IGYBuddy Privacy Policy (Canada)

I Got You Buddy Health and Wellness Inc.

Privacy Policy (Canada)

Effective upon: October 1, 2026

Last updated: October 1, 2026

At I Got You Buddy Health and Wellness Inc. o/a IGYBuddy (“we”, “us” and “our”), we are strongly committed to transparency, and we want you to understand how we collect, use, disclose and protect your personal information, as well as how you can manage the information we collect from you. “You” includes Users and Buddies, as applicable (as the terms “Users” and “Buddies” are defined in our Terms of Use available at https://igybuddy.com/terms).

This Privacy Policy applies to your use of the Website, the Application, and the Content under our Terms of Use, and all associated Services (as the terms “Website”, “Application”, “Content” and “Services” are defined in our Terms of Use, and collectively under this Privacy Policy, the “Services”).

By using the Services, you are accepting the terms of this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Services. If you do not understand, or if you have questions about, this Privacy Policy, please contact us before using, or continuing to use, the Services.

The Services are intended for the following user groups:

• individual consumers who sign up directly for personal wellness tracking;

• company-sponsored individual members whose access is provided through an employer or other sponsoring organization;

• user-selected buddies or invitees who receive check-in prompts or notifications;

• organization owners and managers who use the restricted company portal to administer seats, invitations, and memberships;

• website visitors and individuals who submit contact forms through our website; and

• individuals who contact us through support, privacy, or security channels.

• The Services are limited to adults aged 18 or older and to individuals located in Canada, excluding Quebec. The Services are not directed to, and should not be used by, individuals located in the United Kingdom, Quebec, the United States, the European Union, or other international markets.

• The Services are not currently offered for clinic, public-sector, insurer, school, or regulated-health deployments unless separately reviewed and approved.

The date on which the Privacy Policy was last amended is indicated above. We reserve the right to change our Privacy Policy from time to time. If we choose to amend this Privacy Policy, we will revise the “last updated” date at the top of this policy when we post the updated version. We will display a prominent notice that the Privacy Policy has been amended on our Website and Application for a period of 30 days. The amended Privacy Policy is effective when posted. Your use of the Services after we have made changes to our Privacy Policy will mean that you have accepted those changes.

1. INFORMATION

Personal information means information about an identifiable individual (collectively, “personal information”), and does not include information that cannot be attributed to an identifiable individual, such as information of an aggregate or anonymous nature (collectively, “non-personal information”). We will only collect, use, and disclose the personal information that we need in order to provide you with the Services.

2. CONSENT

We will obtain your express consent prior to or when collecting, using, or disclosing your personal information for any purpose not described in this Privacy Policy, or for a purpose that was not identified to you nor reasonably expected at the time of collection, unless we are required or permitted by law not to obtain your consent.

We may rely on your implied consent in certain circumstances, after taking into account factors such as the sensitivity of the personal information and your reasonable expectations. We will limit the collection, use, and disclosure of your personal information to only that which is necessary for the purposes identified, unless you have otherwise consented, or when such collection, use, and/or disclosure is permitted or required by law.

You can always refuse to provide your personal information, except that it may prevent you from using our Services or receiving responses to your inquiries or other information of interest.

3. TYPES OF PERSONAL INFORMATION WE COLLECT

We may collect various types of personal information from you (as applicable), depending upon how you interact with us or use or interact with our Services. This personal information may include your:

• Account and Profile Information. Account credentials (such as password hash), user role, account status, profile settings, reminder and vacation-mode settings, timezone, communication preferences, name, email address, phone number, and other contact details you provide.

• Check-ins and Wellness Inputs. Daily check-in records, status indicators, and wellness notes you enter.

• Daily Score and Status Information. Daily Score summaries and related status data derived from your inputs.

• Self-Care Records. Self-care sessions, custom self-care options, and support-resource interactions.

• Buddy Relationships and Invitations. Buddy relationships, invite tokens and statuses, buddy contact details, relationship labels, notification preferences, phone verification status, support contacts, and buddy-alert history.

• Optional Apple Health or Device-Derived Signals. If you connect supported health or device permissions, we may collect Apple Health-derived or device-derived signals such as sleep, heart rate, heart rate variability (HRV), activity, and workout summaries. We use this data to generate insights, trends, Daily Scores, and other personalized wellness information to help you monitor and improve your wellbeing. These signals may be sensitive, and you can choose not to connect them.

• Push, Email, and SMS Delivery Metadata. Push tokens, notification records, delivery logs, message identifiers, delivery status, timestamps, and error information. For SMS, this includes inbound STOP/START replies and suppression records. For email, this includes delivery metadata.

• Consent and Audit Records. Records of your acceptance of the Terms of Use, Privacy Policy, and applicable consents (such as health-processing, buddy-sharing, and SMS consents), including timestamps, consent versions, and related metadata.

• Subscription, Billing-Status, and Entitlement Records. Subscription status, subscription provider, product identifiers, transaction tokens, billing period details, and tester or promotional access records. Payment card processing is handled by app-store or payment providers; we do not store full payment card details.

• Security and Diagnostic Logs. Analytics events, IP addresses, user-agent data, request metadata, security incident records, login status, failed login counts, lockout timestamps, device identifiers, operating system, browser type and version, device type, general location derived from IP address, and other logs necessary to secure and diagnose the Services.

• Support and Privacy-Request Records. If you contact us through support channels or submit a privacy request, we may collect your name, email address, message content, request status, and related submission metadata.

• Website Contact Submissions. If you submit a form through our website, we may collect your name, email address, message content, and related submission metadata.

• Organization-Administration Information. If your account is associated with an organization or company account (for example, through an employer, clinic, or other sponsoring organization), we may collect limited administrative information such as seats, invitations, memberships, roles, license status, and organization-level audit events. Organization administrators do not have access to your individual wellness check-ins, mood or status scores, Daily Scores, HealthKit or other device-derived data, self-care details, buddy-message content, communications information, or other detailed health or wellness records.

For clarity, not all information included above is personal information; we treat as personal information only data that identifies, relates to, or can reasonably be linked to an identifiable individual, and information that cannot be attributed to an identifiable individual (including property data on a non-identifiable basis) is considered non-personal information.

Where you provide us with personal information about another individual (such as a buddy or emergency contact), you represent and warrant that you have the lawful authority to do so and, where required by applicable law, that you have provided any necessary notices and obtained any required consent from that individual for our collection, use, and disclosure of their personal information as described in this Privacy Policy. Please do not upload sensitive personal information about others unless it is necessary for the Services and you are authorized to share it.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Policy.

When we combine non-personal information with personal information, we treat the combined information as personal information. You can always refuse to provide the personal information, but please note that some personal information is necessary to provide the Services.

4. HOW WE COLLECT PERSONAL INFORMATION

We need to collect personal information from you in order to provide you with our Services, as well as to improve the experience of using our Services. You may provide us with personal information in several ways, including, for example when you:

• use our Services;

• create an account or accept a buddy invitation;

• correspond with us, including through surveys;

• connect optional Apple Health or device-derived wellbeing signals;

• sign up to receive our newsletter or promotional information;

• ask for customer service, support or other assistance; or

• interact with us in any other way, online or offline, including through our Services.

We may also collect personal information from other sources (such as from third party service providers) to, among other things, enable us to complete, verify, or update personal information contained in our records and to better customize the Services we provide.

Web Beacons & Cookies

Like many websites and apps, we use web beacons and “cookies”, which are small text or image files that are stored on your computer or equipment when you visit certain online pages that record your preferences and actions, including how you use a website. We use this information for analytics purposes, which allows us to improve your experience. The information we collect through these technologies will also be used to manage your session. Out of these, the files that are categorized as "necessary" are stored on your browser as they are essential for the working of basic functionalities of the website. Disabling these necessary files may result in a website or app not functioning properly.

You can set your browser or device to refuse beacons or cookies or to indicate when they are being sent. If you delete them or if you opt-out, or if you set your browser or device to decline these technologies, some Services may not function properly. The Services do not currently change the way they operate upon detection of a Do Not Track or similar signal.

Online Analytics

We do not currently use third-party web analytics services (such as Google Analytics), advertising pixels, or third-party tracking cookies on the Website, the Application, or any authenticated user areas. If we introduce non-essential analytics or cookies on our public marketing website in the future, we will do so only after providing the required notice or obtaining consent where applicable, applying data minimization principles, completing vendor privacy and security review, and updating our Data Map, Vendor Register, and privacy documentation. Any future analytics implementation will be limited to the public marketing website and will not receive health or wellness information, HealthKit or device-derived data, buddy information, Daily Score data, SMS content, invite tokens, email addresses, phone numbers, or other directly identifying app-user data. We will not enable advertising personalization, remarketing, cross-app tracking, or similar features without separate disclosure and consent.

5. HOW WE USE PERSONAL INFORMATION

Unless otherwise consented by you in advance, or as may be permitted or required by law, we will only use and disclose your personal information to fulfill the purposes for which it was collected (and in accordance with this Privacy Policy).

We may use personal information to do any or all of the following:

• providing and securing your account, including identity verification and access management;

• producing wellness-only Daily Score and status summaries to help you monitor your wellbeing;

• operating check-ins, self-care features, buddy relationships, and user-requested notifications;

• processing optional Apple Health or device-derived signals when you choose to connect them;

• managing subscriptions and company-funded entitlements;

• administering the restricted organization portal for organization owners and managers;

• supporting users and responding to privacy requests;

• preventing abuse, fraud, and misuse of the Services;

• maintaining legal, consent, billing, security, and suppression records; and

• complying with applicable law.

• ensure our systems are secure;

• respond to legally binding demands from law enforcement, regulatory authorities or other third parties;

• defend, protect, or enforce our rights or applicable terms of service;

• to prevent fraud or the recurrence of fraud;

• assist in the event of an emergency; and

• comply with applicable law.

We may also combine your personal information collected through various sources, including personal information collected through the Services, and develop a profile that will be used for the purposes above.

In many cases, we de-identify your personal information as soon as we collect it. In these cases, such information is non-personal information. We may use non-personal information for any legitimate business purpose.

We actively process your check-ins, optional health/device signals when enabled, and recent Application activity to generate automated Daily Scores, trends, insights, and status summaries designed to help you monitor and improve your wellbeing. These features may be powered by machine learning or artificial intelligence using IGYBuddy-controlled systems and internal tools for IGYBuddy’s own product functionality. We may also use aggregated, de-identified, or anonymized information to improve the reliability, safety, performance, and functionality of our wellness-support features. We do not use identifiable wellness information for advertising, employment decisions, insurance decisions, clinical decisions, fitness-for-duty decisions, or third-party AI training. We do not sell identifiable health or wellbeing information or provide identifiable health or wellbeing information to third-party AI or model-training providers for their own AI or model-training purposes. If broader identifiable-data model training is ever introduced, we will provide additional notice and obtain any legally required consent. The Daily Score and related insights are intended to support personal awareness and buddy check-ins. They should not be treated as a medical diagnosis, safety decision, employment decision, insurance decision, emergency instruction, or professional advice. Users may request more information about the main signals used to generate a score, and may choose not to connect optional device/health data where supported.

6. HOW WE DISCLOSE PERSONAL INFORMATION

Except as set forth in this Privacy Policy, or as required or permitted by law, we do not disclose your personal information to any parties other than our service providers (including contractors and third party research and development entities) and our affiliates, and their respective directors, officers, employees, agents, consultants, advisors or other representatives that have a need to use your personal information to provide or improve our Services, to legal or regulatory authorities, or for other purposes for which you have provided your consent. In no event will we sell or rent your personal information.

We may disclose personal information:

• to our service providers that are required to operate the Services, including DigitalOcean (VPS hosting in Toronto, Canada), MongoDB Atlas (database hosting in a Canadian region), Twilio (SMS messaging), Postmark (transactional email), Sentry (crash and error monitoring), Expo/EAS (mobile app builds and push notifications), Apple (App Store, Apple Push Notification service, HealthKit integration, and subscription processing), and Google (Play Store, Firebase Cloud Messaging, and subscription processing). Core hosting is in Canada, but some providers may process personal information outside Canada. We require our service providers to use your personal information only to provide services to us and to comply with applicable privacy and security obligations;

• to your user-selected Buddies when you have enabled buddy sharing, limited to your name, contact method, relationship details, and a prompt to check in. Buddy notifications are minimal check-in prompts and do not include detailed scores, symptoms, diagnoses, or detailed health status;

• to app stores and payment platforms (Apple App Store, Google Play Store) as needed to process subscriptions and entitlements;

• where required by law, security incident response, or legal process, including to comply with any applicable legal obligation, regulatory process, or an order of a government institution, investigative body, regulatory body, or judicial authority of competent jurisdiction

• where we transfer or are considering transferring control of any or all of our assets, operations or services to a third party, including in connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets. The third party may continue to retain and use the personal information that you provided to us. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party agrees to be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such compliance by the third-party acquirer; and

• where we merge, consolidate, or amalgamate with a third party, the merged, consolidated, or amalgamated entity may continue to use and disclose your personal information. We will use our best efforts to ensure that the merged, consolidated, or amalgamated entity agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such compliance.

We may disclose non-personal information (including aggregated or de-identified data that cannot be linked to an identifiable individual) for legitimate business purposes.

If your account is associated with an organization or company account (for example, through an employer or other sponsoring organization), that organization’s administrators may access organization-administration information only, such as seats, invitations, memberships, roles, license status, and organization-level audit events. Organization administrators do not have access to your individual wellness check-ins, mood or status scores, Daily Scores, HealthKit or other device-derived data, self-care details, buddy-message content, communications information, or other detailed health or wellness records. No company or organization customer receives this administrative access until the applicable company or customer agreement and data processing addendum have been signed.

7. HOW WE PROTECT PERSONAL INFORMATION

We are concerned about ensuring the security of your personal information, and we have taken appropriate measures to ensure its security and confidentiality. We exercise great care in providing secure transmission of your personal information from your browser or device to our servers. Our security measures include: encrypted channels (TLS) between our front-end web service and our APIs; encrypted storage of personal information in secure operating environments; server-side authorization and least-privilege access controls; multi-factor authentication for privileged administration; firewall and restricted network access; secure session management; rate limits and request-size limits; security headers; log redaction to minimize sensitive data exposure; backup and restore controls with backup expiry; monitoring and alerting; access review and offboarding procedures; and incident-response procedures.

We retain personal information in accordance with our approved category-specific retention schedule, which specifies retention periods based on the type of information and the purposes for which it was collected. Retention periods are subject to backup expiry timelines, legal-hold rules where applicable, and limited post-deletion record requirements for legal, security, audit, SMS opt-out, dispute-resolution, billing, or abuse-prevention purposes. You may request account deletion from within the Application or through support. Account deletion removes active account-linked data where feasible, including check-ins, scores, buddy links, alerts, push devices, support records, self-care records, analytics events, and notification inbox data. We may retain non-personal information for as long as we have a business need to do so.

Our Services utilize third-party systems, programs, websites, solutions, and/or applications to support the provision of our Services. These third-party service providers include: DigitalOcean (VPS hosting); MongoDB Atlas (database hosting); Twilio (SMS messaging); Postmark (transactional email); Sentry (crash and error monitoring); Expo/EAS (mobile app builds and push notifications); Apple (App Store, Apple Push Notification service, HealthKit integration, and subscription processing); Google (Play Store, Firebase Cloud Messaging, and subscription processing); and GoDaddy/DigitalOcean DNS (domain registration and DNS management).

Our service providers are subject to data security and privacy obligations as set out in applicable service terms, data-processing agreements, and vendor contracts. These agreements require our service providers to implement appropriate security measures and to collect, use, disclose, and retain personal information only within the scope required for the provision of our Services. However, we are not responsible for the independent actions or privacy policies of third-party service providers beyond the terms of our agreements with them. We encourage you to review the privacy policies of third-party service providers for information on their privacy practices.

We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. If you suspect an unauthorized use or security breach of your information, please contact us as soon as possible.

8. YOUR CHOICES

We offer you certain choices in connection with our Services.

Access to your personal information

On your reasonable written request, we will provide you, not later than 30 days from our receipt of your request, or such additional time as required by law, with access to or information about your personal information (if any) under our custody or control, and the names of persons to whom, and any circumstances in which, your personal information has been and is being disclosed by us. You must provide sufficient information in your request to allow us to verify your identity and identify the information you are seeking.

If you request a copy of your personal information and the personal information can reasonably be reproduced, we will provide you with a copy of the personal information, or, if applicable, we will give you reasons for any delay in providing a copy of the requested personal information. All requests may be subject to minimal costs, in accordance with applicable privacy legislation.

We reserve all rights not to disclose personal information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

• the personal information is protected by any legal privilege;

• the disclosure of the personal information would reveal confidential commercial information;

• the disclosure could reasonably be expected to threaten the life or security of another individual;

• the personal information was generated in the course of a formal dispute resolution process; or

• the personal information was collected by us without your knowledge and consent for reasonable purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

If access to your personal information is refused, in whole or in part, we will provide you with the reasons for the refusal, the provision of applicable privacy legislation on which the refusal is based, and the contact information of the Privacy Officer who can answer your questions about the refusal, and will inform you that you may ask for a review of the refusal in accordance with applicable privacy legislation.

To submit a request to access your personal information or designate an authorized agent to make a request to access your personal information, please contact us. Our security procedures mean that we may request proof of identity before we disclose your personal information to you.

Updating your personal information

The accuracy of the personal information we have about you is very important. To submit a request that we update your personal information, please contact us.

On your request, we will make every reasonable effort to correct outdated personal information, or errors or omissions in your personal information where that personal information is in our custody or control. Such request must be in writing, signed by you, and include sufficient detail to enable us to identify any personal information in our custody or control in relation to the request.

We will, as soon as reasonably practical and not later than 30 days from our receipt of your request, or within such additional time as permitted or required by law, either correct the personal information and, if applicable and reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect personal information, or decide not to correct the personal information, but we will annotate the personal information under our control to indicate that a correction was requested but not made.

We will inform you of the action that we have taken in response to your request for correction, the contact information of the Privacy Officer who can answer your questions about your request for correction, and that you may ask for a review of the action taken in accordance with applicable privacy legislation.

Email communications

You may have the opportunity to receive certain communications from us related to our Services. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails and adjusting your email preferences. Please note that certain emails may be necessary for the operation of our Services. You will continue to receive these emails, if appropriate, even if you unsubscribe from our optional communications.

SMS communications

If SMS buddy-check prompts are enabled, message frequency may vary and carrier message/data rates may apply. Recipients can reply STOP or other supported opt-out keywords, such as STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT, to opt out of SMS buddy alerts. They can reply START or UNSTOP to remove a prior SMS opt-out. Removing a STOP opt-out does not necessarily re-enable all app-level preferences; Users and Buddies may still need to enable preferences in the app or through an invite flow. We keep SMS suppression records to respect opt-out choices and to demonstrate compliance.

Operational and service messages, such as account, security, and buddy-check SMS messages needed to provide the Services, are part of your use of the Services and are not optional marketing communications. We will only send you marketing messages based on a separate, express opt-in that you provide when that consent option becomes available.

9. THIRD PARTY WEBSITES AND APPS

The Services may contain links to other websites or apps operated by third parties. Please be advised that the practices described in this Privacy Policy do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

10. CONTACT US

If you have questions, concerns, or would like to access/update/change your personal information, you can contact us in the following ways:

Email privacy@igybuddy.com Subject Line: Privacy Information Question Attention: Privacy Officer

Mail I Got You Buddy Health and Wellness Inc. 805 Bowman Point SW Edmonton, Alberta T6W 1P7 Attention: Privacy Officer

For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.