Privacy Policy

1. Introduction

MobiSoins ("we", "us") is committed to protecting our users' privacy. This policy explains what personal information we collect, why, how we use, disclose, and retain it, and the rights you have.

It applies to the MobiSoins App and related services and supplements our Terms of Use.

2. Who we are and scope

MobiSoins is responsible for the personal information processed through the App. Our Privacy Officer can be reached at info@mobisoins.com.

By using the App, you acknowledge that you have read this policy.

3. Information we collect

Identity data: first name, last name, date of birth.

Contact data: email address, phone number, postal address.

Account data: credentials, hashed password, role, preferences.

Payment data: processed and stored by Stripe — we never retain card numbers.

Health data: the health profile you complete at sign-up (sex, height, weight, allergies, chronic conditions, pregnancy, blood thinners, care and mobility needs) and information you provide as part of a booking (treatments, notes for the Nurse).

Emergency contact: the name and phone number you give us, used only if an incident occurs during a visit.

Profile photo: optional for Patients; shown to the Patient for Nurses.

Professional data (Nurses): license, professional order, qualifications, and where applicable verification results.

Identity document (Nurses): a photo of an official ID (passport or driver's licence) and a selfie, used only to verify your identity. They are never shown to Patients.

Vehicle (Nurses): make, model, colour and plate, shown to the Patient during a visit so they can recognise your car.

Payouts (Nurses): your bank details are entered directly with Stripe (Stripe Connect); we keep only the bank name and the last 4 digits of the account.

Audio recordings (Nurses): only if you start a safety recording yourself from the Safety Center, to document an incident. Recording never happens without your knowledge or in the background. It is stored in Canada, accessible only to the MobiSoins safety team, and kept only as long as needed to handle the incident and meet our legal obligations. People present during the visit may be heard on the recording.

Technical data: IP address, device identifier, device type, usage logs.

Location data: the visit address and, with your permission, your device location (precise location for Nurses, including in the background during an active visit). See section 8.

4. How we collect your data

Directly from you, when you create an account, complete your profile, make a booking, or contact support.

Automatically, as you use the App (technical, location, and usage data).

From third parties, such as our payment and verification providers, to the extent necessary to provide the service.

5. Purposes of processing

Provide, operate, secure, and improve the service.

Manage accounts, bookings, payments, and invoicing.

Communicate with you (visit notifications, support, security alerts).

Verify Nurse identity and qualifications.

Comply with legal, regulatory, tax, and accounting obligations.

Detect, prevent, and respond to fraud, abuse, and security incidents.

6. Legal basis and consent

We process your personal information based on your consent, the performance of our contract with you, compliance with our legal obligations, and our legitimate interests (for example security and fraud prevention).

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.

7. Health data

Medical information entered as part of a booking is sensitive information. It is visible only to the assigned Nurse and the Patient, on a need-to-know basis.

It is never sold or shared with third parties for marketing or profiling. Internal access is restricted and audit-logged.

8. Location data

Patients: we collect the visit address you enter. With your permission, we also use your device location, only while the App is open, to place the address pin on the map. We never access a Patient's location in the background.

Nurses: we collect your device's precise (GPS) location. While you are online and the App is open, it is used to offer you nearby visits.

Nurses, during an accepted visit: MobiSoins collects your location continuously, including in the background, even when the App is closed or not in use. It is shared in real time with the Patient concerned so they can follow your arrival, and it is used to confirm your arrival at the Patient's home. Background collection stops as soon as the visit ends.

Before any request for background location access, the App shows a notice explaining this collection and asks for your agreement. You can refuse or withdraw this permission at any time in your device settings; live arrival tracking will then no longer be available to the Patient.

We do not keep a history of your movements: only your last known position is stored, and it is replaced at each update. Coordinates needed to compute routes are sent to Mapbox.

Location data is never sold or used for advertising.

9. Disclosure to third parties

Stripe — payment processing (PCI-DSS compliant) and, for Nurses, payouts (Stripe Connect).

ipwho.is and reallyfreegeoip.org — approximate location derived from your IP address, to centre the map when your device location is not known yet.

Amazon Web Services — hosting and authentication (Cognito).

Google Firebase — Patient–Nurse messaging and notifications.

Mapbox — maps and route calculation.

Sentry — crash reports and technical diagnostics, without health data.

Google and Meta (Facebook) — sign-in with your Google or Facebook account, only if you choose that option.

Nurses on the platform — only the information strictly necessary for the visit.

Advisors, auditors, or potential acquirers — in connection with a corporate transaction, under confidentiality terms.

Public authorities — only when required by law or to protect our rights and the safety of others.

No data is sold.

10. Service providers and sub-processors

We use service providers that process information on our behalf, under contract, only on our instructions and with appropriate protection safeguards.

These providers are not authorized to use your information for their own purposes.

11. Hosting and data residency

We strive to host personal information in Canada (the ca-central-1 region) where possible.

Some sub-processors may, however, process data outside Canada (see the international transfers section).

12. Security

Your data is encrypted in transit (TLS 1.2 or higher) and at rest.

Internal access is restricted to authorized personnel and audit-logged.

Payments are PCI-DSS compliant via Stripe. Despite these measures, no system is completely infallible.

13. Data retention

We retain your information for as long as your account is active and as long as necessary for the purposes described.

On account deletion, personal data is erased or anonymized within thirty (30) days, except where the law requires longer retention (for example, accounting records kept for seven (7) years).

You can delete your account in the App (Account tab > tap your profile or "Personal information" > Delete account) or by following the instructions at https://www.mobisoins.com/en/suppression-compte.

14. Your rights (Law 25 and PIPEDA)

Under Quebec's Law 25 and Canada's PIPEDA, you have the right to:

Access the information we hold about you.

Request correction of inaccurate or incomplete information.

Request erasure, subject to our legal obligations.

Object to or request restriction of processing, within the limits of the law.

Request portability of your information in a structured, commonly used technological format.

Withdraw consent at any time, for processing based on consent.

To exercise these rights, contact: info@mobisoins.com. We will respond within the timeframes required by law.

15. Marketing communications

We may send you promotional communications if you have consented. You may opt out at any time via the unsubscribe link or by contacting us.

Essential transactional communications (bookings, security, service updates) are not marketing communications and will continue while you have an account.

16. Cookies and trackers

The App does not use third-party cookies for advertising.

Anonymized technical logs and device identifiers may be used for diagnostics, security, and service improvement.

17. Automated decision-making

We do not make decisions producing legal effects about you based solely on automated processing, without human involvement.

If such a practice were introduced, we would inform you and offer the recourse provided by law.

18. Privacy incidents

In the event of a confidentiality incident presenting a risk of serious harm, we will take reasonable steps to contain it and will notify affected individuals and the competent authorities (notably Quebec's Commission d'accès à l'information) in accordance with the law.

19. Minors

The App is not intended for individuals under 18 and we do not knowingly collect their information. If you believe a minor has created an account, contact us — we will delete it without delay.

20. International transfers

Your information may be processed outside Canada by some of our sub-processors (notably AWS and Stripe).

In that case, we ensure appropriate safeguards (contractual clauses, certifications, privacy impact assessments) are in place to protect your information.

21. Privacy Officer and complaints

For any question, request, or complaint regarding your personal information, contact our Privacy Officer at info@mobisoins.com.

If you believe your rights have not been respected, you may file a complaint with Quebec's Commission d'accès à l'information or the Office of the Privacy Commissioner of Canada.

22. Changes to this policy

This policy may evolve. Material changes will be communicated via the App or by email.

The "Last updated" date appears at the top of the document.

23. Contact

Privacy Officer

MobiSoins — info@mobisoins.com