Privacy Policy

In Short: Care records belong to the organization that employs you. Account records are ours to answer for.

Easydocks is not a consumer app. It is sold to organizations that operate licensed residential homes. Those organizations invite their own staff to use it. That produces two different kinds of personal information, handled under two different sets of rules.

If you are a resident, a family member, a guardian, or another person named in a care record, we are not the organization that decides how your information is used. Your request should go to the care organization that operates the home. We will support them in answering it. If you cannot identify that organization, contact us using section 15 and we will direct you.

Information in care records

In Short: Staff enter this while documenting care. We do not collect it from residents, and residents do not have accounts.

Resident identity. Given, middle, family and preferred name; date of birth; admission date; residency status; and which licensed home the resident lives in.

Resident health information. Allergies, dietary restrictions, blood type, mobility notes, family physician, preferred pharmacy, and where the organization records it, an Alberta Health Care Number.

Resident care and behavioural profile. Communication style and supports, hygiene and dressing support level, mealtime protocols, sleep routine, behaviour triggers, escalation signs, approved de-escalation tactics, preferred activities, and dislikes and phobias.

Care documentation. Shift log narrative, care events and appointments, task completion notes, and answers to forms the care organization has defined itself.

Incident and safeguarding records. Critical incident reports, including the antecedent, behaviour and consequence narrative, injury descriptions, and incident category. Abuse reporting records, including the allegation narrative, named witnesses, and the person alleged to be responsible, who may be a staff member.

Resident money. Cash ledger entries, amounts, what money was spent on, who it was paid to, shift cash counts and variances, and photographs of receipts.

Other people named in a care record. Emergency contacts, including name, phone number, email address and relationship to the resident; guardians; PDD caseworkers; physicians; pharmacies; visitors; and anyone else a staff member names while documenting care.

Several of these fields accept free text. What a staff member writes in them is determined by the care organization’s own documentation practices, not by us.

Sensitive information. Care records contain health information about residents. We process it in order to provide the Services to the care organization responsible for that information, on their instructions.

Personal information you provide as a staff user

In Short: Your employer provides most of it when they create your account.

• Name
• Work email address
• Phone number
• Date of birth

We do not collect payment card numbers or billing addresses. Easydocks is billed to the care organization by invoice. No payment information is processed by the app.

Information collected automatically

• Which homes you are assigned to, and which one you are currently working at.
• Shift activity. Assignments, acceptances, drop requests and the reasons you give.
• Notification state. Your preferences, and which notifications you have read or dismissed.
• Audit trail. Your IP address, the actions you take on records, and the fact that you opened a particular resident’s entries on a particular day.
• Push notification token, identifying your device and its operating system.

Application data

• Camera. The app requests camera access so you can photograph a receipt when recording a cash transaction. It is requested at the point of use.
• Photo library. The app can attach an existing photo to a cash entry.
• Push notifications. The app requests permission to send notifications about shifts, deadlines and access changes. You can turn these off in your device settings or in the app.

No resident name, initial, room number, medication, or incident detail appears in any push notification. Notifications about critical incidents and abuse reports use fixed wording that names no one, for example that a report is due and you should open the app. What can appear on a locked screen: the name of a home, a shift date and time range, and in the single case of a “Shift picked up” alert sent to a home’s leads, the name of the staff member who picked up the shift.

The app does not collect location data. It requests no location permission and reads no location, precise or imprecise. It does not access your contacts, calendar, reminders, SMS messages, Bluetooth devices, or social media accounts, and it collects no biometric data.

Information collected by our website

The website collects nothing automatically. It sets no cookies and runs no analytics.

Its only form is the demo request form, which collects your name, organization, email address, phone number, number of homes you operate, what you currently use, and any notes you add. We use it only to contact you about Easydocks and to respond to your request. We do not use it for advertising, we do not add you to a marketing list without your agreement, and we do not sell it. We may use a form-handling or email service to receive and store these submissions.

Please do not include information about a resident in a demo request.

In Short: To run the software, keep it secure, and comply with law. Never for advertising.

• To deliver the Services. To let staff record care and let managers review it.
• To manage accounts. To provision, authenticate and revoke access at the direction of a care organization’s administrator.
• To send operational notifications. Shift reminders, reporting deadlines, and access changes.
• To maintain the audit trail. To record who wrote each entry and who read which records, which is what makes the record usable at a review.
• To keep the Services secure. To detect and prevent unauthorized access.
• To provide support. To answer questions from a care organization about their account.
• To comply with legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not process personal information for advertising, marketing profiling, or automated decision-making that produces legal or similarly significant effects.

Easydocks contains no advertising network and reads no advertising identifier, and nothing in it links your data with third-party data for advertising or measurement. We do not sell personal information.

In Short: Consent, and the limited exceptions Alberta law provides.

We are subject to Alberta’s Personal Information Protection Act (PIPA). We process personal information with consent, which may be express or implied depending on the circumstances, and you may withdraw consent at any time subject to legal or contractual restrictions and reasonable notice.

For care records, the care organization is the organization with the consent relationship with residents and their representatives. We process that information as their service provider, on their instructions, under a written agreement.

For staff account records, your employer collects and provides your information for purposes reasonable to your employment relationship, and we process it on their behalf.

PIPA permits collection, use or disclosure without consent in limited circumstances, including where disclosure is required to comply with a subpoena, warrant or court order, and where collection is clearly in the interests of an individual and consent cannot be obtained in a timely way.

In Short: Only with the service providers that run the software, and where the law requires it.

We use the following service providers. Each receives only what it needs in order to do its job, and each acts on our instructions.

Database and file storage

The database holding all care and account records, and storage for receipt images

Canada (Montreal)

Application server, worker and queue

Runs the Easydocks application server, background worker and queue. All care data passes through here when it is read or written

United States (Virginia)

Sign-in

Staff sign-in, passwords, sessions, and the primary staff identity record

Outside Canada

Email delivery

Sends notification and administrative email to staff email addresses

Outside Canada

Push notification delivery

Delivers push notifications to your device via Apple and Google

Outside Canada

Application monitoring

Application performance traces and logs from our servers

United States

Manager web application hosting

Serves the manager web application. Holds no records

Outside Canada

The named list is provided on request and written into the data processing agreement. It is deliberately not published here. Naming your suppliers on a public page hands anybody hunting a newly disclosed weakness in one of them a ready-made list of who to try it on. In the agreement that same list is contractually binding, which is worth considerably more to you than a web page you cannot enforce.

We may also disclose personal information where the law requires it, or where it is necessary to protect someone’s safety.

Business transfers. We may share or transfer information in connection with a merger, sale of assets, financing, or acquisition of all or part of our business. Where that happens, the receiving party is bound by this notice and by our agreement with the care organization.

We do not sell personal information, and we do not disclose it for advertising.

In Short: Stored in Canada. Processed in the United States.

Care records and receipt images are stored in Canada. They are processed in the United States.

The database sits in Montreal. The application servers that read from it, render your screens, and generate incident report PDFs and form exports run in Virginia, in the United States. Application performance traces reach a monitoring provider in the United States. Sign-in, email delivery and push notification delivery also occur outside Canada.

This means personal information held in Easydocks may be subject to the laws of the countries where these providers operate, including lawful access requests by the authorities of those countries.

As required by section 13.1 of Alberta’s Personal Information Protection Act, we tell you two things:

1. How to obtain written information about our policies and practices with respect to service providers outside Canada. Write to privacy@tryeasydocs.com and we will send it to you.
2. Who can answer your questions about the collection, use, disclosure and storage of personal information by service providers outside Canada acting for us: Alain Descartes Uwishema, Privacy Officer, at privacy@tryeasydocs.com.

In Short: No.

Our website sets no cookies. It runs no analytics, no session replay, no web beacons, and no advertising pixels. There is no cookie notice because there are no cookies to consent to.

The mobile app contains no advertising SDK, no attribution SDK, and reads no advertising identifier. It does not link your data with third-party data for advertising or measurement.

The manager web application uses only the session storage necessary to keep you signed in.

In Short: Sign-in is handled by a third-party provider. We never receive your password.

Accounts are created by your organization’s administrator. There is no public sign-up.

Depending on how your organization has configured access, you may sign in with a work email and password, or with a work Google or Microsoft account. Where you sign in with a work account, we receive your name and email address from that provider in order to match you to the account your administrator created. We do not receive your password, and we do not access anything else in that account.

We do not offer sign-in through consumer social media accounts.

In Short: Care records are kept as long as the care organization’s obligations require, and are not deleted at discharge.

When a resident leaves, their record is marked discharged and deactivated. It is not erased. Their name, date of birth, health information, care profile, contacts, shift logs, incident reports and cash ledger entries remain in the system.

Certain records cannot be changed or deleted by anyone, including us. Abuse reports, critical incident reports, cash ledger entries and form submissions are protected by database rules that reject any attempt to modify or remove them. This is deliberate. These are statutory records whose integrity has to be provable.

Staff account records are retained while the account exists, and afterwards where they form part of an audit trail, for example the record of who wrote a shift note or filed a report.

Demo request submissions are kept until you ask us to delete them.

In Short: Technical and organizational measures, described plainly.

• Sign-in is handled by a third-party provider. Easydocks never receives your password.
• Access follows the homes you actually support. Administrators see their whole organization; everyone else sees only the homes their active assignment covers.
• Opening a resident’s entries is recorded against your name.
• Abuse reports, critical incidents, cash entries and form submissions cannot be altered after submission. This is enforced by the database, not by the application.
• Receipt images are never publicly linked. They are reachable only through a signed link that expires after five minutes.
• All traffic between your device and our servers runs over HTTPS.

On your device. The app stores a sign-in token in your device’s secure keychain. If you submit a form while your device is offline, that submission is held in the app’s local storage until it can be sent.

No electronic transmission or storage technology can be guaranteed completely secure. If a breach occurs that creates a real risk of significant harm, we will report it to the Office of the Information and Privacy Commissioner of Alberta as PIPA requires, and we will notify the affected care organization.

In Short: Easydocks is a workplace tool and staff users must be adults.

We do not knowingly collect information from or market to anyone under 18. By using the Services as a staff user, you confirm you are at least 18.

Residents documented in Easydocks may be of any age, depending on the care organization’s licence. That information is entered by staff of the care organization, which is responsible for obtaining any consent required.

In Short: Access, correction, and withdrawal of consent.

Under Alberta’s Personal Information Protection Act you may:

• request access to the personal information we hold about you, and information about how it has been used and to whom it has been disclosed;
• request correction of an error or omission;
• withdraw your consent, subject to legal or contractual restrictions and reasonable notice.

To make a request, email privacy@tryeasydocs.com. We will respond within 45 days.

For information held in a care record, direct your request to the care organization that operates the home. We will assist them in responding.

Withdrawing consent. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not affect processing we carry out on another lawful basis.

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta.

Most browsers offer a Do-Not-Track (“DNT”) setting. No uniform standard for recognizing DNT signals has been finalized.

Because our Services carry no tracking or advertising technologies, there is nothing for a DNT signal to disable. If that changes, we will say so here.

In Short: Yes, as necessary.

We will post any change on this page and update the date at the top. Where a change materially affects how we handle personal information, we will notify the care organizations we work with.

Email privacy@tryeasydocs.com, or write to:

Alain Descartes Uwishema, Privacy Officer
Blueprint Solutions Corp.
PO Box 80074, Site 108, 5211 Macleod Trail SW
Calgary, Alberta T2H 0J3, Canada

Your account. Easydocks accounts are created by your employer’s administrator. You cannot create one yourself. Because your employer controls your access, they also control account closure. Ask your administrator, who can revoke your access immediately.

You can also ask us directly to close your account and delete the personal information we hold about you. Email privacy@tryeasydocs.com with the subject line “Account deletion request”, from the email address associated with your account. We will confirm the request with your employer, close your access, and delete what we are able to delete. We will respond within 45 days.

What we cannot delete, and why. Where your name appears in a care record as its author, as the person who reported an incident, or as the person who handled resident money, that record is a statutory care document belonging to the care organization. We cannot remove you from it. In several cases the database itself refuses the change, as described in section 9.

Notifications. You can turn push and email notifications off in the app at any time.