How KynTrack protects personal information and supports customers’ privacy obligations under applicable Canadian law.
Privacy Framework
What are PIPEDA and PHIPA?
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal private-sector privacy law. It applies to organizations subject to the Act when they collect, use, or disclose personal information in commercial activities.
Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) governs personal health information handled by health information custodians and, in certain circumstances, their agents and service providers. Which law applies depends on the organization, activity, information, and jurisdiction.
Our Approach
Our Commitment
KynTrack maintains administrative, technical, and organizational safeguards designed to protect personal information and address privacy obligations applicable to KynTrack.
When we handle information for a customer, our respective responsibilities depend on the services provided, applicable law, and our agreement with that customer.
Privacy in Practice
How we protect personal information
01
Purpose and data minimization
We seek to handle personal information only for identified, appropriate purposes and limit it to what is reasonably necessary to provide, secure, support, and maintain KynTrack’s services, or as otherwise permitted or required by law.
02
Consent and lawful authority
KynTrack’s processes are designed to support consent and other lawful authority for collecting, using, and disclosing personal information. Customers remain responsible for determining and documenting the authority required in their context.
03
Security safeguards
We use safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, secure authentication, and controls intended to reduce the risk of unauthorized access, use, alteration, or disclosure.
04
Access, logging, and oversight
Role-based permissions are designed to limit access to authorized users and personnel with a legitimate need. Logging and monitoring support security oversight, investigations, and accountability.
05
Retention and secure disposal
We retain personal information only as long as reasonably necessary for identified purposes or legal and contractual requirements, then securely delete or de-identify it in accordance with applicable requirements.
06
Incident response
We maintain procedures to identify, contain, investigate, and mitigate suspected privacy or security incidents and to support notifications and reports required by law or contract.
Shared Responsibility
Privacy is a shared responsibility
KynTrack’s services are designed to support privacy-conscious operations, but using technology does not by itself make an organization compliant. Customers remain responsible for determining which laws apply, providing required notices, obtaining and managing consent or other lawful authority, configuring access appropriately, and meeting their own retention, access, correction, and breach-response obligations.
Questions or privacy requests?
Contact our Privacy Officer
For questions about KynTrack’s privacy practices, or to submit a privacy request or concern, contact our Privacy Officer. If KynTrack handles information on behalf of another organization, we may direct the request to that organization.
This page provides general information only. It is not legal advice, a regulatory certification, a warranty, or a guarantee that use of KynTrack will make any person or organization compliant with applicable law. KynTrack’s Privacy Policy and applicable customer agreements govern the services.
