CareMate Privacy Policy

Scope and responsibilities

Gridex is responsible for personal information it controls, including information used to manage its website, business relationships and support activities. For any future senior living or care deployment, the residence operator or care provider will generally determine the approved resident workflows and the purposes for handling resident information. Where Gridex processes information on that organization’s behalf, we follow its lawful documented instructions and the applicable written agreement.

For such a deployment, that organization’s own privacy notice will also apply. A deployment notice will explain the relevant features, data collection, access arrangements and contact points before resident information is collected. An agreement or site notice does not remove rights under applicable law or Gridex’s responsibility for its own handling of information.

This policy describes possible data categories for approved features. It does not mean every feature is available, enabled or used at every site. Optional features remain subject to product validation, site approval and the required notices and consents. Independent websites, clinicians and services linked from CareMate are responsible for their own practices.

Information provided to us

Business and inquiry information may include your name, work role, organization, email address, telephone number, site details, appointment preferences and the contents of messages or feedback you send us. This includes information you submit through the Website’s inquiry or appointment request forms or by email. We use it to answer your request, arrange appointments or demonstrations, evaluate collaboration requests and manage business relationships. Submitting an inquiry or requesting an appointment does not by itself subscribe you to unrelated marketing communications.

If a CareMate account or portal is enabled for an approved service, account and administration information may include an authorized user’s name, work contact details, role, account identifier, permissions, authentication information and access history. Such information is used to administer accounts, restrict access and investigate misuse.

Commercial and support records may include contracts, billing contacts, invoice information, support requests and authorized diagnostic material. If payment processing is offered, the relevant collection notice will identify the payment provider and information involved. Do not enter payment card details, resident health records, passwords or other sensitive information in the Website’s inquiry or appointment forms or send them to our general business email address. These forms are intended for business inquiries and scheduling, not the collection of resident health information.

Website and technical information

When you access a website or digital service, technical systems may process IP addresses, browser and device details, timestamps, referring pages, requested pages, errors and security logs. These records help deliver the service, troubleshoot problems and protect systems. Cookie and analytics choices are described in section 10.

If an approved robot deployment begins, operational records may include the robot identifier, software version, battery and connectivity status, mapped routes, task instructions, delivery destinations, timestamps, completion status, exceptions and staff acknowledgements. We use them to run and support approved tasks and review operational performance. We treat records linked to people as personal information even when the records are mainly technical.

Resident information and optional features

Before resident data collection begins, we and the site operator will identify the information necessary for the approved service and limit collection accordingly. Depending on the features enabled, that information may include a resident identifier or room reference, communication preferences, language, agreed reminders, authorized contacts, consent choices and staff-entered task information.

If enabled for an approved deployment, communication features may process call participants, connection details, messages, speech inputs, transcripts or audio and video needed for an authorized interaction. Processing a live session and retaining a recording are different activities. A recording or retained transcript requires its own disclosed purpose and applicable authorization.

An approved wellness feature may process readings from compatible devices, such as blood pressure, heart rate, temperature, oxygen saturation or weight, together with the source, time and relevant staff review information. These features support recording and non-diagnostic review. They do not authorize Gridex to obtain a resident’s complete medical record or to make clinical decisions.

If enabled for an approved deployment, sensing features may process camera, depth, LiDAR or radar inputs for navigation or an approved workflow. Derived information may include occupancy, motion, inactivity, non-response or an event requiring staff review. A signal processed locally can still be personal information even if it is never uploaded. A radar-only or camera-off mode can reduce visual collection without making all resulting information anonymous.

Before enabling a sensitive feature, the deployment notice must explain the sensors involved, whether processing is live or recorded, what leaves the robot, who can access the information and how long it is retained. Resident audiovisual recording, wellness data collection and identifiable sensing require prior written site approval and required consent or other lawful authority. Entry into a room or the presence of a robot is not consent by itself.

Facial identification, voice identification and biometric templates for identifying a person are not authorized by this policy. Any proposed future use would require a separate assessment, specific notice and the required legal authority before it begins.

Purposes and limits

We use personal information for the purposes described when it is collected, including to:

• Provide and support the specific website function, account or approved workflow requested.
• Arrange communications with authorized staff, residents and contacts.
• Maintain safety and security, resolve faults and investigate reported incidents.
• Manage business relationships, billing, service records and legal obligations.
• Evaluate task completion, reliability and workflow performance using the least identifying information reasonably necessary.
• Send permitted business updates and marketing communications, subject to your choices.

We do not collect information simply because a sensor or integration could make it available. We limit collection and access to the approved purpose and obtain additional consent where required before a materially different use. De-identified information remains subject to appropriate controls where re-identification is reasonably possible.

Consent and supported decisions

We obtain meaningful consent where required and explain important collection practices in a form suited to the audience. Sensitive information and unexpected uses generally require express consent unless a lawful exception applies. A privacy policy, a facility’s signature or a general website acceptance does not replace the consent process required for an individual.

Where a resident needs assistance understanding a choice, we work with the residence operator to provide an accessible explanation. If someone gives consent on another person’s behalf, their legal authority must be established for the particular decision. A family relationship does not automatically provide that authority, and age or a diagnosis alone does not establish inability to consent.

You may withdraw consent on reasonable notice, subject to legal or contractual restrictions, and we will explain the likely consequences. An optional function may then need to be disabled or changed. Refusing an unnecessary or optional use of information must not be treated as permission to deny unrelated care or basic services. Site staff should explain available alternatives.

Staff and visitors may also be affected by a deployment. Notices and collection limits apply to them as appropriate. We work with operators to reduce incidental collection and provide a contact for questions about sensing in shared spaces.

Access and disclosure

In an approved deployment, authorized care teams and site administrators may receive information needed for their approved roles. Family members, representatives and remote participants receive information only within verified permissions, consent or other lawful authority. Paying for a service or being listed as an emergency contact does not by itself give unrestricted access to resident records.

Service providers may process information needed for functions such as website hosting, inquiry forms, appointment scheduling, email delivery, business communications and security. Any future approved service may involve additional providers for communications or technical support. When we engage a provider to handle personal information on our behalf, we require purpose restrictions, confidentiality and appropriate safeguards. We remain accountable for information under our control when a provider processes it for us. We do not authorize those providers to use resident information for their own advertising or unrelated AI training.

We may disclose information to professional advisers where necessary, to comply with a lawful request, to meet a legal obligation, or where law permits disclosure to address a serious safety or security issue. We assess the legal basis and limit the information involved. A possible business transfer may involve information only under the conditions and safeguards the law permits, with any required notice.

We do not sell or rent personal information. We do not use identifiable resident information, health readings, private communications or robot sensing records for behavioural advertising. Our website does not currently use advertising tracking. If that changes, we will explain the tools and choices before introducing them, as described in section 10.

Remote support and access to robots

Where remote support is enabled, access must be limited to authorized personnel and the scope approved for the deployment. Routine diagnostic access is distinct from access to a live camera, microphone, resident record or remote-control function. The deployment notice and support arrangements must identify which forms of access are possible and when they may occur.

Live access to a private space or sensitive resident information requires the applicable site authorization, notice and legal authority. Sessions must be limited to the support task and logged as agreed. Remote support does not mean that someone continuously watches a site or guarantees that a resident event will be noticed. Report an immediate safety concern to on-site staff or emergency services.

AI and product improvement

Approved AI features may use authorized inputs to prepare a response, organize a task or identify information for staff review. Staff remain responsible for interpretation and action. We do not use CareMate to make autonomous clinical decisions about residents.

We may improve reliability through operational testing, non-confidential feedback and appropriately aggregated or de-identified workflow information. We do not use identifiable resident recordings, health readings or private conversations to train general-purpose AI models, or permit a model provider to do so, without a separate disclosed purpose, written site approval and the required valid consent or other legal authority. Agreement to this policy alone does not authorize that training.

If an external AI service is proposed, its role, data access, retention, training permissions and processing locations must be assessed and disclosed before sensitive resident information is sent to it. Optional participation in research or training must not be presented as necessary to receive unrelated services.

Cookies and communications

The Website does not currently use Google Analytics or advertising tracking. Its inquiry or appointment request forms collect the information you submit so we can respond, coordinate scheduling and follow up on your request. Submissions and related delivery details may be handled by providers supporting our Website, forms, scheduling and email. You may instead contact info@caremate.life. Information you include in an email, together with the sender address and delivery details, may be handled by us and the email services involved in delivering and storing that message.

Website hosting and security services may use technical logs, cookies or similar technologies necessary to deliver requested pages, maintain security and prevent misuse. The absence of Google Analytics or advertising tracking does not mean that no technical information is processed when you visit the Website.

If we introduce optional analytics, advertising tracking, new embedded services or materially different uses of form submissions, we will describe the relevant data collection and provider arrangements before they begin. We will provide any choices or consent controls required for that use. Consent-dependent technologies will not be activated before the relevant choice is made. You may also manage cookies through your browser, although blocking technologies needed for a requested function may affect that function.

You may unsubscribe from marketing messages using the instructions in the message or by contacting info@caremate.life. We send commercial electronic messages only where permitted by applicable law. Necessary service, safety, account and legal communications are separate from marketing preferences.

Processing locations

Gridex operates from British Columbia, Canada. Website hosting, form submissions, appointment scheduling, email delivery and business systems may involve service providers that process information in Canada or other countries. Our Canadian business location is not a promise that every website, form or email record is processed exclusively in Canada. You may contact info@caremate.life for information about the providers and processing locations relevant to your interaction with us.

We have not begun collecting resident data through the CareMate robot platform. Before any such collection begins, we will establish the applicable storage and processing locations, provider arrangements and any remote access, and explain them in the relevant deployment notice. Local robot processing, cloud storage, external AI processing and remote support will be assessed separately. Required notices, site approvals, consent or other lawful authority must be in place before the relevant processing begins.

We will honour any agreed location restrictions and additional restrictions imposed by applicable law. Before introducing a provider or access location that changes a deployment’s approved arrangements, we will follow the required review, notice and authorization process.

Where personal information is processed outside Canada, it may be accessible to courts, law enforcement or other authorities under the laws of that country. We remain accountable for information under our control and require contractual or other safeguards appropriate to the information when a provider processes it on our behalf.

Security and incident response

We are responsible for protecting personal information under our control with administrative, technical and physical safeguards appropriate to its sensitivity and purpose. Access must be limited to people who need it for an authorized purpose and are subject to appropriate confidentiality requirements.

Before any future resident data collection begins, the deployment’s safeguards will be established to address staff permissions, device and network security, encryption, access records, updates and incident handling as appropriate to the proposed use. These requirements do not represent that a future deployment has already been implemented or certified. No system can guarantee complete security.

If we identify a privacy or security incident, we investigate, take steps to contain it and coordinate with the affected operator or provider. We notify affected organizations, individuals and regulators where required by law or the applicable agreement. Report a suspected incident through the privacy contact below, without including unnecessary sensitive information in the initial message.

Retention and deletion

We retain information for the period reasonably necessary for its disclosed purpose, taking account of service delivery, the sensitivity of the information, access rights, legal requirements and the need to address a dispute or incident. We review retention rather than keeping personal information indefinitely for an undefined future use.

For resident recordings, wellness readings, sensor events and operational records, the site-specific retention and deletion schedule must be established and explained before collection. Information used to make a decision directly affecting an individual is retained for the period required by applicable law. For example, where section 35 of British Columbia’s Personal Information Protection Act applies, the minimum period is one year after that use.

When information is no longer needed, we delete it, securely destroy it or render it non-identifying as appropriate. Backups may expire through a controlled cycle rather than immediate deletion. Legal holds and mandatory recordkeeping may delay removal. At the end of a deployment, data return or deletion and device clearing follow the applicable agreement and legal obligations. Ask us or the site operator about the schedule that applies to your information.

Your rights and complaints

Subject to the law that applies and its exceptions, you may ask about our handling of your information, request access, seek correction, withdraw consent and request deletion of information that is no longer lawfully needed. Deletion is not an unrestricted right to erase required care, incident, transaction or legal records.

We may request limited information to confirm your identity and, where relevant, the authority of a representative. We respond within applicable legal time limits and explain a permitted refusal or extension and the available review process. If the residence operator controls the records, we will help direct the request to it and assist as required. That process does not remove our obligations for information we control ourselves.

You may raise a concern with our privacy contact or the relevant residence operator. You may also contact the Office of the Information and Privacy Commissioner for British Columbia at www.oipc.bc.ca, the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or another regulator with jurisdiction. You do not have to waive a statutory complaint right to use CareMate.

Children and incidental collection

The CareMate website and business services are intended for adults. We do not invite children to create accounts or send us personal information. If sensing or communication features are introduced in a future deployment, a child visiting a residence could be incidentally captured by an authorized feature. We apply collection limits and safeguards to that information and work with the site to address an appropriate request from a legally authorized guardian. Contact us if you believe a child’s information has been collected improperly.

Changes and contact

We will update the effective date when this policy changes and provide an appropriate notice of material changes. We obtain new consent where required before using existing information for a materially different purpose. A revised policy does not retroactively create consent or override a signed data protection commitment.

Privacy contact
Gridex Technology Inc.
CareMate
202–12391 Horseshoe Way
Richmond, BC V7A 4X6
Canada

Website: https://caremate.life
Email for privacy requests and complaints: info@caremate.life

Please identify the website, service or residence involved so we can route your request. You may ask for an accessible explanation or a paper copy of this policy. Avoid sending health records or identity documents with an initial inquiry; we will explain a suitable verification method if needed.