Privacy Policy — effective 10 August 2026. This policy replaces the Welab privacy policy dated 1 June 2023.

Welab Technologies Inc. (“Welab”, “we”, “us”) builds and licenses technology for healthcare logistics. We take the protection of personal information seriously and we maintain procedures and safeguards to keep it confidential and secure.

This policy explains how we handle personal information for which Welab is the accountable organisation — people who visit this website, who contact us about our products, who apply to work with us, and who work for us.

It does not cover patients, phlebotomists or laboratory staff whose information is processed inside the Welab platform. For those people Welab acts on behalf of the laboratory operating the service, and a separate notice applies: see our Platform Privacy Notice.

Welab Technologies Inc. is a Canadian company registered in Ontario. Our registered address is 4441 Marshdales Court, Mississauga, Ontario L5M 4G2, Canada.

We are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Where we handle personal health information as an agent of an Ontario health information custodian, Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) also applies — that is dealt with in the Platform Privacy Notice.

Our Privacy Officer is responsible for compliance with this policy and can be reached at [email protected]. Every Welab employee, contractor and agent is required to comply with our privacy and security policies as a condition of their engagement.

If you visit this website. We collect technical information that your browser sends — IP address, browser type, pages viewed, and the time of your visit — and we use it to keep the site running, to keep it secure, and to understand which pages are useful. Section 6 explains cookies.

If you contact us or ask about our products. We collect the name, business email address, telephone number, employer and role you give us, together with what you tell us about your requirements. We use it to answer you, to prepare proposals, and to keep in touch about our products. You can ask us to stop at any time.

If you apply for a role with us. We collect your CV, contact details, work history, references and right-to-work information. Where a role warrants it and where you have consented separately, we may commission a background check through a third-party provider. We use this information only to assess your application and, if you are successful, to onboard you.

If you work for us. We collect and hold the information needed to employ or engage you and to meet our obligations as an employer: identity and contact details, banking and tax information, engagement and payroll records, training and policy acknowledgements, performance records, and records of the systems access granted to you.

We collect personal information directly from you wherever we can. Where we obtain it from someone else — a referrer, a referee, or a background check provider — we do so with your knowledge.

We do not sell personal information, and we do not disclose it for anyone else’s marketing.

We use personal information to identify the people we deal with; to provide, support and improve our products; to correspond with you; to recruit; to administer employment and engagement; to meet legal, tax and regulatory obligations; and to protect our systems and investigate misuse.

We disclose personal information only in these circumstances:

• To service providers who process it on our behalf and under contract — the categories are listed in section 5. They may use it only to provide the service to us.
• Where the law requires it, or to establish, exercise or defend a legal claim.
• In a corporate transaction, if Welab is involved in a financing, sale or reorganisation — in which case the other party is restricted by agreement to using the information for that transaction only, and to protecting it on terms no weaker than these.

We obtain your consent to collect, use and disclose your personal information, and by providing it to us you consent to our handling it as described here. Where the information is sensitive, we seek express consent.

You can withdraw your consent at any time, subject to legal or contractual restrictions and to reasonable notice, by writing to [email protected]. We will tell you what withdrawing consent means in practice — in some cases it will mean we can no longer provide a product or service to you, or continue a hiring process.

You can opt out of marketing communications at any time, either by using the unsubscribe link in any message or by writing to us. Withdrawing marketing consent does not affect messages we must send you about a service you are receiving.

We use a small number of established service providers, each engaged under a written agreement requiring them to protect personal information and to use it only on our instructions:

A current list of the specific providers is maintained in our vendor and subprocessor register and is available to customers on request.

This website sets a small number of cookies. They are listed here in full, in this notice, rather than on a separate page, so that what we tell you and what the site actually does cannot drift apart. The list below was verified against the live site on 4 August 2026.

The messaging widget also stores one entry in your browser’s local storage, intercom.intercom-state-nv9dcrc4, which records only whether the messaging window is open or closed.

These cookies are functional. They exist so that you can start a conversation with us and so that the conversation survives you moving between pages. They do not build an advertising profile of you and they do not follow you to other websites. We do not use advertising, analytics or cross-site tracking technologies on this website, and we set no cookie for those purposes.

If you would rather not have these cookies you can refuse or delete them in your browser settings. The website works normally without them; only the messaging widget stops remembering your conversation. We review this list whenever the website changes and at least once a year, and if we ever add a cookie that is not functional we will ask for your consent before it is set.

We keep personal information only for as long as we need it for the purpose we collected it for, or for as long as the law requires — whichever is longer. When it is no longer needed we securely destroy, delete, erase or anonymise it.

Some periods are fixed by law or by our own policy. Employment and engagement records are kept for the duration of the relationship plus seven years. Corporate financial records are kept for a minimum of six years from the end of the last tax year to which they relate. Security and compliance records are kept for a minimum of seven years. The full schedule is set out in our Data Retention and Disposal Policy, which is available on request.

We store personal information in a secure cloud environment located in Canada. Our production systems run in Canada and our backups are held in Canada. Access is restricted to those individuals who need it to do their jobs, and that access is reviewed periodically.

We maintain physical, procedural and technical safeguards appropriate to the sensitivity of the information, including encryption of information in transit and at rest, multi-factor authentication, logging of access to production systems, and a documented incident response process.

We will not transfer your personal information outside Canada without notifying you first and giving you the opportunity to withdraw your consent, unless the law otherwise permits or requires it.

No safeguard is perfect. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will keep a record of the breach as the law requires.

You may ask us to:

• tell you what personal information we hold about you, how we have used it, and to whom we have disclosed it;
• give you a copy of it, in an accessible format;
• correct anything that is inaccurate or incomplete;
• delete it, where we have no continuing legal or business reason to keep it;
• stop using it for a particular purpose, including marketing.

Write to [email protected]. We will confirm receipt and respond within 30 days. If we need more time, we will tell you before the 30 days are up, explain why, and tell you when to expect our answer. We do not charge for this.

We will verify your identity before we act, and we may not be able to grant access in full — for example where doing so would reveal personal information about someone else who will not consent, or where the information is subject to legal privilege. If we refuse, in whole or in part, we will tell you in writing why, and tell you how to complain.

If you are unhappy with how we have handled your personal information, write to our Privacy Officer at [email protected]. We will acknowledge your complaint, investigate it, and give you a written answer.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376). Where the complaint concerns personal health information handled in Ontario, you may complain to the Information and Privacy Commissioner of Ontario (ipc.on.ca, 1-800-387-0073).

This policy is effective as of the date at the top of the page. We review it at least once a year, and whenever we make a material change to our products or to how we handle personal information.

When we change it, we will update the effective date and, if the change is material, tell you through the application or by email before it takes effect. Previous versions are retained and are available on request. Your continued use of our services after a change takes effect means you accept the updated policy.

Privacy Officer, Welab Technologies Inc., 4441 Marshdales Court, Mississauga, Ontario L5M 4G2, Canada. [email protected]