Privacy Policy

Karis Care is a product of BridgeNode, based in British Columbia, Canada. We handle two different kinds of information, under two different roles, and this policy keeps them separate because your rights differ between them.

1. Two roles, two kinds of information

Care records in the Karis Care platform. When your agency uses Karis Care, your agency decides what is collected and why. Your agency is the organization accountable for that information under privacy law; we hold and process it on your instructions, under your service agreement. We do not use it for our own purposes, we do not sell it, and we do not use it to train machine-learning models.

Information about you as a visitor or prospect. When you browse this website or send us a form, we are the organization accountable for that information, and this policy is our commitment to you directly.

2. Where your data lives

Personal information processed through the Karis Care platform is stored and processed in Canada, in a Toronto data centre region. Each customer gets its own database — a separate boundary at the database level, not a shared table with a tenant column. Records do not leave Canada in the course of normal operation.

Three exceptions are worth naming plainly, because “hosted in Canada” should not paper over them. Transactional email (invitations, password resets, notifications) is delivered through a provider in the United States, and a notification can include a supported individual’s name — for example, that a named person’s consent is expiring. Error monitoring is US-hosted and configured to receive no personal information. Billing is processed in the United States and carries your administrators’ contact and payment details, never care records. Separately, backups are written to a second provider in a Canadian region, so they leave our primary host but not the country. All of these are listed in section 5.

3. What we collect

Platform. Account information for the people your agency authorizes — name, work email, role, and authentication data — plus the care records your agency enters, and an audit log of who changed what and when.

This website. If you complete the demo or contact form, we receive what you type into it: your name, work email, organization, role, province, funder, approximate headcounts, and anything you write in the message field. We also collect aggregate page analytics — page views, referrer, country, device type — through a cookie-free service that does not track you across sites or build a profile of you. This website sets no advertising or tracking cookies.

4. How we use it

To provide and support the service, to keep the platform secure and available, to bill correctly, and — for website enquiries — to reply to you and to have a sales conversation you asked for. We do not sell personal information, and we do not share it for advertising.

5. Service providers we rely on

We use a small number of service providers, and we would rather list them than make you ask. Each is bound by contract to protect the information it handles and to use it only to provide its service to us.

Karis Care platform:

This website:

If we add or replace a provider that handles personal information in the platform, we update this page. Customers with a data-protection schedule in their agreement receive advance notice on the terms set out there. A dated copy of this list, suitable for a procurement file or a board package, is available on request — email support@kariscare.com.

6. How long we keep it

Platform data is retained for as long as your agency's subscription is active, plus the post-termination retrieval window set out in your agreement, after which it is deleted. Backups follow their own schedule: each nightly backup is kept for 365 days and then expires automatically, and for its first 35 days it is write-protected, so it cannot be deleted early even by us. The managed database also keeps a rolling seven-day point-in-time recovery window. Website enquiries are kept for as long as they remain commercially relevant, and we will delete yours sooner if you ask.

7. How we protect it

Per-tenant database isolation, encryption in transit and at rest, multi-factor authentication available on every account, role-based and entity-level access control, and a full audit trail of changes. Access by our own team to customer environments is limited, purpose-bound, and logged. There is more detail on the Security page, including what we are not certified for.

8. If something goes wrong

If we become aware of a privacy breach involving customer data that creates a real risk of significant harm, we will notify the affected customer without undue delay, with what we know, what we are doing about it, and what we recommend. Reporting obligations to the Office of the Information and Privacy Commissioner for British Columbia and to the Office of the Privacy Commissioner of Canada are handled as the law requires. Suspected security issues can be reported to support@kariscare.com.

9. Your rights

Under PIPEDA and BC PIPA you have the right to ask what personal information we hold about you, to have it corrected, and to challenge how we handle it. For care records in the platform, the accountable organization is the agency that entered them, so those requests go to that agency — and we will help them respond. For information you gave us directly through this website, write to us and we will answer.

10. Contact

Privacy questions, access requests, and complaints: support@kariscare.com. We are a small team and we answer these ourselves, usually within one business day. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia.

BridgeNode, 34064 Parr Avenue, Mission, British Columbia V2V 0J5, Canada.