Privacy policy (draft)

1. Who we are and what this covers

Nearkin is run by [Legal company name], [mailing address]. In this policy, "we" means Nearkin.

This policy covers this website, the forms on it and the caregiver portal, where applicants sign in to follow their application and do their training.

Nearkin is not open for booking yet. Today you can apply as a caregiver, join the family waitlist or send us a message. We don't take bookings or payments.

Before booking opens, we'll update this policy. We won't collect anything new until we do.

2. Who is responsible

Our privacy officer is responsible for how we handle personal information.

Privacy officer: [name or title].

They make sure this policy is followed.
They answer privacy questions and requests.
They make sure everyone on the Nearkin team who sees personal information knows these rules.
Companies that help us run the site must protect your information under a written agreement.

3. What we collect

We only collect what you type into our forms, and a few technical details.

Caregiver applications, your path: whether you're joining as a Companion, a Home Helper or a PSW.
Caregiver applications, about you: your name, email, mobile number and postal code, and that you're 18 or older (a yes, never your age or birth date).
Caregiver applications, your experience: for PSWs, your certificate, registration status and years of experience. For Companions and Home Helpers, your caring experience and whether you'll do Nearkin training. For Home Helpers, which home tasks you're comfortable with.
Caregiver applications, your work: your languages, where you'd like to work, your usual hours, how you get around and, if you choose, interests you'd enjoy sharing with clients.
Caregiver applications, insurance and driving: whether you have liability insurance and would drive clients. If so, whether your car insurance covers business use.
Caregiver applications, your checks: your vulnerable sector check and its date, two references, and whether you can work in Canada. As we finish each check, we record the date.
Caregiver portal: your email, so we can send you a sign-in link, and when you signed in.
Caregiver training: which lessons you've done, how many tries each quiz took, your scores and when you passed.
Family waitlist: your name, email, your parent's postal code and when you need help.
Family waitlist: which kinds of help you're looking for: company, help at home, personal care, or not sure yet.
Family waitlist, if you choose: the languages your parent speaks, interests they enjoy and a short note about the help they need.
Messages: your name, email, the topic you pick and your message.
Every form: when you agreed to this policy, and which version you agreed to.
Spam protection: a scrambled (hashed) version of your internet address, kept for up to 24 hours. We never store the address itself.

4. What we don't collect

We collect only what we need. We never ask for:

Age or date of birth. Caregivers only confirm they're 18 or older. Families never choose caregivers by age.
Gender, marital or family status, or religion. "Going with someone to their place of worship" is an activity you can offer, not a question about your beliefs.
Where you're from, citizenship or immigration details.
Photos or health conditions of caregivers.
Your parent's health details. Please leave them out of the waitlist note.

Approved caregivers give their SIN, banking details and documents later, after an interview. That happens through a separate secure process, not this website.

5. Why we collect it

Applications: to review your application, contact you about an interview and, after the interview, contact your references.
Checks and training: to know when you're ready for visits. We only activate caregivers who have passed every check and their training, and sent proof of insurance.
Interests: to suggest caregivers and clients who'll enjoy each other's company. They're never used to rank or exclude anyone.
Insurance and driving answers: to know which visits we can offer you. For example, driving visits are only for caregivers with business-use car insurance.
Caregiver portal: to show you where your application is, what's next and your training.
Waitlist: to contact you when caregivers are available near your parent, and to suggest the right kind of caregiver.
Messages: to reply to you.
Spam protection: to stop automated sign-ups.

We don't sell personal information. We don't use it for advertising.

If we want to use your information for a new purpose, we'll ask you first.

Each form has a box you tick to agree to this policy. We record when you agreed and to which version.
Before you give us someone else's details, such as a reference, please make sure they agree.
You can withdraw your consent at any time. For example, you can leave the waitlist or withdraw an application.
To withdraw, send us a message and choose "Privacy". We'll tell you if this affects anything, for example that we can't keep reviewing your application.

Only members of the Nearkin team on our admin list, after they sign in. Every change they make is recorded with their name.
In the portal, each caregiver sees only their own application, checks and training. They never see our internal notes.
Caregivers don't see the waitlist or messages. Families don't see applications.
When something new arrives, our team gets an email. It has no personal details, only a link to sign in.
Supabase stores our database and handles sign-in for our team and caregivers. Cloudflare hosts the website. Resend sends our emails. [Confirm each provider's data-processing agreement.]
We share information if the law requires it, for example a court order. [Confirm wording with a lawyer.]
We don't share your information with anyone else without your consent.

8. Where it's stored

Everything you submit is stored in Canada, in a Supabase database in AWS Canada Central (Montréal).
The code that saves your form runs on Cloudflare's network, in the data centre closest to you. For visitors in Canada that's usually in Canada, but Cloudflare may route a request through data centres outside Canada. Nothing is stored there.
[Confirm in writing with each provider where data, backups and logs are kept.]

9. How long we keep it

We keep information only as long as we need it. Then we delete it. These are our proposed periods:

Applications that don't go ahead: 12 months after our last contact with you. [confirm]
Caregivers who join Nearkin: while you work with us, then 7 years for tax and legal records. [confirm]
Training results and portal sign-in: kept with your application, for the same time. [confirm]
Waitlist: until you ask to leave, or 24 months after you join, whichever comes first. [confirm]
Messages: 24 months after our last reply. [confirm]
Spam-protection data: deleted within 24 hours.
If you ask us about your information, we keep it long enough for you to use your rights.

10. Keeping it accurate

We use the information you give us. Please tell us if something changes, such as your email.
If something is wrong, we'll correct it. If it matters, we'll also tell anyone we shared it with.

11. Keeping it safe

Your information is encrypted while it travels and while it's stored.
Only signed-in team members on our admin list can see everything. Caregivers who sign in can see only their own information. Every change is recorded.
Caregivers sign in with a one-time link sent to their email, with no password to forget or steal.
Our team emails never include personal details.
Application drafts stay in your browser tab until you send them. They're cleared when you close the tab.
A breach could put you at real risk of significant harm. If that happens, we'll tell you and the Privacy Commissioner of Canada quickly.
We keep a record of every breach, as the law requires.

12. Cookies and tracking

The public website doesn't use tracking or advertising cookies.
Caregivers who sign in to the portal, and Nearkin team members who sign in to the admin, get a sign-in cookie. It's deleted when you sign out.
[Confirm before launch whether we'll use analytics. If we do, we'll update this section first.]

13. Seeing and correcting your information

You can ask to see the personal information we hold about you. You can also ask how we use it and who has seen it.
Caregivers can see their application, checks and training in the portal at any time.
You can ask us to correct it or delete it.
It's free. We may ask you to confirm who you are first.
We'll reply within 30 days. If we need more time, we'll tell you why.
If we can't give you something, we'll explain why, unless the law doesn't allow us to.
To ask, send us a message and choose "Privacy".

14. If you have a concern

Please tell our privacy officer first. We'll look into it and tell you what we found.
If we got something wrong, we'll fix it and change how we work.
You can also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
[When booking opens and we hold health information, add the Information and Privacy Commissioner of Ontario (PHIPA).]

15. Changes to this policy

When we change this policy, we'll update the date at the top.
If a change affects how we use information you've already given us, we'll tell you first. We'll ask again if we need new consent.

16. Contact our privacy officer

[Privacy officer name or title]
[Legal company name], [mailing address]
Or send us a message and choose "Privacy".