Privacy Policy
This policy explains what Care Beyond Canada collects, why it is used, where it is processed, how long it is kept, and the choices available to you.
Scope and accountability
This policy applies to carebeyondcanada.ca, its member and administrator areas, and information submitted directly to Care Beyond Canada. Care Beyond Canada is responsible for the personal information under its control and has designated a Privacy Lead to receive access, correction, deletion, consent-withdrawal, and privacy-compliance requests.
External fundraisers, linked petitions, news sites, meeting platforms, and resource providers operate independently. Their policies apply after you leave Care Beyond Canada.
Information Care Beyond Canada collects
- Accounts: email address, Amazon Cognito account identifier, verification and account status, consent versions, and administrative role where applicable. Passwords are handled by Amazon Cognito and are not stored in the Care Beyond Canada database.
- Stories and photographs: draft and published story text, optional public display name, uploaded images, guardian and publication permissions, moderation decisions, and timestamps.
- Petitions and signatures: petition content, official external link where supplied, uploaded images, moderation history, account identifier for a signature hosted on Care Beyond Canada, petition version, consent version, signature status, timestamp, and optional public display name. Care Beyond Canada does not publish a list of individual signers.
- Comments: comment text, account identifier, status, and timestamps.
- Contact and participation forms: the name, email address, topic, subject, message, consent record, and any volunteer, partnership, event, story, or privacy details you choose to provide.
- Newsletter preferences: email address, subscribe or unsubscribe status, consent version, and timestamp.
- Operational records: API request identifier, route, response status and size, error code where applicable, authentication and moderation events, and service health metrics.
Do not use the website for emergencies. Submit health, family, or child-related information only when necessary and when you have authority to share it.
Analytics, cookies, and browser storage
Care Beyond Canada uses Google Analytics 4 only after you select “Accept analytics.” Before you consent, the Google Analytics tag is not downloaded and the website does not set Google Analytics cookies. Selecting “Decline” keeps optional analytics disabled.
After consent, Google Analytics may receive the page URL and title, referrer, general device and browser information, approximate region, and interaction events. Your browser also sends ordinary network information, including its IP address, when it connects to Google. Care Beyond Canada does not intentionally send Google Analytics your account identifier, email address, form content, petition signatures, story or health details, or on-site search terms. Google signals and advertising personalization are disabled in the website configuration.
Google Analytics may set first-party cookies whose names begin with _ga. The website stores your analytics preference in your browser so it can remember your choice. You can change that choice at any time using “Analytics preferences” in the footer. Declining after previously accepting sends an updated denial instruction and attempts to remove Google Analytics cookies for this domain. Clearing browser storage resets the choice.
Secure sign-in uses temporary browser storage and strictly necessary authentication information so a session and sign-in redirect can work. Authentication information is not used for audience analytics. Amazon Cognito’s managed login may use strictly necessary cookies on its hosted sign-in domain.
Site search runs in your browser and does not send search terms to an analytics provider. The site also loads the DM Sans font from Google Fonts, so the browser makes a separate request to Google that can include ordinary network information such as IP address and browser details.
How information is used
Information is used to create and secure accounts; provide member features; save, review, publish, withdraw, and moderate content; process signatures hosted on Care Beyond Canada; prevent duplicate or abusive activity; respond to messages and privacy requests; record newsletter choices; operate and troubleshoot the service; protect families and the public; and meet legal obligations.
Care Beyond Canada does not sell personal information and does not use it to build advertising profiles. Public content is displayed only according to the publication and photograph permissions recorded for that submission.
Service providers and disclosures
Amazon Web Services provides the website’s cloud hosting, authentication, application processing, database, private media storage, content delivery, and operational monitoring. Primary application data is configured in the Canada (Central) AWS region. Authorized Care Beyond Canada administrators and service providers may access information only as needed to operate, secure, moderate, or support the service.
When analytics consent is granted, Google LLC provides Google Analytics and processes the analytics information described above. Google Analytics information may be processed outside Canada and is subject to Google’s service terms and privacy practices. Event-level analytics data follows the retention controls configured for the Google Analytics property, while aggregate reports may remain available for longer.
Information may also be disclosed when required by law, to respond to a valid legal process, or when reasonably necessary to protect a person, investigate abuse, or preserve the security of the service. Service providers may process limited information in other jurisdictions and may be subject to the laws of those places.
Google Fonts receives the font request described above. GoFundMe, Change.org, Global News, Microsoft Teams, Google Meet, Apple FaceTime, and other linked services receive information only when you choose to visit or use them, subject to their own terms and privacy practices.
Retention
- New contact submissions are scheduled to expire 180 days after receipt. The storage provider may complete automatic removal shortly after the expiry time.
- Production API access logs and application logs are configured for 30-day retention. They are used for reliability and security, not audience analytics.
- Newsletter preference records are kept until the preference is changed or removal is requested. An unsubscribe record may be retained as needed to honour the opt-out.
- Upload originals are deleted after successful safety processing or by the short abandoned-upload lifecycle. Processed images are kept with the related submission while needed for moderation or publication.
- Accounts, consent records, submissions, comments, petition signatures, and moderation records are kept while the account or feature is active and afterward only as needed for withdrawal history, security, legal obligations, dispute handling, or deletion review.
Deletion from active systems may not immediately remove limited copies in encrypted backups, version history, security records, or provider recovery systems. Those copies are isolated from ordinary use and are removed or overwritten according to the applicable recovery and retention cycle.
Your privacy choices
You may accept, decline, or later change optional analytics through “Analytics preferences” in the website footer. Declining analytics does not limit access to the website or member features.
You may view your member submissions; correct a draft; withdraw eligible comments, stories, petitions, and signatures hosted on Care Beyond Canada; change a newsletter preference; sign out; or submit an account-and-data deletion request from My Account. You may also ask the Privacy Lead for access to, correction of, or an explanation of the use of your personal information, and you may withdraw consent subject to legal or operational limits.
Account deletion requests are reviewed so published content, moderation records, media, account access, and any required retention can be handled safely. Choices relating to an external petition, fundraiser, or other linked service must be made directly with that provider.
Safeguards and incidents
Care Beyond Canada uses encrypted HTTPS connections, private encrypted AWS storage, blocked public access to uploaded originals, short-lived signed media links, least-privilege administrative access, moderated publication, email verification, strong password rules, request throttling, and short log retention. No internet service can guarantee absolute security.
If a privacy breach creates a real risk of significant harm, Care Beyond Canada will investigate, preserve required records, notify affected people and the appropriate privacy authority when required, and take reasonable corrective steps.
Questions, requests, and complaints
Contact the Privacy Lead, Care Beyond Canada through the secure contact page and choose “Privacy or data request.” Include enough detail to identify the account or submission involved, but do not send passwords or unnecessary medical information. Identity may need to be verified before access, correction, or deletion is completed.
If a privacy concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator that applies in your province or territory.
Material changes will be posted here with a new effective date. Where a change requires renewed consent, Care Beyond Canada will request it through the relevant account or submission feature.