with your lawful instructions respecting the use of your information.

Elderella only uses and discloses your personal information if it helps us facilitate your needs, to provide the Services to you, to improve our products and services, to meet legal and regulatory requirements, or — to the limited extent possible — to manage our internal business operations. Additionally, if there are any disclosure or use restrictions in your consent to the collection of your personal information, Elderella will abide by those restrictions (subject to the consent exceptions listed in this Privacy Policy). For example, your credit card or financial information will only be used to bill you for the services that you have authorized or used, or to pay you for the services performed, as applicable.

2.3 Use of Anonymized and Aggregated Data

We may create anonymized and aggregated data from the information we collect by removing identifying information that makes the data personally identifiable to you. We may use such anonymized and aggregated data for our own lawful business purposes, including but not limited to:

• Analyzing usage patterns and trends to improve our Services;
• Conducting research and development;
• Creating statistical reports and analytics;
• Developing new features and services; and
• Publishing insights about caregiving trends (without identifying individuals).

This anonymized data cannot be used to identify you and is not considered personal information under privacy laws.

2.4 Use of AI in connection with your information

Elderella currently utilizes Google Cloud platform for all computing relating to the Services, including using Google's Large Language Model and their AI libraries (Vertex AI) as well as Google's semantic database (retrieval augmented generation) to power the Elderella care assistant and other tools. These tools will access your information to provide you with the Services tailored to your requests; such access will remain secure and confidential.

3How We Share Your Information

We respect your privacy and will not sell, rent, or trade your personal information. Elderella provides your information to third parties only for purposes to which you have consented, and we require such third parties to keep your information confidential.

In a few situations, Elderella may be required to disclose your information without your prior consent. For example, Elderella may disclose your information if we are required to do so by law, or if we believe in good faith that such disclosure is necessary to:

• Comply with law or legal process;
• Protect and defend our rights and property, or the rights and property of a third party;
• Protect against misuse or unauthorized use of any of Elderella's products, services, or other proprietary materials;
• Protect the personal safety of any person; and
• Allow for a change of ownership of Elderella and associated transfer of all personal information to the new owner of Elderella – this does not affect the protection of your information under this Privacy Policy.

Elderella will always try to provide you with prior notice of such disclosure; however, such notice may not always be possible or reasonable given the circumstances.

Additionally, the nature of the Services provided requires the routine use of your information in the provision of the Services. Your personal information will only be used to the limited extent necessary to provide the Services that you have requested, and may include the following uses:

• To allow third party suppliers, vendors, contractors and other parties to provide products and services to us or to you, or to otherwise act on our behalf (this may include, without limitation, email services, analytics, scheduling tools such as Calendly, customer relationship management platforms such as Attio, and cloud storage providers such as Google Cloud). Such authorization includes the ability for such third parties to email our users regarding updates, surveys and other inquiries regarding their experience with our Services; and
• To allow for audits and surveys to, among other things, validate the size and composition of the users of Elderella's Services, and understand their experience with Elderella's Services.

4Your Rights and Choices

You have certain rights regarding your personal information:

Access: You may request access to the personal information we hold about you at any time.

Correction, Update or Change: You may request that we correct inaccurate or incomplete information, or update it at any time.

Deletion: You may request that we delete all or part of your personal information at any time; however, there may be situations where we are obligated to retain one archival copy of your information to allow us to comply with laws or respond to legal processes. We will inform you of all such situations, and will only use your retained personal information to the limited extent necessary to comply with such laws or respond to legal processes.

Opt-Out: You may opt out of receiving marketing communications from us at any time. Be advised that if you do choose to opt out of communications respecting Services provided by Elderella, you may not obtain all the benefits we could otherwise provide, such as updates or warnings. Elderella will not have any liability to you for your loss of those benefits or any inability to fully use Elderella's Services.

Withdraw Consent: Where we rely on your consent regarding the use or disclosure of information, you may withdraw that consent at any time; in such cases, we will proceed accordingly, which may include the deletion of information that we no longer have your consent to process or store.

Retention: Unless otherwise instructed by you or where deletion of information is mandated by law, we retain your personal information for as long as you maintain an active account with Elderella. An Elder's care coordination data, memories, and history remain accessible throughout your subscription, similar to how email services preserve your message history. After account cancellation, we retain personal data for up to 5 years to allow for reactivation and service improvements, unless you request deletion or a longer retention period is required by law.

5Data Security and Storage

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

5.1 Data Storage Location

Your health information and personal data are securely stored on Google Cloud servers located in Montreal, Canada. While stored outside the United States, your data remains protected under our Business Associate Agreement with Google Cloud and all applicable privacy requirements. Canadian privacy laws, including PIPEDA, provide strong protections for your information. Canadian authorities may have access to data stored in Canada under Canadian law.

Your personal data may also be processed by other trusted third-party service providers (such as Calendly and Attio), which may store data in the United States or other jurisdictions. We take steps to ensure appropriate safeguards are in place when information is transferred internationally.

6Compliance with Laws

We are committed to complying with applicable privacy laws, including:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada;
• State privacy laws in the United States, including the California Consumer Privacy Act (CCPA) where applicable; and
• Applicable regional and local privacy regulations in jurisdictions where we operate.

For clarity, we are not responsible for compliance with any privacy or data protection laws that may be applicable to you unless they are also generally applicable to Elderella, as a Canadian company, or they are mandated to apply to Elderella cross-jurisdictionally due to the nature of the Services and the personal information processed or stored by Elderella.

6.1 Healthcare Data Protection

We take the protection of health-related information seriously. Our processes and technical infrastructure, including our use of Google Cloud with appropriate security measures, are designed to meet healthcare industry standards for data protection, including with respect to Protected Health Information (PHI) under the US Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). We maintain Business Associate Agreements (BAAs) with our infrastructure partners, including Google Cloud, in compliance with HIPAA requirements, for the secure storage and handling of your personal and health data.

6.2 PIPEDA Compliance

As a Canadian corporation, we comply with PIPEDA requirements for the collection, use, and disclosure of personal information in the course of commercial activities. This includes obtaining meaningful consent, limiting collection to necessary purposes, ensuring accuracy, implementing appropriate safeguards, and providing individuals with access to their personal information upon request.

7Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website with a new effective date. We encourage you to review this Privacy Policy periodically.

8Contact Us

9Accessibility

We are committed to ensuring that our privacy practices are accessible to all individuals. If you need this Privacy Policy in an alternative format, please contact us.

10Additional Provisions for European Data

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of personal information.

"European Data" means personal information that is subject to the protection of European Data Protection Laws.

"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) in respect of the United Kingdom, any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; and (iv) Swiss Federal Act on Data Protection Act of September 25, 2020 and its Ordinance; in each case, as may be amended, superseded or replaced.

"Processing" means any operation or set of operations which is performed on personal information, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of personal information. The terms "Process", "Processes" and "Processed" will be construed accordingly.

"Processor" means a natural or legal person, public authority, agency or other body which Processes personal information on behalf of the Controller.

"Standard Contractual Clauses" means the standard contractual clauses for Processors approved pursuant to the European Commission's decision (C(2010)593) of 5 February 2010; as may be amended, superseded or replaced.

This 'Additional Provisions for European Data' section shall apply only with respect to European Data.

When Processing European Data for the Services or in accordance with your instructions, the parties acknowledge and agree that you are the Controller of European Data and Elderella is the Processor.

You acknowledge that in connection with the performance of the Services, Elderella is a recipient of European Data in Canada. The parties acknowledge and agree the following:

• Standard Contractual Clauses: Elderella agrees to abide by and process European Data in compliance with the Standard Contractual Clauses.
• Data Importer and Exporter Status: The parties agree that (i) purely for the purposes of the descriptions in the Standard Contractual Clauses, Elderella will be deemed the "data importer" and you will be deemed the "data exporter" (notwithstanding that you may be located outside Europe and/or be acting as a processor on behalf of third party controllers); and (ii) if and to the extent the Standard Contractual Clauses (where applicable) conflict with any provision of this Privacy Policy, the Standard Contractual Clauses will prevail to the extent of such conflict.

11Additional Provisions for California Personal Information

This "Additional Provisions for California Personal Information" section will apply only with respect to personal information subject to California law.

When processing California personal information for the Services and/or in accordance with your instructions, the parties acknowledge and agree that Elderella is a Service Provider for the purposes of the CCPA. The parties agree that Elderella will Process (as defined in Section 10 above) California personal information as a Service Provider strictly for the purpose of performing the Services under your agreement with Elderella (including the Elderella Terms of Service) or as otherwise permitted by the CCPA.