Privacy Policy

Information we collect

We collect personal information in three ways:

• Information you give us: your name, email address, phone number, organisation and the details of your enquiry or project when you fill in a form, email us or book a call.
• Information collected automatically: IP address, browser type, device and the pages you visit, collected through standard server logs and website analytics.
• Information from clients: personal information, including personal health information, that a client shares with us under a contract so that we can deliver the agreed services. We use it only for that purpose.

How we use your information

• To respond to your enquiries and provide the services you have asked for.
• To manage our relationship with clients, including contracts, invoicing and support.
• To improve this website and our services, using aggregated and anonymised statistics.
• To send you updates about our services where you have agreed to receive them. You can opt out at any time.
• To meet our legal, regulatory and security obligations.

We do not sell personal information, and we do not share it with third parties for their own marketing. We share it only with service providers who help us run our business and who are bound by contract to protect it, or where the law requires.

Cookies and website analytics

This website uses essential cookies that make it work and may use analytics cookies to understand how visitors use the site. Analytics data is aggregated and does not identify you personally. You can block or delete cookies in your browser settings; the website will still work, although some features may behave differently.

How we protect your information

We use industry-standard safeguards to protect personal information against loss, theft and unauthorised access, use or disclosure: encryption in transit and at rest, role-based access on a need-to-know basis, logging of access to sensitive systems, and privacy and security training for our staff. Our operational commitments for client engagements, including hosting, access control and incident response, are described in our Trust Center.

Personal health information and our role

Much of our work is for hospitals and other health information custodians. When we handle personal health information on a client's behalf, the client remains the custodian or controller of that information and we act under its instructions:

• Ontario: we act as an agent of the custodian under the Personal Health Information Protection Act (PHIPA). We collect, use and disclose personal health information only as the custodian permits and only for the agreed purpose, and we notify the custodian at the first reasonable opportunity if information is stolen, lost, or used or disclosed without authority.
• European Union: we act as a data processor under Article 28 of the General Data Protection Regulation (GDPR), under a written data processing agreement, and we notify the controller without undue delay of any personal data breach.
• Elsewhere in Canada: we follow the Personal Information Protection and Electronic Documents Act (PIPEDA) or the applicable provincial privacy law.

We never aggregate client data across engagements or use it to train general-purpose models. Please do not send personal health information through this website's forms; use the secure channel agreed in your contract.

How long we keep information

We keep personal information only for as long as it is needed for the purpose it was collected for, and then delete or anonymise it:

• Website enquiries: for as long as needed to respond to your enquiry and maintain our business relationship.
• Client engagements: personal health information is retained only for the period set out in the contract and is deleted or returned to the custodian at the end of the engagement, with written confirmation.
• Consent and opt-out records: for as long as required to respect your choices and meet our legal obligations.

Your rights

You can contact us at any time to:

• Confirm what personal information we hold about you and receive a copy of it.
• Correct information that is inaccurate or incomplete.
• Delete information where we have no legal duty to keep it.
• Withdraw your consent to future communications.

We answer requests within 30 days and may ask you to verify your identity first. Residents of the European Union have the additional rights set out in the GDPR, including the right to lodge a complaint with a supervisory authority. Ontario residents may also contact the Information and Privacy Commissioner of Ontario. For personal health information we hold on behalf of a hospital or other custodian, please contact that organisation directly; we will support it in responding.

Privacy officer and where data is processed

Questions, requests and complaints about personal information go to our privacy officer at info@zeroonetech.co, or by post to ZeroOne, 3600 Steeles Avenue East, Markham, Ontario L3R 9Z7, Canada. Enquiries submitted through this website are processed in Canada. For client engagements, the hosting region is agreed in the contract; Canadian client data stays in Canadian regions unless the custodian agrees otherwise.

Changes to this policy

We review this policy at least once a year and whenever our services or the law change. The date at the top of this page shows the latest revision, and material changes will be noted here. The sections on personal health information, retention, your rights and the privacy officer were added in October 2026.