Privacy Policy

Effective and last updated: August 26, 2026

Scope and accountability

This policy describes BenefitKey account and Canadian benefits-navigation practices. BenefitKey must comply with applicable Canadian federal and provincial private-sector privacy laws. A privacy contact and complete vendor/subprocessor list must be published before launch.

Information we collect

We collect account identity and contact information, consent records, case answers needed for benefit matching in the user’s province or territory, optional contact/address details used to facilitate form preparation, transaction records, security logs, and support communications. We record the accepted policy versions, timestamps, method, locale, content hashes, and network address associated with signup consent.

Information we do not request

BenefitKey does not request or store dates of birth, Social Insurance Numbers, banking or direct-deposit credentials, document uploads, medical records, or practitioner files. Do not provide these through free-text or support channels.

Purposes and consent

We use information to create and secure accounts, provide the requested Canadian benefits-navigation service, save progress, generate user-requested preparation outputs, process payment, prevent abuse, provide support, and meet legal obligations. Signup requires separate affirmative acceptance of the Terms and core privacy practices. Optional marketing, analytics, or other non-essential purposes require separate consent where required.

Service providers and transfers

Authorized service providers may process data for hosting, database, authentication email, payments, and security. Stripe processes payment details under its own privacy practices; BenefitKey should not receive full card numbers. Before launch, BenefitKey must document provider locations, contractual safeguards, and any processing outside Canada.

Retention, access, and safeguards

Information is retained only as long as needed for stated purposes, legal requirements, security, disputes, and account administration, then securely deleted or anonymized. Users may request access, correction, consent withdrawal where applicable, or account deletion, subject to lawful exceptions. BenefitKey applies role restrictions, encryption in transit, access logging, and data-minimization controls, but no system is risk-free.

Questions and complaints

Before launch, replace this text with the designated privacy officer’s name and monitored contact address. Individuals may also contact the Office of the Privacy Commissioner of Canada about applicable federal privacy rights.

This operational text should be reviewed by qualified Ontario and Canadian privacy/legal counsel before public launch. No contract wording can eliminate statutory obligations or liability that cannot lawfully be excluded.