1. Who we are and what this policy covers

Caregiver by Cognitive (“Caregiver,” the “Service”) is a product of Cognitive Systems Corp. (“Cognitive,” “we,” “us,” “our”), located at 560 Westmount Rd. N., Waterloo, ON N2L 0A9, Canada. This Privacy Policy explains how we collect, use, share, and protect personal information in connection with the Service, our website at caregiverbycognitive.com, the in-home devices we provide, and the agency dashboard.

What Caregiver is. Caregiver is a visibility and coordination tool for in-home care providers. It uses discreet in-home devices and Wi-Fi Sensing technology to create structured visibility between care visits – helping caregivers stay informed about the home environment and daily activity patterns. Caregiver is not a medical device, diagnostic tool, or emergency-response system, and it does not use cameras, microphones, or wearables.

Who this policy is written for

This policy addresses two audiences, and your rights depend on which one applies to you:

• ‍Care agencies and their staff – the organizations that license the Service and use the agency dashboard.Care recipients and their families –
• Care recipients and their families – the individuals living in homes where Caregiver devices are installed, and the family members involved in their care.

2. Our role: who controls the data

• ‍Care-recipient and in-home data: the care agency or caregiver is the controller; Cognitive is the processor. The agency or caregiver decides to deploy Caregiver in a home and is responsible for obtaining any required consent from the care recipient and family. Cognitive processes this data only to provide the Service to that agency or caregiver, under our agreement with them.Website, account, and marketing data: Cognitive is the controller.
• Website, account, and marketing data: Cognitive is the controller. When you visit our website, join the waitlist, or contact us, Cognitive decides how that information is used.

Privacy laws distinguish between the party that decides why and how personal information is processed (a “controller” or “business”) and the party that processes it on another’s behalf (a “processor” or “service provider”). Cognitive’s role changes depending on the data:

If you are a care recipient or family member and want to exercise privacy rights over in-home data, you may contact us and we will assist, but some requests may need to be directed to, or confirmed with, the care agency or caregiver that controls that data. See Section 9 (Your privacy rights).

3. Information we collect

We collect the following categories of personal information. The table also notes the typical source and which role applies.

Account & contact information

Examples: Name, business email, phone number, employer/agency name, role, and login credentials for agency users; family contact details where provided.

Source / Role: Provided by agency / caregiver / family. Cognitive as controller (accounts) or processor.

In-home sensing data

Examples: Motion, presence, and daily activity patterns derived from Wi-Fi Sensing (e.g., the time and duration of movement in a space).

Source / Role: Generated by in-home devices. Agency / Caregiver is controller; Cognitive is processor.

Device & technical data

Examples: Device unique identifier, IP address, MAC address, operating system, browser type, mobile network information, and similar diagnostics.

Source / Role: Collected automatically by devices/app.

Dashboard & usage data

Examples: Pages viewed, features used, configuration settings, and log/audit data within the agency dashboard.

Source / Role: Collected automatically.

Website & cookie data

Examples: IP address, browser and device details, region of access, and analytics about how you use our website.

Source / Role: Collected via cookies/analytics. Cognitive as controller.

Communications

Examples: Messages, support requests, and feedback you send us, including waitlist sign-ups.

Source / Role: Provided by you. Cognitive as controller.

Sensitive information. Because Caregiver is used in the homes of people receiving care, in-home activity data can reveal sensitive patterns about an identifiable person’s daily life. We treat this data with heightened care and use it only to provide the Service. We do not collect vital signs, medication data, health diagnoses, precise GPS location of individuals, government IDs, or financial account numbers through the Service.

What we do not do

Consistent with how the Service is designed, Cognitive does not:

• use cameras, microphones, video, audio recording, or wearable tracking devices;
• monitor vital signs, track medication adherence, or detect, diagnose, or treat any medical condition;
• provide emergency-response or clinical services; or
• sell personal information, or “share” it for cross-context behavioral advertising, as those terms are defined under California law. See Section 6.

4. How we use information

We use personal information to:

• provide, operate, maintain, and secure the Service and the in-home devices;
• give care agencies / care givers structured visibility into the home environment and daily activity patterns between visits;
• create and manage accounts, authenticate users, and provide customer support;
• improve and develop the Service, including troubleshooting, analytics, and product research using aggregated or de-identified data;
• communicate with you about the Service, including service notices and, where permitted, marketing (which you can opt out of); and
• comply with legal obligations and enforce our agreements.

5. Our grounds for processing

Canada (PIPEDA). We collect, use, and disclose personal information with the knowledge and consent of the individual, except where the law permits or requires otherwise. Consent for in-home monitoring is obtained by the care agency before a device is installed. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice — see Section 9.

United States. We process personal information to perform our contract with the care agency or caregiver, to operate and secure the Service, for our legitimate business purposes described above, and to comply with law. We rely on the care agency or caregiver to provide any notices to, and obtain any consents from, care recipients required under applicable state law.

6. How we share information

We share personal information only as described here:

• ‍With the care agency or caregiver. In-home and care-recipient data is made available to the licensing care agency or caregiver through its dashboard.
• ‍Service providers / sub-processors. We use vendors, including third-party infrastructure and analytics providers, that host, store, and process data on our behalf (for example, cloud infrastructure and analytics providers) and otherwise help run our services under contracts that require them to protect the data and use it only for our purposes. This includes AWS for data hosting, PostHog (Product usage behavior, session recordings, heatmaps, and unique user IDs) for product analytics, and Bugsnag (Crash logs, device information, IP addresses, and potentially Personal Identifiable Information (PII) accidentally caught in stack traces) for error reporting.‍
• Legal and safety. Where required by law, legal process, or to protect the rights, safety, and security of individuals, the public, or Cognitive.‍
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.‍
• With your direction or consent. When you ask us to share information, or otherwise consent.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended (“CCPA/CPRA”).

7. Cookies and similar technologies

Our website uses cookies and similar technologies to enable core functionality, remember preferences, analyze site usage, and support our marketing. When required, we present a cookie banner so you can accept or decline non-essential cookies, and you can also manage cookies through your browser settings. You can find more detail, including the categories of cookies we use, in our cookie notice.

8. Data retention and security

Retention. We keep personal information only as long as necessary for the purposes described in this policy, to provide the Service to care agencies or caregivers, and to meet legal, accounting, or reporting requirements. Our current retention periods are:

In-home sensing data (motion / activity patterns)
Retention period: Retained on a rolling 12-month basis, then deleted or de-identified.

Account and contact information
Retention period: Kept for the life of the account and for 90 days after it is closed, then deleted.

Device and technical / diagnostic logs
Retention period: 90 days.

Dashboard usage and audit logs
Retention period: 6 months.

Website analytics and cookies
Retention period: Analytics data up to 14 months; cookies expire according to the durations stated in our cookie banner or notice.

Support communications and waitlist
Retention period: 24 months after your last interaction with us; waitlist entries are kept until launch or until you opt out.

De-identified or aggregated data
Retention period: May be retained indefinitely, as it no longer identifies an individual.

Backups
Retention period: Deleted data may persist in secure backups until they are overwritten on our normal backup cycle.

We may retain information for longer where a legal hold or other legal obligation requires it. When a care agency’s or caregiver’s agreement with us ends, we return or delete the care-recipient data associated with that agency within 30 to 90 days, in accordance with our agreement with the agency. Because the care agency controls in-home and care-recipient data, retention of that data also follows the agency’s documented instructions. When data is no longer needed, we delete or de-identify it.

Security. We use technical and organizational safeguards designed to protect personal information, including encryption of sensing data in transit and at rest, access controls, and anonymization or de-identification where feasible. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your privacy rights

Canada (PIPEDA)

If you are in Canada, you have the right to access the personal information we hold about you, to request correction of inaccuracies, and to withdraw consent (subject to legal or contractual limits and reasonable notice). We will respond to access requests within the timeframe required by PIPEDA. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:
‍

• know and access the categories and specific pieces of personal information we have collected about you;
• delete personal information we have collected, subject to exceptions;
• correct inaccurate personal information;
• opt out of any “sale” or “sharing” of personal information (note: we do not sell or share personal information as those terms are defined); and
• limit the use of sensitive personal information, and not be discriminated against for exercising your rights.

You may submit a request as described in Section 11. We will verify your request and respond within the timeframes required by law. You may use an authorized agent to submit a request on your behalf.

Other U.S. state privacy rights

Residents of other U.S. states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to appeal a decision on a request. We honor these rights where they apply. Contact us as described in Section 11.

Care recipients and families

Because the care agency or caregiver controls in-home and care-recipient data, requests about that data may be routed to, or confirmed with, the relevant agency. If you contact us directly, we will help you reach the right party and will act on the controller’s instructions as its processor. For data where Cognitive is the controller (such as website and account data), we will handle your request directly.

10. Children’s privacy

The Service is intended for use by care agencies and adults involved in in-home care. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, please contact us so we can address it.

11. International data transfers

Cognitive is headquartered in Canada and processes and stores personal information in Canada and the United States. Where we transfer personal information across borders (for example, between Canada and the United States), we use appropriate safeguards required by applicable law. The Service is offered to care agencies, caregivers and individuals in the United States and Canada; if you access it from elsewhere, you do so on your own initiative.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

13. How to contact us

For privacy questions or to exercise your rights, contact:

Cognitive Systems Corp. – Privacy

Email: privacy@cognitivesystems.com

Mailing address: 560 Westmount Rd. N., Waterloo, ON N2L 0A9, Canada

Privacy officer / contact: Privacy Officer

If you are in Canada and remain unsatisfied after contacting us, you may reach the Office of the Privacy Commissioner of Canada at priv.gc.ca.