NeedleAID Privacy Policy

Last updated: [DATE] • Effective date: [DATE]

This Privacy Policy explains how DECAP Research and Development Corp. ("DECAP", "we", "us", or "our") handles personal information in connection with NeedleAID, our smart sharps container monitoring system. We take privacy seriously and we comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector, as modernized by Law 25.

1. Our role

NeedleAID is provided to organizations — hospitals, care homes, and similar (your "Employer"). For most of the data in the system, your Employer decides why and how it is used, and we process it on their behalf under our contract with them. For some operational data, we act on our own behalf, as described below.

2. Privacy Officer

As required by Quebec law, we have appointed a person responsible for the protection of personal information. You can contact them about anything in this policy:

Privacy Officer DECAP Research and Development Corp. [NAME / TITLE] [EMAIL] • [PHONE] • [MAILING ADDRESS]

3. What information we collect

Category Examples
Account information Name, work email, role, Employer, login credentials
Usage information Logins, actions taken in the system, servicing records, timestamps
Facility & asset data Floorplans, container locations, inventory, sensor readings
Technical information Device/browser type, IP address, log data needed for security and support

We collect this information directly from you, from your Employer, and automatically as you use the system.

4. Why we use it

We only collect what we need for these purposes. If we ever want to use your information for a new purpose, we'll ask for your consent unless the law allows otherwise.

5. Consent

By logging in and agreeing to our Terms of Use, you consent to the handling of your personal information as described here. Some processing is also necessary to provide the service you and your Employer have signed up for. You can withdraw consent where applicable, but note this may affect your ability to use the system — and your access also depends on your relationship with your Employer.

6. Who we share it with

We do not sell your information, and we do not share your or your Employer's data with outside parties — with one exception: our own staff and our own contractors may access it solely to develop, maintain, and operate NeedleAID. Anyone who accesses it is bound by confidentiality and privacy obligations.

We may also disclose information if we're legally required to (for example, in response to a valid court order), or to protect the safety and security of people or the system.

7. Where your information is stored, and transfers outside Quebec

Your information is stored and processed in Montreal QC, Delta BC and Victoria BC.

8. How we protect it

We use reasonable technical, physical, and organizational safeguards — such as encryption, access controls, and monitoring — appropriate to the sensitivity of the information. No system is perfectly secure, but we work hard to keep yours safe.

9. How long we keep it

We keep personal information only as long as needed for the purposes above, to meet our obligations to your Employer, and to comply with legal requirements. When it's no longer needed, we securely delete or anonymize it.

10. Your rights

Under PIPEDA and Quebec law, you have the right to:

To exercise any of these, contact our Privacy Officer above. We'll respond within the timeframe the law requires (generally 30 days). Because much of the data belongs to your Employer, we may need to direct some requests to them.

11. If there's a privacy breach

If a confidentiality incident occurs that poses a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and affected individuals as required by law, and we'll keep a register of incidents. We'll also work with your Employer on the appropriate response.

12. Cookies and tracking

NeedleAID uses first party secure cookies and similar technologies that are necessary for the system to function (for example, to keep you logged in) and to keep it secure. We do not use any non-essential, analytic or tracking cookies or technologies.

13. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the new version here and update the date at the top. If changes are significant, we'll provide additional notice.

14. Language

This policy is available in French and English, as required by Quebec law. [The French version is a working translation and has not yet been reviewed by counsel.]

15. Questions or complaints

Start with our Privacy Officer (Section 2). If you're not satisfied, you may contact:

This is a draft template, not legal advice. Quebec's Law 25 has detailed and evolving requirements (Privacy Officer, breach register, privacy impact assessments for transfers, automated decision-making disclosures, French-language obligations). Have a Quebec-qualified privacy lawyer review before you publish.