Privacy Policy隐私政策

1. Definitions1. 定义

Key terms used throughout this policy:本政策中使用的关键术语：

• Personal Data:个人数据：Information that identifies or can identify you, such as name, email, phone, and account details.可以识别您身份的信息，例如姓名、电子邮箱、电话及账户信息
• Protected Health Information (PHI):受保护的健康信息（PHI）：Health records including medical history, blood panels, test results, clinical notes, and biometric data, governed by PHIPA.受 PHIPA 管辖的健康记录，包括病史、血液检测、检查结果、临床记录及生物识别数据
• Data Controller:数据控制方：Careby Solutions Inc., which determines how and why your data is collected and processed.Careby Solutions Inc.，负责决定您的数据如何收集、如何处理
• Data Processors:数据处理方：Third-party service providers (e.g., Dynacare, GoToDoctor, and our SafeHome monitoring technology partner) who process data on our behalf under strict agreements.代表我们处理数据的第三方服务商（例如 Dynacare、GoToDoctor 及我们的 SafeHome 监测技术伙伴），均受严格协议约束
• PHIPA:PHIPA：Ontario's Personal Health Information Protection Act, which governs the collection, use, and disclosure of health information.安大略省《个人健康信息保护法》，规范健康信息的收集、使用与披露

2. Information Collection and Use2. 信息的收集与使用

We collect information in the following ways:我们通过以下方式收集信息：

• Directly from you:直接来自您：When you sign up, complete a health assessment, or interact with our platform.当您注册、完成健康评估或使用我们的平台时
• From healthcare providers:来自医疗服务方：Medical records, lab results, and clinical notes provided by your physician or our partner network.由您的医生或我们的合作网络提供的医疗记录、化验结果与临床记录
• From partner services:来自合作服务：Data from Dynacare (labs), GoToDoctor (virtual consultations), and SafeHome monitoring (contactless home monitoring), shared with your consent.来自 Dynacare（化验）、GoToDoctor（线上问诊）及 SafeHome 监测（无接触居家监测）的数据，经您同意后共享
• Automatically:自动收集：Usage data, device information, and analytics to improve our services and ensure security.使用数据、设备信息与分析数据，用于改进服务并保障安全

3. Types of Information Collected3. 收集的信息类型

We collect the following categories:我们收集以下几类信息：

Personal Data (Non-Health)个人数据（非健康类）

• Name, email, phone, address, date of birth姓名、电子邮箱、电话、地址、出生日期
• Account credentials and login information账户凭据与登录信息
• Payment information (processed securely by Stripe, PCI-DSS compliant)付款信息（由 Stripe 安全处理，符合 PCI-DSS 标准）
• Emergency contacts and family member details紧急联系人及家庭成员信息

Protected Health Information (PHI)受保护的健康信息（PHI）

• Clinical records and medical history临床记录与病史
• Blood panel results and biomarker data血液检测结果与生物标志物数据
• Biometric information (e.g., from home monitoring devices)生物识别信息（例如来自居家监测设备）
• Wellness and activity data from SafeHome home monitoring来自 SafeHome 居家监测的健康与活动数据
• Care-related usage data (e.g., caregiver visit notes)与护理相关的使用数据（例如护理人员的上门记录）

Usage Data & Analytics使用数据与分析

• Pages visited, time spent, clicks, and interactions浏览的页面、停留时间、点击与交互
• Device information (OS, browser, IP address)设备信息（操作系统、浏览器、IP 地址）
• Cookies and tracking data to improve user experience用于改善使用体验的 Cookie 与跟踪数据

4. Your Rights Under PHIPA4. 您在 PHIPA 下的权利

As an Ontario resident, you have the following rights:作为安大略省居民，您享有以下权利：

• Right to access:查阅权：Request a copy of your PHI at any time. We will provide it within 30 days.随时索取您的 PHI 副本，我们将在 30 天内提供
• Right to amend:更正权：Request corrections to inaccurate health information in your record.要求更正记录中不准确的健康信息
• Right to withdraw consent:撤回同意权：Stop the collection, use, or disclosure of your PHI at any time, subject to legal obligations.随时停止对您 PHI 的收集、使用或披露（法律要求保留的除外）
• Right to lodge a complaint:投诉权：File a complaint with the Information and Privacy Commissioner of Ontario (IPC) if you believe your privacy rights have been violated.如您认为自己的隐私权受到侵害，可向安大略省信息与隐私专员（IPC）投诉

5. Use of Your Information5. 信息的使用

Personal Data (Non-Health) Uses个人数据（非健康类）的用途

• Create and manage your account创建并管理您的账户
• Process payments and billing处理付款与账单
• Provide customer support and respond to inquiries提供客户支持并回应咨询
• Send service updates and important notifications发送服务更新与重要通知
• Coordinate care with your caregiver or family members (with consent)与您的护理人员或家人协调护理（经您同意）
• Improve platform functionality and user experience改进平台功能与使用体验

Protected Health Information (PHI) Uses受保护的健康信息（PHI）的用途

• Provide health panels, clinical assessments, and test result delivery提供健康体检、临床评估并送达检测结果
• Support virtual doctor consultations and medical recommendations支持线上医生问诊与医疗建议
• Deliver home monitoring services and care intelligence alerts to your family提供居家监测服务，并向您的家人发送护理提醒
• Coordinate care with your healthcare providers and Dr. Jerry Leung (Careby Medical Director)与您的医疗服务方及康伴医疗总监梁医生（Dr. Jerry Leung）协调护理

6. Consent to Collection and Use of Data6. 对数据收集与使用的同意

Personal Data Consent个人数据的同意

When you create an account, you consent to the collection and use of your personal data for account management, billing, and service delivery. You may withdraw this consent at any time, though this may affect service availability.当您创建账户时，即表示您同意我们为账户管理、计费及提供服务而收集和使用您的个人数据。您可以随时撤回该同意，但这可能影响部分服务的使用。

Protected Health Information Consent受保护的健康信息的同意

Express Consent Required: We obtain explicit, signed consent before collecting, using, or disclosing your PHI. This includes:须经明确同意：在收集、使用或披露您的 PHI 之前，我们会先取得您明确的书面同意，内容包括：

• What PHI will be collected (e.g., blood panel results, home monitoring data)将收集哪些 PHI（例如血液检测结果、居家监测数据）
• Why it will be collected (e.g., to provide health panels, deliver care intelligence)收集的原因（例如提供健康体检、发送护理提醒）
• How it will be used and disclosed将如何使用与披露
• To whom it will be shared (e.g., Dr. Jerry, GoToDoctor, your designated family member)将与谁共享（例如梁医生、GoToDoctor、您指定的家庭成员）

How to Withdraw Consent: You may withdraw consent at any time by contacting us at hello@getcareby.ca. We will cease collection and use of new data, though existing data uses under prior consent remain valid.如何撤回同意：您可以随时发邮件至 hello@getcareby.ca 撤回同意。我们将停止收集和使用新的数据；在此之前经您同意的数据使用仍然有效。

No Marketing Without Opt-In未经您主动同意，不用于营销

We do not use PHI for marketing or promotional purposes without your explicit opt-in consent. Marketing communications are sent only to those who have actively chosen to receive them.未经您明确的主动同意，我们不会将 PHI 用于营销或推广。营销信息仅发送给主动选择接收的用户

7. Retention of Personal Data and PHI7. 个人数据与 PHI 的保留

We retain your data as follows:我们按以下方式保留您的数据：

• Active Account:活跃账户：While you maintain a subscription or active account, all data is retained to provide services.在您持有会员或活跃账户期间，所有数据均予保留，用于提供服务
• After Account Closure:账户关闭后：PHI is retained for 7 years in secure archive to comply with PHIPA requirements and support any necessary care continuity. Personal data is deleted within 90 days, except where required by law.PHI 在安全存档中保留 7 年，以符合 PHIPA 要求并支持必要的护理衔接；个人数据在 90 天内删除（法律另有要求的除外）
• Regulatory Hold:监管要求的保留：Data may be retained longer if required by law or for legal proceedings.如法律要求或涉及法律程序，数据可能保留更长时间

8. Transfer of Data8. 数据的转移

PHI Stays in Canada: All Protected Health Information remains within Canada and is not transferred outside our borders without explicit legal authority.PHI 保留在加拿大境内：所有受保护的健康信息均存储在加拿大境内，未经明确的法律授权不会转移至境外

Personal Data: Non-health personal data may be transferred internationally to our service providers (e.g., Stripe for payments, AWS for hosting) where appropriate safeguards are in place.个人数据：非健康类个人数据可能转移给我们的国际服务商（例如处理付款的 Stripe、提供托管的 AWS），并均有适当的保护措施。

9. Disclosure of Your Information9. 信息的披露

PHI DisclosuresPHI 的披露

We disclose your PHI only with your express consent and in the following cases:我们仅在您明确同意的情况下披露您的 PHI，对象与用途如下：

Personal Data Disclosures个人数据的披露

Non-health personal data may be disclosed to:非健康类个人数据可能披露给：

10. Security of Your Information10. 信息的安全

We implement industry-standard security measures to protect your data:我们采用行业标准的安全措施保护您的数据：

• Encryption in transit:传输加密：All information you send us travels over encrypted connections (TLS).您发送给我们的所有信息均通过加密连接（TLS）传输
• Encryption at rest:存储加密：Where we store health information, it is encrypted at rest with dedicated encryption keys, in Canadian data centres.凡我们存储健康信息之处，均使用专用加密密钥，在加拿大境内的数据中心加密存储
• Payments:付款：Payment card details are handled entirely by Stripe, a certified payment processor. Card numbers never touch Careby's systems.银行卡信息完全由认证支付机构 Stripe 处理，卡号绝不经过康伴的系统
• Data minimization:数据最小化：Our website contact forms forward your message directly to our care team by secure email and are not stored in a website database.网站联系表格会将您的留言通过安全邮件直接转给护理团队，不存储在网站数据库中
• Access Control:访问控制：Your information is handled by our care team on a need-to-know basis, and systems we build for health information are designed so that every access is recorded.您的信息仅由护理团队按“必要知情”原则处理；我们为健康信息构建的系统在设计上会记录每一次访问
• Canadian data residency:数据存储在加拿大：Our cloud infrastructure runs in AWS's Canadian region.我们的云基础设施位于 AWS 加拿大区域
• Third-Party Security:第三方安全：Our service providers (Dynacare, GoToDoctor, our monitoring technology partner, and AWS) maintain their own security standards and are contractually bound to protect your data.我们的服务商（Dynacare、GoToDoctor、监测技术伙伴及 AWS）均维持自身的安全标准，并负有保护您数据的合同义务。

11. Rights for EU/EEA Users (GDPR Compliance)11. 欧盟/欧洲经济区用户的权利（GDPR 合规）

If you are located in the EU or EEA, you have additional rights under the General Data Protection Regulation (GDPR):如果您位于欧盟或欧洲经济区，您在《通用数据保护条例》（GDPR）下享有额外权利：

• Right to Access: Request a copy of your personal data in a portable format.查阅权：以可携带格式索取您的个人数据副本
• Right to Rectification: Correct inaccurate or incomplete data.更正权：更正不准确或不完整的数据
• Right to Erasure: Request deletion of your data under certain conditions ("right to be forgotten").删除权：在特定条件下要求删除您的数据（“被遗忘权”）
• Right to Restrict Processing: Limit how we use your data.限制处理权：限制我们使用您数据的方式
• Right to Data Portability: Receive and transfer your data to another service.数据可携权：获取您的数据并转移至其他服务
• Right to Object: Object to certain uses of your data.反对权：反对对您数据的某些使用

To exercise these rights, contact hello@getcareby.ca. We will respond within 30 days.如需行使上述权利，请联系 hello@getcareby.ca，我们将在 30 天内回复

12. California Privacy Rights (CCPA Compliance)12. 加州隐私权（CCPA 合规）

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):如果您是加州居民，您在《加州消费者隐私法》（CCPA）下享有以下权利：

• Right to Know: Request what personal information we have collected about you.知情权：了解我们收集了您的哪些个人信息
• Right to Delete: Request deletion of your personal information.删除权：要求删除您的个人信息
• Right to Opt-Out: Opt out of the sale or sharing of your personal information.选择退出权：拒绝出售或共享您的个人信息
• Right to Non-Discrimination: We do not discriminate against you for exercising your CCPA rights.免受歧视权：我们不会因您行使 CCPA 权利而区别对待您

Do Not Track: We honour the Do Not Track (DNT) browser setting. This website does not track visitors at all, so there is nothing for DNT to limit — see section 13.禁止跟踪：我们遵守浏览器的禁止跟踪（DNT）设置。本网站完全不追踪访客，因此 DNT 无需限制任何内容——详见第 13 节

13. Analytics and Cookies13. 分析与 Cookie

This website does not run advertising, tracking, or analytics cookies. It stores a single preference on your device:本网站不使用广告、追踪或分析类 Cookie，仅在您的设备上保存一项偏好设置：

• Language preference:语言偏好：Your choice of English or 中文, saved in your browser's local storage so the site opens in the same language next time. It is never sent to us or to anyone else.您选择的英文或中文，保存在浏览器本地存储中，以便下次以相同语言打开网站。该信息不会发送给我们或任何第三方

You can clear it at any time through your browser settings. Doing so only means the site reopens in its default language.您可随时通过浏览器设置清除该信息，清除后网站将以默认语言重新打开，不影响其他功能

Separate platforms we work with — such as the GoToDoctor patient portal and our payment processor Stripe — set their own cookies when you use them, governed by their own privacy policies. If we add analytics to this website in future, we will update this section and ask for your consent first.我们合作的独立平台（例如 GoToDoctor 会员门户与支付服务商 Stripe）在您使用时会设置各自的 Cookie，受其自身隐私政策约束。若日后本网站引入分析工具，我们会先更新本节内容并征得您的同意

14. Payment Processing & Security14. 付款处理与安全

All payment information is processed securely through Stripe, which is PCI-DSS compliant:所有付款信息均通过符合 PCI-DSS 标准的 Stripe 安全处理：

• Careby does not store or have access to your credit card details.康伴不存储、也无法访问您的银行卡信息
• All transactions are encrypted and processed in compliance with industry standards.所有交易均经加密，并按行业标准处理
• For questions about payment security, contact Stripe directly at stripe.com/security.有关付款安全的问题，请直接联系 Stripe：stripe.com/security

15. Links to Other Websites15. 第三方网站链接

Our website may contain links to third-party websites (e.g., GoToDoctor, Dynacare). We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any information.我们的网站可能包含第三方网站的链接（例如 GoToDoctor、Dynacare）。我们无法对其隐私做法负责，建议您在提供任何信息之前先查看对方的隐私政策。

16. Children's Privacy16. 未成年人隐私

Careby services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a minor has provided information, we will delete it within 30 days. If you believe a child has provided us with information, please contact us immediately at hello@getcareby.ca.康伴服务不面向 18 岁以下人士。我们不会有意收集未成年人的个人信息。如发现未成年人提供了信息，我们将在 30 天内删除。如您认为有儿童向我们提供了信息，请立即联系 hello@getcareby.ca。

17. Changes to This Privacy Policy17. 本隐私政策的更新

We may update this policy from time to time. Material changes will be notified to you via email or through a prominent notice on the website. Your continued use of Careby after such changes constitutes your acceptance of the updated policy.我们可能不时更新本政策。重大变更将通过电子邮件或网站显著位置的通知告知您。变更后您继续使用康伴，即表示您接受更新后的政策。

18. Contact Us18. 联系我们

If you have questions about this privacy policy or your data, please contact us:如对本隐私政策或您的数据有任何疑问，请联系我们：

• Email: hello@getcareby.ca邮箱： hello@getcareby.ca
• Phone: 905-305-3107电话：905-305-3107
• Address: Careby Solutions Inc., 205 Placer Ct #513, North York, ON, Canada地址：Careby Solutions Inc.，加拿大安大略省北约克 Placer Ct 205 号 513 室

Privacy Commissioner: If you believe your privacy rights have been violated, you may lodge a complaint with the Information and Privacy Commissioner of Ontario (IPC):隐私专员：如您认为自己的隐私权受到侵害，可向安大略省信息与隐私专员（IPC）投诉：

• www.ipc.on.cawww.ipc.on.ca
• Phone: 1-800-387-0073电话：1-800-387-0073