Privacy Policy

We collect the following information when you use Cercle: Account Information: Name, email address, phone number (optional), and encrypted password. Care Recipient Information: Name, date of birth, medical conditions, medications, and care notes you choose to enter. Documents: Any medical documents, prescriptions, or files you voluntarily upload. Usage Data: Anonymized access logs to improve our services and ensure security.

Your information is used exclusively to: • Provide and improve Cercle services • Send you important notifications (medication reminders, appointments) • Communicate with you about your account • Ensure security and prevent fraud • Comply with our legal obligations We never use your health data for targeted advertising.

We only share your personal information with: Members of your care circle: According to the permissions you grant each member. Service providers (subprocessors): These providers are bound by data-protection terms: • Neon — Database hosting (North America) • Vercel — Application compute and private document storage configured in Montréal; other platform operations may occur outside Canada • Resend — Transactional email delivery (United States) • Stripe — Payment processing Legal authorities: Only if required by applicable law. We never sell, rent, or share your data with advertisers or data brokers.

We take the security of your data seriously: • Encryption: Our infrastructure providers encrypt data in transit and at rest • Hosting: Private documents and application compute are configured in Montréal. Our database and some service providers operate elsewhere in North America, including the United States • Access controls: Authenticated membership and care-circle permissions restrict access • Reviews: We review application security and dependencies regularly • Deletion: Account data is anonymized on request and scheduled for permanent deletion after 30 days; external file deletion is retried durably

Under Quebec and Canadian privacy laws, you have the right to: • Access all your personal data • Export your data in a portable format • Correct any inaccurate information • Delete your account and all associated data • Withdraw your consent at any time To exercise these rights, contact us at privacy@carecercle.com or use your account settings.

We retain your data while your account is active and as needed to provide the service. When you delete your account, we immediately revoke access, anonymize account identifiers, remove care data that is not shared with another active member, and queue external file deletion. The anonymized account record is permanently deleted from the active database after 30 days. Infrastructure backups may persist for the limited retention period applied by our providers before being overwritten. De-identified operational records may be retained where they can no longer be linked to you.

Cercle is designed to support obligations under Quebec's Act respecting the protection of personal information in the private sector, as modernized by Bill 25, and applicable Canadian privacy requirements. Privacy Officer: Email: privacy@carecercle.com | Address: P.O. Box 55532, Montreal, QC H2T 1A0, Canada. We assess material privacy impacts, maintain an incident process, and will notify regulators and affected individuals when required by applicable law. This policy describes our practices; it is not a certification by a regulator.

We use essential cookies to: • Maintain your login session • Remember your language preferences • Ensure the security of your account We do not use advertising tracking cookies or third-party cookies for marketing purposes.

In accordance with Bill 25, you have the right to: • Explicitly consent to the processing of your personal information when creating your account • Withdraw your consent at any time by contacting us at privacy@carecercle.com or by deleting your account • Object to the processing of your personal information on legitimate grounds • Request portability of your data in a structured, commonly used format Withdrawal of consent results in deletion of your account and all associated data within 30 days.

We may update this policy from time to time. In case of significant changes, we will notify you by email and display a visible notice in the application. The date of last update is indicated at the bottom of this page.

For any questions about this policy or your personal data: Privacy Officer Email: privacy@carecercle.com Address: P.O. Box 55532, Montreal, QC H2T 1A0, Canada You may also file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca We generally respond to requests within 30 days of receipt.