Privacy policy

Who this policy covers

It covers everyone whose information passes through VTEPCare: the adult who holds an account, every person whose profile is kept in that account (a child, a teenager, an adult, an older person), the people an account invites to see a profile, and visitors to vtepcare.com. An organization that keeps a record for an older person uses the separate consent text at vtepcare.com/senior/consent together with this policy.

What we collect

We collect only what the service needs to work:

• Account: your email address and a password (stored in hashed form only), the language you choose, and the dates you sign in.
• Profile: the person's name, date of birth and language, and the stage and areas the account turns on (learning, sport, creativity, fitness, wellbeing, later-years check-ins).
• Readings and notes: what you record about the person over time, such as school results and teacher comments, sport sessions and times, fitness measures, wellbeing check-ins, goals, observations and notes, and, for older adults, the result and follow-up of checks done with a professional.
• Uploads: the files you add to a profile, such as a report card, a photo or a document.
• Conversations with MAI: the messages you exchange with the AI guide and the summaries it keeps.
• Usage and technical events: the pages used and actions taken in the account (kept as an activity log), and technical data such as the IP address and browser type, which the hosting service records for security.

Why we collect it

We use this information for the following purposes, and nothing else:

• To keep the growth profile you asked us to keep, and to show it back to you over time.
• To let MAI read the profile so it can suggest useful next steps, draft summaries and answer your questions. Calculations (averages, trends, projections) are made by deterministic code, not by the AI.
• To send you the emails the service needs: account confirmation, password reset, invitations you ask for, and reminders you turn on.
• To keep the service safe: to sign you in, to know who may see or change a profile, and to detect misuse.
• To understand how the site is used as a whole, in aggregate, without identifying any person.

We never sell personal information and we do not use it for advertising.

Who can see it

A profile is private by default. Only these people can see it:

• The account that created the profile.
• The people that account invites, with the level of access it chooses (view, edit or manage), for as long as the invitation stands. Access can be removed at any time from the profile's access page.
• The person responsible for the protection of personal information at VTEPCare, and the few people who maintain the service, only when needed to run it, to fix a problem you report or to answer a request about your rights. They are bound to confidentiality.
• The service providers listed below, only to the extent needed to provide their service to us.

We do not share personal information with anyone else unless the law requires it.

Where it is kept, and who processes it

The record is stored in Canada, in a database region located in central Canada (ca-central-1). To run the service we rely on a small number of providers, each bound by contract to protect your information:

• Supabase — the database and sign-in service, in the Canadian region named above.
• Vercel — the web hosting that serves the pages, and the aggregate site statistics described under Cookies.
• Anthropic — the language model behind MAI. When you use MAI, the parts of the profile it needs in order to answer are sent to Anthropic's API, and MAI's replies are drafted from them.
• Resend — the service that sends our emails, which receives the email address and the content of each message.

Some of these providers operate from outside Quebec and Canada, mainly in the United States, so your information may be transferred outside Quebec when the app is used, when MAI is asked a question or when an email is sent. Before using such a provider we assess the protection it offers, including its contract terms and the law that applies to it, as Law 25 requires, and we continue only if that protection is adequate.

MAI is an AI guide, not a professional

MAI reads the profile and drafts suggestions, summaries and replies. Nothing MAI says is a medical, psychological or educational diagnosis, and nothing in VTEPCare replaces a doctor, a psychologist, a teacher or a coach. Where the app offers a screening check (for example the WHO ICOPE check for older adults), it records only the result and the follow-up; a result that needs attention is for a professional to assess. MAI's suggestions are drafted from the information you entered, and you remain responsible for the decisions you take.

Children and parental consent

Most profiles in VTEPCare belong to minors. A profile for a person under 18 may only be created by a parent or legal guardian, who gives consent for the child. For a child under 14, that consent must come from the parent or guardian, as Law 25 requires. A teenager may be invited to see or add to their own profile, but the account holder remains responsible for it. We do not knowingly accept an account from a person under 18, and we delete any such account when we learn of it.

How long we keep it, and how to delete it

We keep the record for as long as the account exists, because the point of a growth profile is to carry on over time. When you delete a profile, its readings, notes, uploads, MAI conversations and invitations are removed. When you delete your account, every profile it owns and the account itself are removed. Copies held in routine backups are overwritten on their own cycle shortly afterwards. Some technical logs are kept for a limited time for security. To ask for a deletion, or for help with one, write to us through the contact page.

Write to us through the contact page

Your rights

Under Quebec law you may, for yourself or for a child you are responsible for:

• Ask to see the personal information we hold about you, and receive a copy in a usable, structured format (portability).
• Ask that inaccurate or incomplete information be corrected.
• Withdraw your consent at any time. Withdrawing does not undo what was done before, and may mean the service can no longer be provided.
• Ask that your information, or a profile's, be deleted.
• Ask who has had access to your information and to which providers it was sent.
• File a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) if you believe your rights were not respected.

We answer a request within 30 days. Write to us through the contact page; we may ask you to confirm your identity first.

Write to us through the contact page

Cookies and site statistics

VTEPCare uses only the cookies it needs to work: a session cookie that keeps you signed in, a cookie that records the access password you entered, and a cookie that remembers your language. There are no advertising or tracking cookies. The site uses Vercel Web Analytics and Speed Insights, which count page views and measure page speed in aggregate, without cookies and without identifying any person.

How we protect it

Information travels encrypted between your device and the service. Each person sees only the profiles they were given access to, and this rule is enforced in the database itself, not only on the page. Passwords are never stored in readable form. Access by the people who maintain the service is limited and recorded. If a confidentiality incident presented a risk of serious injury, we would notify the Commission d'accès à l'information and the people concerned, as the law requires.

Person responsible for the protection of personal information

VTEPCare has designated a person responsible for the protection of personal information, as Law 25 requires. Requests about this policy, about your rights or about a possible incident reach that person through the contact page.

Write to us through the contact page

Changes to this policy

When the substance of this policy changes, we update the version and date shown below and tell account holders by email or in the app. Smaller wording changes may be made without notice. The version in force is always the one published at vtepcare.com/privacy.