This Privacy Policy explains how [PLACEHOLDER: company name, e.g. OwnLee Inc.] ("OwnLee", "we", "us" or "our") collects, uses, discloses and protects personal information. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, the EU and UK General Data Protection Regulation (GDPR) and the U.S. Health Insurance Portability and Accountability Act (HIPAA).
Information that clients store inside their own OwnLee-built system is covered separately in section 6.
Information you give us. When you email us, reserve a slot or apply for a job, you may give us your name, email address, phone number, company name, role, the size of your team, details about your needs, and anything else you choose to include, such as a resume.
Information collected automatically. Like most websites, the servers that deliver the Site record basic technical information, such as your IP address, browser and device type, the pages you visit and the date and time of your visit.
We do not knowingly collect sensitive information through the Site. Please do not send us health or other sensitive information unless we ask for it under a Client Agreement.
We only use personal information for the purposes we tell you about, or for purposes a reasonable person would expect. If we want to use it for a new purpose, we will ask for your consent first.
Under PIPEDA, we rely on your consent, which may be express (for example, when you send us your details) or implied, depending on the sensitivity of the information. You can withdraw consent at any time, subject to limits set by law or contract; withdrawing consent may affect our ability to work with you.
Where GDPR applies, we process personal information because it is needed to take steps toward or perform a contract with you, for our legitimate interests in running and growing our business, to comply with the law, or with your consent.
We never sell personal information. We share it only with:
Each client owns its system and the data in it. When we host, maintain and support a client's system, we handle that data on the client's behalf and only on its instructions: under GDPR the client is the controller and OwnLee is a processor, and under HIPAA OwnLee acts as a business associate where applicable. We sign a data processing agreement or a business associate agreement with clients that need one. [PLACEHOLDER: confirm DPA / BAA templates with counsel]
If you are an employee or customer of one of our clients and have a question about your information in that client's system, please contact the client directly. We will help them respond.
Client systems are hosted on AWS, with files stored in Amazon S3, in the [PLACEHOLDER: AWS region(s), e.g. Canada (Central)] region. Some of our service providers may store or process information outside Canada, including in the United States, where it may be accessible to local authorities under local law. Where GDPR applies, we use appropriate safeguards, such as standard contractual clauses, for transfers outside the EU or UK.
We keep personal information only as long as we need it for the purposes above or as the law requires. As a general guide:
Data inside a client system is kept and deleted according to the Client Agreement and the client's instructions.
We use administrative, technical and physical safeguards suited to the sensitivity of the information, including encryption, access controls limited to the people who need them, and hosting on AWS infrastructure. Our practices are designed to meet HIPAA and GDPR requirements. No system is perfectly secure, but if a breach creates a real risk of significant harm, we will notify affected people and the regulators as the law requires.
Subject to applicable law, you may ask to:
To make a request, email info@ownlee.co. We will reply within 30 days, or tell you if we need more time as the law allows. We may need to confirm your identity first.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where GDPR applies, to your local data protection authority.
The Site and our services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under [PLACEHOLDER: minimum age, e.g. 16].
We may update this policy from time to time. If we make significant changes, we will take reasonable steps to let you know.
Our Privacy Officer is [PLACEHOLDER: Privacy Officer name and title]. You can reach them at info@ownlee.co or by mail at [PLACEHOLDER: company name, e.g. OwnLee Inc.], [PLACEHOLDER: mailing address].