Platform Privacy Notice — effective 10 August 2026.

This notice explains how Welab Technologies Inc. handles personal information and personal health information inside the Welab platform — the software a laboratory or healthcare provider licenses from us to schedule collections, dispatch phlebotomists and record what was collected.

It is not the notice that governs your care. If you are a patient, the laboratory or healthcare provider that arranged your collection is responsible for your health information and its own privacy notice governs. This notice tells you what our role is, so that you know where your information goes and who to ask about it.

This notice covers the platform. The cookies our public website sets, and what each one does, are listed in full in our Privacy Policy.

Welab licenses a platform. The organisation that operates the service — the laboratory or healthcare provider, which we call the operator — decides what information is collected, why, and what happens to it. We process that information on the operator’s instructions and for no purpose of our own.

In legal terms:

• Under Ontario’s Personal Health Information Protection Act, 2004, the operator is the health information custodian. Welab is its agent under section 17. We may collect, use, disclose, retain and dispose of personal health information only as the operator permits, only for the purposes the operator has authorised, and only in accordance with our agreement with the operator.
• Under PIPEDA, Welab acts as a service provider processing personal information on the operator’s behalf. The operator remains accountable for it.

What this means in practice. We do not decide what is collected. We do not use platform information for our own purposes. We do not sell it, we do not use it for advertising, and we do not use it to train models or build products outside what the operator has authorised in writing. If you ask us to give you your information, correct it or delete it, we will not act unilaterally — we will pass your request to the operator and support them in answering it, because the decision is theirs to make.

Four groups of people have information in the platform: patients who receive a collection; phlebotomists and mobile collection staff who perform it; operator staff who administer the service; and partner staff at organisations the operator works with.

For patients: identifying information including name, contact details and the Ontario health number; the collection address; the tests a physician has ordered; requisition metadata; the appointment window; and a record of the collection including specimen details and timestamps.

We treat a requisition as personal health information even before any result exists, because the tests a physician has ordered disclose what was clinically suspected. The health number alone is personal health information.

The platform does not hold laboratory results. Results are produced and held by the operator’s own systems.

For phlebotomists and collection staff: identity and contact details, credentials, assignment history, and location information while working — including the route and position data needed to dispatch and to confirm attendance.

For operator and partner staff: name, work contact details, role, and account and access records.

All platform data is stored in Canada. Production systems run in the Toronto region of Google Cloud Platform and backups are held in the Montréal region. No production data, backup or disaster-recovery copy is stored outside Canada.

Where documents are processed automatically to extract information, that processing takes place in Canada.

Our own service providers. Welab engages a small number of subprocessors, each under written contract, to run the platform: cloud infrastructure and storage, identity and authentication, push notification delivery, and address and routing services. Every operator receives the current subprocessor list, is notified before we add one, and may object.

Services the operator connects itself. The platform includes an integration hub. Where an operator wants messaging, email or payment processing, the operator brings its own subscription and its own credentials and connects them in the administration panel. Today that includes Twilio, SendGrid and Stripe.

Those are the operator’s vendor relationships. The operator chose the vendor, holds the contract, and determines where that vendor processes information. Welab transmits to the endpoint the operator configures. We disclose that we do so; we do not control it, and we do not represent where those providers process. Your operator’s own privacy notice should tell you which of these it uses.

The operator determines how long information is kept, within the periods set by our Data Retention and Disposal Policy and by the operator agreement.

When an operator agreement ends, the operator’s data is deleted within 30 days of the effective termination date and a deletion certificate is issued. Residual copies inside encrypted backups are not individually excised; they age out of the backup rotation within seven backups and seven days of transaction logs. We disclose that window rather than claim an instantaneous erasure we could not deliver.

Platform data is encrypted in transit and at rest. Access to production systems requires multi-factor authentication, is granted on a least-privilege basis, is logged, and is reviewed periodically. Welab maintains a documented incident response process, and where a privacy breach occurs we notify the operator promptly so that the operator can meet its own notification obligations to individuals and to the Information and Privacy Commissioner of Ontario.

To dispatch a collection we resolve service addresses and compute routes. Where an address cannot be served from our own cache, it may be sent to a mapping provider.

The platform can be operated with no address egress at all — distances served from cache and computed locally — and an operator that requires this can be accommodated by configuration rather than by code change.

If you are a patient, a phlebotomist, or operator or partner staff: contact the operator — the laboratory or healthcare provider that arranged the service. They are accountable for your information and they hold the relationship with you. Their privacy contact will be in their own privacy notice.

If you cannot identify the operator, or if your question is about Welab specifically — what our platform does, where data is stored, who our subprocessors are — write to us at [email protected] and we will help you, and where appropriate route your request to the right operator.

You may also complain to the Information and Privacy Commissioner of Ontario (ipc.on.ca, 1-800-387-0073) about the handling of personal health information, or to the Office of the Privacy Commissioner of Canada (priv.gc.ca) about personal information under federal jurisdiction.

We review this notice at least annually and whenever the platform changes materially. Where a change affects operators or the people whose information they entrust to us, we notify operators in advance. The effective date at the top of this page always reflects the current version, and previous versions are retained and available on request.

This notice does not displace the operator’s privacy notice and does not purport to obtain consent from any individual. Consent for the collection, use and disclosure of personal health information in the platform is obtained by the operator as custodian. Welab publishes this notice so that individuals, operators and regulators can see the division of responsibility, the storage locations and the subprocessor position without having to ask for them.