Your information, treated with care.

KinDock is a secure, family-centred communication platform for supported living. It is operated by [Legal Entity Name] ("KinDock", "we", "us", or "our"), the parent company of which is Muldoon Web Design. This Privacy Policy describes how we handle personal information collected through the KinDock website and application (the "Service").

We designed KinDock for adults with developmental disabilities who live in group homes, supported living, and similar arrangements, together with their approved family connections and support teams. Because the people at the centre of the Service may be vulnerable, we hold ourselves to a high standard of privacy and restraint in how information is collected and shared.

When a developmental service agency, residential provider, home, or family arrangement (a "customer organization") uses KinDock, that organization decides what information about the people it supports is entered into the Service and who may access it. In privacy terms, the customer organization is the data controller for the information about the people it supports, and KinDock acts as its data processor, handling that information on the organization's behalf and under its instructions.

If your information is held in KinDock because a customer organization invited you, or because you are a person supported by that organization, requests to access, correct, or delete that information are usually best directed to the organization. We will support the organization in responding, and we will assist you in reaching the right contact. For account information you provide directly to us, KinDock is the controller.

We collect the following categories of information:

• Account information. Your name, email address, the password you set (stored only in a securely hashed form), and your role within an organization or home.
• Organization and home information. Organization or home name, structure, the homes or locations within it, and the roles and assignments of staff and family members.
• People-supported profiles. Non-clinical profile details entered by the customer organization, such as a display name, preferences, and an optional photo. KinDock is not a clinical or health record system, and it is not intended for medical, medication, or incident-reporting information.
• Content and updates. Posts, updates, photos, calendar events, secure messages, video-visit links, and similar content shared through the Service, along with the audience each item is shared with.
• Consent records. Records of consents captured through KinDock's consent features, including what was consented to, by whom, and when.
• Usage and audit logs. Records of sensitive actions (such as invitations, access and consent changes, and content changes), together with technical information such as log timestamps and limited device or browser information needed to operate and secure the Service.
• Cookies. We use only cookies that are essential to sign you in and keep the Service secure and working. We do not use advertising cookies, and where a non-essential cookie or analytics choice is offered, we default to declining it.

We use personal information to:

• provide, maintain, and secure the Service and the accounts within it;
• show content only to the people who are approved to see it, based on relationships and assignments;
• record and honour consents, including withdrawals of consent;
• send transactional and service messages, such as invitations, notifications, and digests;
• keep audit history for accountability and to investigate misuse or security concerns;
• provide customer support and respond to your requests;
• administer subscriptions and billing once paid plans are available; and
• comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not use the content within KinDock for advertising.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Depending on their sector and province, some customer organizations may also be subject to provincial health-privacy legislation as data controllers; those organizations remain responsible for their own obligations under those laws.

Consistent with PIPEDA's meaningful-consent principles, we aim to collect and use information for purposes a reasonable person would consider appropriate in the circumstances. KinDock's own consent-record feature helps customer organizations capture and manage consent for sharing about a person supported. Where consent is the basis for handling information, it may be withdrawn, subject to legal and contractual limits, and withdrawal takes effect on a going-forward basis.

We do not disclose personal information except as described in this policy. We rely on a small set of trusted service providers (subprocessors) to operate the Service. Each is bound to protect information and to use it only to provide services to us. Our current subprocessors are:

We may also disclose information where required by law, to protect the rights and safety of people using the Service, or in connection with a corporate transaction, in which case we will require that the information continue to be protected consistent with this policy.

KinDock's database, authentication, and file storage run on Supabase in the Canadian region (ca-central-1), and application hosting runs on Vercel in Montréal (yul1). Customer data at rest is held in Canada. Any service that would process personal data outside Canada is identified and reviewed before we introduce it, rather than added silently.

We work to keep personal information within Canada. Where a service provider or communication (for example, email delivery or bot protection) may process limited information outside Canada, we minimize what is involved and require appropriate safeguards. While information is handled by a provider in another country, it may be subject to the laws of that country, including lawful access by its authorities. We will update this policy if the nature of any such transfer changes materially.

We use layered technical and organizational safeguards, including:

• database-enforced boundaries (row-level security) so access to a person's information is scoped to that person's approved circle, not granted by employment or interface alone;
• encryption of data in transit, and encryption of data at rest by our hosting provider;
• relationship-based and assignment-based access, decided on the server for every request;
• secure, expiring invitations and revocable calendar feeds;
• audit logging of sensitive actions in an uneditable history; and
• time-limited and logged operator support access.

No system can be guaranteed perfectly secure, but we design KinDock so that the default is privacy, and we review our safeguards as the Service grows. You can read more on our Security & Privacy page.

We keep personal information only as long as needed for the purposes described in this policy, to provide the Service to the customer organization, and to meet legal, accounting, and audit requirements. Where appropriate, we use soft deletion so that audit integrity is preserved while information is removed from everyday view. Default retention periods are being finalized and will be described here once confirmed.

When a customer organization ends its use of KinDock, we make its data available for export for a limited period and then delete or de-identify it in line with our agreement and applicable law, unless a longer retention is legally required.

Subject to legal limits, you have the right to:

• ask what personal information we hold about you and access it;
• ask us to correct information that is inaccurate or incomplete;
• withdraw consent to certain uses, on a going-forward basis;
• ask questions about how your information is handled; and
• make a complaint to the Office of the Privacy Commissioner of Canada if you are not satisfied with how a concern has been addressed.

Where your information is held on behalf of a customer organization, we will direct your request to that organization as the controller and help facilitate a response. To make a request to KinDock directly, use the contact details below. We may need to verify your identity before acting on a request.

KinDock is designed for adults living in supported settings, together with their approved family connections and support teams. The Service is not directed to children and is not intended for the creation of accounts by children. We do not knowingly collect personal information from children through the Service. If you believe a child's information has been provided to us in error, please contact us so we can address it.

We may update this policy from time to time. When we make a material change, we will revise the "Last updated" date and, where appropriate, provide additional notice. Your continued use of the Service after an update means the updated policy applies to you.

For privacy questions or to make a request, contact our privacy contact:

• Email: privacy@kindock.ca [placeholder address, to be confirmed]
• Operator: [Legal Entity Name]
• Mailing address: [Business Address]

For general support, you can reach us at support@kindock.ca [placeholder address, to be confirmed].