PHIPA Compliance Statement

PHIPA is Ontario legislation that governs how health information custodians collect, use, disclose, retain, and dispose of personal health information. It gives individuals the right to access and correct their own PHI and establishes obligations for organizations that handle PHI to implement appropriate privacy and security safeguards.

PHIPA defines personal health information broadly to include identifying information about an individual's physical or mental health, health history, health care services received, eligibility for health care, and payments for health care.

Nuvara Connect operates as a health information custodian and, in certain contexts, as an agent of health information custodians (such as licensed care facilities using our Caregiver Portal).

Where Nuvara Connect acts as an agent of a health information custodian (e.g., a long-term care facility), we handle PHI only as directed by and on behalf of that custodian, in accordance with PHIPA and any applicable agreements.

Depending on the features used, Nuvara Connect may handle the following categories of personal health information:

• Medication names, dosages, schedules, and adherence records.
• Wellness check-in responses (mood, pain levels, energy, sleep quality).
• Cognitive assessment results and trend data.
• Mobility and physical activity data.
• Aging intelligence scores and risk domain assessments.
• Care notes and observations entered by professional caregivers.
• Alerts and notifications related to health status changes.

We do not collect clinical diagnostic data, laboratory results, or imaging data. Nuvara Connect is a wellness monitoring and care coordination tool, not a clinical electronic health record (EHR) system.

We collect PHI only with the knowledge and consent of the individual (or their authorized representative), except where PHIPA permits collection without consent (e.g., for emergency purposes or as required by law).

Consent is obtained at account registration and, where applicable, through in-app consent flows when new categories of PHI are collected. Individuals may withdraw consent at any time by contacting our Privacy Officer, subject to legal or contractual restrictions.

We collect only the minimum PHI necessary to provide the requested services (the principle of data minimization).

We use and disclose PHI only for the purposes for which it was collected or as permitted by PHIPA, including:

• Care coordination: Sharing wellness data with authorized family members and caregivers within the user's care network.
• Service delivery: Generating wellness scores, alerts, reminders, and reports for the individual and their authorized care team.
• Platform improvement: Analyzing de-identified, aggregated data to improve platform features and algorithms. Individual PHI is never used for this purpose without explicit consent.
• Legal compliance: Disclosing PHI where required by law, court order, or to prevent serious harm.

We do not sell, rent, or trade PHI. We do not disclose PHI to third parties for marketing or advertising purposes.

We have implemented the following technical, administrative, and physical safeguards to protect PHI:

We retain PHI only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

• Active accounts: PHI is retained for the duration of the account.
• Deleted accounts: PHI is securely deleted or anonymized within 90 days of account deletion, unless longer retention is required by law.
• Caregiver Portal records: Care notes and resident records may be subject to minimum retention periods under applicable provincial health legislation.

When PHI is no longer required, it is destroyed using secure methods (cryptographic erasure for electronic records) that render the information unrecoverable.

Under PHIPA, individuals have the right to:

• Access their PHI: Request a copy of their personal health information held by Nuvara Connect.
• Correct their PHI: Request correction of inaccurate or incomplete PHI.
• Withdraw consent: Withdraw consent to the collection, use, or disclosure of their PHI, subject to legal restrictions.
• Complain: File a complaint with the Information and Privacy Commissioner of Ontario if they believe their rights under PHIPA have been violated.

To exercise any of these rights, contact our Privacy Officer at [email protected]. We will respond within 30 days as required by PHIPA.

In the event of a privacy breach involving PHI, Nuvara Connect will:

• Contain the breach and conduct a risk assessment as quickly as possible.
• Notify affected individuals at the first reasonable opportunity if the breach creates a real risk of significant harm.
• Notify the Information and Privacy Commissioner of Ontario as required by PHIPA.
• Document the breach and our response in our breach register.
• Implement corrective measures to prevent recurrence.

If you believe your PHI has been compromised, please contact us immediately at [email protected].

Nuvara Connect has designated a Privacy Officer responsible for overseeing PHIPA compliance, handling privacy inquiries and complaints, and maintaining our privacy program.

If you are not satisfied with our response to a privacy concern, you have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC):

This statement is reviewed and updated annually or whenever there are material changes to our privacy practices. For questions about this statement or our PHIPA compliance program, contact our Privacy Officer.