Privacy Policy
⚠️ DRAFT FOR LEGAL REVIEW — NOT YET IN FORCE. Prepared to be handed to a Canadian privacy lawyer. Not legal advice. Because the Service is offered across Canada — including Quebec — this draft is written to the strictest applicable standard: federal PIPEDA plus Quebec's Law 25. Law 25 attaches to the residence of the individual, not the location of the business, so serving Quebec at all triggers it. Key Law-25 items flagged inline for counsel: named Privacy Officer, explicit opt-in for tracking technologies, highest-privacy defaults, breach recordkeeping, and a French-language version.
Last updated: [DATE] · Effective: [DATE]
FirstCheck ("we," "us") respects your privacy. This policy explains what personal information we collect through [firstcheck.ca] (the "Service"), why, and your rights. The Service is directed at residents of Canada.
1. Our Privacy Officer
In accordance with Canadian privacy law, including Quebec's Law 25, the person responsible for the protection of personal information at FirstCheck is:
[Name / title] [privacy@firstcheck.ca] · [mailing address]
You may contact the Privacy Officer with any question or request about your personal information, including the requests described in Section 6.
2. Our approach: collect as little as possible
FirstCheck is a reference you can use without an account and without giving us your name. Most visitors read pages and never provide any personal information. We collect personal information only in the limited situations below, and the Service is configured so that the highest level of privacy applies by default — for example, non-essential tracking is off until you turn it on. [Law 25: confirm highest-privacy default configuration is implemented in-product.]
3. What we collect, and why
(a) When you request a professional (lead referral). If you choose to be connected with a professional, we collect the contact details you provide (such as name, email, phone, and general location) and the diagnostic notes associated with your request (the symptom, conditions you selected, and causes you ruled out). We use this only to route your request to a professional or referral partner you have asked us to contact, and we obtain your express, informed consent at the point of submission. We record the exact wording you agreed to and the time you agreed. We do not sell this information for unrelated marketing.
(b) When you contact us. If you email us, we receive your email address and whatever you include.
(c) Technical and analytics information. We may collect standard technical data (such as IP address, device and browser type, pages viewed) to operate and improve the Service and keep it secure.
- Strictly necessary data used only to serve and secure the site is processed on the basis of our legitimate operation of the Service.
- Any analytics, measurement, or tracking technologies (including non-essential cookies) are OFF by default and are used only with your express opt-in consent, which you can withdraw at any time. [Law 25: this opt-in gate is mandatory — no non-essential trackers may fire before consent.]
(d) Affiliate links. When you click a link to a retailer, that retailer may set its own cookies and collect information under its own privacy policy. We may receive a commission but do not receive your purchase details beyond aggregate reporting.
We do not knowingly collect information from children. The Service is intended for adult homeowners. [Law 25: parental consent required under 14 — confirm no child- directed features.]
4. Cookies and tracking
We use only what a category permits:
- Necessary (site function, security) — always on.
- Analytics / measurement — only after opt-in.
- Affiliate/referral — set when you click out to a partner.
You control non-essential categories through our consent banner and can change your choice any time via [cookie settings link].
5. Sharing and storage
We share personal information only:
- with professionals or referral partners you ask us to contact (lead requests);
- with service providers who host or operate the Service on our behalf, under contract and only as needed;
- where required by law.
We do not sell your personal information.
Storage and cross-border transfers. We aim to store personal information in Canada. If any service provider stores or processes it outside Quebec or outside Canada, we will have assessed that the information will receive adequate protection and put appropriate contractual protections in place. [Law 25: a Privacy Impact Assessment is required before transferring personal information outside Quebec — complete and retain one; PIPEDA requires comparable-protection contractual terms.]
We keep personal information only as long as needed for the purpose collected (for example, long enough to route and follow up on a lead), then delete or anonymize it.
6. Your rights
Subject to law, you may:
- access the personal information we hold about you;
- correct it;
- withdraw consent (including to tracking) going forward;
- request deletion;
- request a portable copy of information you provided, in a structured technical format. [Law 25 data-portability right — confirm export mechanism exists.]
To exercise any right, contact the Privacy Officer (Section 1). We will respond within the timeframes required by applicable law.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, and, if you are a Quebec resident, to the Commission d'accès à l'information du Québec (CAI).
7. Automated decision-making
If we ever make a decision about you based exclusively on automated processing of your personal information, we will tell you and let you submit observations, as required by Law 25. Our cause-ranking does not do this: it organizes general content and does not make a decision about you as an individual.
8. Security and breaches
We use reasonable technical and organizational measures to protect personal information. We maintain a record of confidentiality incidents and will notify affected individuals and the appropriate regulator(s) where a breach presents a risk of serious injury, as required by PIPEDA and Law 25. [Confirm breach-register and notification workflow are in place.]
9. Language
This policy is available in English and French. [Law 25 / Quebec's Charter of the French Language: a French version must be available and given equal standing for Quebec residents.]
10. Changes
We will post updates here with a new "Last updated" date and, where required, seek fresh consent.
11. Contact
Privacy Officer — [privacy@firstcheck.ca] · [mailing address]