Privacy Policy

1. Who We Are

HEAL28 Academy Corporation ("HEAL28", "we", "us", "our") is a health technology company incorporated in the Province of British Columbia, Canada. We develop and operate TravelCarePlans — an AI-powered travel health platform that generates personalised care plans for international travellers with pre-existing health conditions.

This Privacy Policy applies to all personal information collected through our website at travelcareplans.com, our platform, mobile applications, and any other interactions you have with us.

2. Applicable Privacy Frameworks

TravelCarePlans operates at the intersection of travel and personal health — which means we handle some of the most sensitive personal data that exists. We comply with all privacy frameworks applicable to our operations and the jurisdictions where our users are located.

Canada — PIPEDA (Federal)

Our primary privacy obligation is the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5), which governs the collection, use, and disclosure of personal information in the course of commercial activities — including our interprovincial and international operations. We adhere to all ten of PIPEDA's Fair Information Principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use / Disclosure / Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

British Columbia — PIPA (Provincial)

As a company incorporated and headquartered in British Columbia, our provincially regulated activities are governed by the Personal Information Protection Act (PIPA, S.B.C. 2003, c. 63). BC PIPA has been recognised by the federal government as substantially similar to PIPEDA. Like PIPEDA, PIPA requires meaningful consent for the collection of personal information and heightened protections for sensitive information including health data.

European Union / EEA — GDPR

For users located in the European Union or European Economic Area, we comply with the General Data Protection Regulation (EU 2016/679). Health data constitutes a "special category" under GDPR Article 9, requiring explicit consent as the legal basis for processing. Canada has received an EU adequacy decision in respect of organisations subject to PIPEDA, and we supplement this with Standard Contractual Clauses where required.

HIPAA Alignment (United States)

HEAL28 Academy Corporation is not currently a HIPAA-covered entity or business associate as defined under 45 CFR §160.103. However, we voluntarily align our health data security architecture with HIPAA's Administrative, Physical, and Technical Safeguard requirements as a baseline standard of care for all users and as a prerequisite for future enterprise partnerships with US-regulated health organisations.

Australia — Privacy Act 1988

For users located in Australia, we comply with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs), including APP 8 governing cross-border disclosure.

Canada — CASL

All commercial electronic messages we send to Canadian recipients comply with Canada's Anti-Spam Legislation (S.C. 2010, c. 23), including the requirements for express or implied consent, sender identification, and a functioning unsubscribe mechanism.

3. Information We Collect

We collect personal information in two categories: General Personal Information and Health Information, which receives additional protections as sensitive personal information.

We do not collect more information than is reasonably necessary for the purposes described in this policy (principle of data minimisation). You will always be told the purpose for collection at or before the point of collection.

3.1 General Personal Information

3.2 Health Information (Sensitive / Special Category)

Health information you voluntarily provide is classified as sensitive personal information under PIPEDA and PIPA (BC), and as a special category of personal data under GDPR Article 9. It is collected only with your explicit, separate, and informed consent, and used solely to generate your personalised care plan.

• Pre-existing medical conditions and diagnoses
• Current medications, dosages, and prescribing schedules
• Known allergies (medications, foods, environmental)
• Relevant medical history (surgeries, hospitalisations, chronic conditions)
• Mobility or accessibility requirements
• Emergency contact information
• Healthcare provider details (optional)
• Health insurance policy information (optional)

3.3 Information We Do Not Collect

We do not purchase, obtain, or append personal information from data brokers or third-party commercial data sources. All personal information we hold was provided directly by you or collected through your direct use of our platform.

4. Legal Basis for Processing

Under PIPEDA and PIPA (BC)

We collect and use personal information only with your knowledge and consent, except where the law permits otherwise (e.g. for safety or legal obligations). For health information, we require explicit, informed consent obtained separately at the point of collection. You may withdraw consent at any time subject to legal and contractual restrictions.

Under GDPR (EU/EEA Users)

Our legal bases for processing personal data are:

Where we rely on legitimate interests, we have documented a Legitimate Interests Assessment (LIA) confirming that our interests are not overridden by your rights and freedoms. You may request a copy of any LIA by contacting our Privacy Officer.

Where we rely on explicit consent for health data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing that occurred before the withdrawal.

5. How We Use Your Personal Information

We use personal information only for the purposes identified at or before the time of collection. We do not use personal information for a new, incompatible purpose without your renewed consent.

Primary purposes (necessary for service delivery)

• Generating your personalised travel health care plan
• Operating, maintaining, and improving the TravelCarePlans platform and AI models
• Providing 24/7 AI nursing assistant support during your journey
• Identifying relevant healthcare resources, emergency contacts, and medication information at your destination
• Communicating with you about your account, care plan updates, and service changes
• Responding to your enquiries and support requests

Secondary purposes (require your separate consent where applicable)

• Sending product newsletters, health travel content, and platform updates (opt-in, CASL-compliant)
• Conducting anonymised aggregate research to improve our clinical AI models
• Sharing fully de-identified, aggregate insights with research and academic partners

6. Automated Decision-Making and AI

TravelCarePlans uses artificial intelligence and automated processing to generate personalised care plans. We are transparent about how our AI works and what it does — and does not — do.

What our AI does

Our AI models cross-reference your health profile against destination-specific healthcare databases, medication availability registries, drug importation regulations, and emergency resource networks to produce your personalised care plan. The AI continuously learns from anonymised, aggregated data across users to improve recommendation quality and coverage accuracy.

What our AI does not do

Our AI-generated care plans are informational outputs, not clinical diagnoses. The platform does not diagnose medical conditions, prescribe treatments or medications, or provide a second opinion on medical decisions. All AI-generated content is designed to support — not replace — the guidance of your qualified healthcare professional. You should always consult your physician before making changes to your medications or care management while travelling.

Your rights regarding automated processing

Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To the extent our AI outputs may constitute such outputs, you may:

• Request human review of any AI-generated care plan recommendation
• Challenge or request clarification on any specific recommendation
• Opt out of AI-generated personalisation entirely and request a manually curated resource list instead

To exercise any of these rights, contact our Privacy Officer at privacy@travelcareplans.com.

7. Sharing Your Personal Information

We do not sell your personal data. We do not rent it. We do not trade it. We share personal information only in the limited circumstances described below.

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf, strictly under written data processing agreements that bind them to confidentiality, security, and purpose-limitation obligations at least as protective as this policy.

For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms where required under GDPR.

7.2 Healthcare and Emergency Resources

Where you give explicit consent, we may transmit relevant portions of your care plan to:

• Pre-verified emergency contacts or healthcare facilities at your destination, in the event of a medical emergency you are unable to manage independently
• A carer, family member, or emergency contact you designate in your profile (only information you have authorised them to receive)

We will always ask for your explicit consent before any such transmission, except where the disclosure is necessary to prevent imminent danger to life as permitted under PIPEDA Section 7(3)(e) and equivalent provincial legislation.

7.3 Legal Requirements and Safety

We may disclose personal information without your consent only where:

• Required by a valid court order, judicial warrant, or lawful demand from a government authority
• Necessary to prevent or respond to an imminent threat to life, health, or safety (PIPEDA s. 7(3)(e); PIPA (BC) s. 18(1)(d))
• Required to comply with mandatory breach notification or statutory reporting obligations

We will notify you of any such disclosure unless we are legally prohibited from doing so.

7.4 Business Transfers

If HEAL28 Academy Corporation undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, personal data may form part of the transferred assets. We will notify affected users before their personal information is transferred and becomes subject to a materially different privacy policy. You will have the opportunity to request deletion of your data before the transfer takes effect.

8. Health Data — Additional Protections

Given the sensitivity of health information and its potential to cause significant harm if mishandled, we apply the following specific protections beyond our general privacy commitments:

Explicit consent at collection

We obtain separate, specific, informed, and unambiguous consent before collecting any health information. This consent is not bundled into general terms acceptance. You may withdraw health data consent at any time; withdrawal will limit care plan personalisation but will not affect your access to general platform features.

Strict purpose limitation

Your health data is used exclusively to: (a) generate and maintain your travel care plan, and (b) support your in-journey health assistance via the AI nursing assistant. It is never used for marketing, profiling, advertising, or any purpose unrelated to your direct care.

No insurance underwriting from individual data

We explicitly prohibit — by contractual obligation — any insurance or travel partner from using individual health data obtained via TravelCarePlans to underwrite, deny, limit, or price any insurance policy. Any aggregate or anonymised data shared with partners is de-identified to a standard that makes re-identification effectively impossible.

Right to compartmentalise

You may choose which health conditions to include in your care plan. You are never required to disclose all conditions to use the service, and partial disclosure will not result in reduced access to other platform features.

Dedicated retention limit

Health data is retained only for the duration of your active account, plus a maximum of 12 months following account closure (to enable account reactivation). After that period, all health data is permanently and irreversibly deleted using secure erasure methods. You may request immediate deletion at any time.

9. Data Security

We implement administrative, physical, and technical safeguards commensurate with the sensitivity of the personal information we handle — including health data — and aligned with PIPEDA, PIPA (BC), GDPR, and HIPAA-equivalent standards.

• Encryption at rest: All health and personal data stored on our servers is encrypted using AES-256 or equivalent
• Encryption in transit: All data transmitted between your device and our servers is secured using TLS 1.2 or higher (HTTPS-only)
• Access controls: Role-based access controls ensure that personnel access only the minimum personal data necessary for their specific function (principle of least privilege)
• AI inference zero-retention: Our AI inference pipeline does not retain personal health information after a care plan has been generated — data is processed in memory and not written to logs
• Vulnerability management: We conduct regular security assessments and penetration testing of our infrastructure
• Incident response: We maintain a documented security incident response plan with defined escalation procedures and breach response timelines
• Employee training: All personnel with access to personal data complete privacy and security awareness training before access is granted and on an annual basis thereafter
• Vendor security: All third-party service providers are assessed for security compliance before engagement and at regular intervals

10. Data Breach Notification

We are subject to mandatory privacy breach notification requirements under PIPEDA's Breach of Security Safeguards Regulations (SOR/2018-64), PIPA (BC), and — for EU users — GDPR Articles 33 and 34.

Our obligations in the event of a breach

If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm to individuals (as defined under PIPEDA), we will:

• Notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible after determining a real risk of significant harm exists
• Notify affected individuals directly, as soon as feasible, with information about: the nature of the breach, the personal information involved, the steps we have taken to address it, and the steps you can take to protect yourself
• For EU/EEA users: notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms
• Maintain a breach register containing records of all security breaches (including those that do not meet the notification threshold) for a minimum of 24 months, as required under PIPEDA

11. Retention of Personal Information

We retain personal information only as long as is necessary for the identified purpose or as required by applicable law. We apply the following retention schedules:

When data is deleted, we use secure deletion methods (overwriting, cryptographic erasure, or equivalent) to ensure that deleted personal information cannot be recovered or reconstructed.

12. Your Privacy Rights

Depending on your location, you have the following rights regarding your personal information. We will verify your identity before processing any request.

All Users — Rights under PIPEDA and PIPA (BC)

• Right of access: Request a copy of the personal information we hold about you. We will respond within 30 calendar days.
• Right to correction: Request correction of any personal information that is inaccurate, incomplete, or misleading. Where we decline a correction request, we will note your objection in your file.
• Right to withdraw consent: Withdraw consent for any processing activity based on consent, at any time. This will not affect the lawfulness of prior processing but may limit your ability to use certain features.
• Right to complain: Challenge our compliance with PIPEDA or PIPA (BC) by filing a complaint with the applicable Commissioner.

EU / EEA Users — Additional Rights under GDPR

• Right to erasure ("right to be forgotten"): Request deletion of your personal data where there is no compelling legitimate reason to continue processing it.
• Right to restriction: Request that we temporarily restrict processing of your data in certain circumstances (e.g. while accuracy is being verified).
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object: Object to processing based on legitimate interests or to direct marketing at any time. We will cease processing for marketing immediately upon objection.
• Right to human review: Request human review of any automated decision that produces significant effects on you, as described in Section 6.

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. Below is a full description of what we use and why.

EU / EEA users — cookie consent

For users in the EU or EEA, we will display a cookie consent banner before placing any non-essential cookies (analytics, preference, or marketing). Non-essential cookies will not be set until you affirmatively consent. You may withdraw cookie consent at any time by clicking the "Cookie Preferences" link in the footer or by clearing cookies in your browser settings.

Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. We currently honour DNT signals by disabling analytics tracking for sessions where a DNT signal is detected.

14. Children's Privacy

TravelCarePlans is not designed for, directed at, or intended to be used by persons under the age of 18. We do not knowingly collect personal information from individuals under 18.

If you are a parent or legal guardian and you believe your child has provided us with personal information without your consent, please contact us immediately at privacy@travelcareplans.com. We will verify the report and delete the information promptly.

Where a minor travels with a carer or guardian who uses TravelCarePlans to manage the minor's travel health, consent to collection and processing of the minor's health information must be provided by the parent or legal guardian, who assumes responsibility for all authorisations made on the minor's behalf.

15. Cross-Border Data Transfers

As a British Columbia–incorporated company serving users globally, your personal information may be transferred to, stored in, or processed in countries outside your country of residence — including Canada, the United States, and countries where our cloud infrastructure providers operate.

These countries may not have privacy laws equivalent to those in your jurisdiction. We address this through the following mechanisms:

• EU/EEA to Canada: Canada has received an EU adequacy decision in respect of organisations subject to PIPEDA. Transfers from the EU/EEA to HEAL28 Academy Corporation are therefore permitted without additional safeguards for most commercial data. For health data transfers, we supplement this with explicit consent.
• EU/EEA to the United States or other third countries: We use Standard Contractual Clauses (SCCs) as approved by the European Commission (Commission Decision 2021/914) to govern transfers to our US-based service providers.
• Australia: Transfers involving Australian user data comply with APP 8, including ensuring recipients are bound by standards substantially similar to the APPs.
• All transfers: Every recipient of personal data transferred outside Canada is contractually bound to protect the data to standards equivalent to or exceeding this policy.

16. Marketing Communications (CASL)

We will only send you commercial electronic messages — newsletters, product updates, promotional content — if one of the following applies:

• You gave us express consent to receive marketing at the point of sign-up (by ticking a dedicated, un-pre-ticked checkbox), or
• We have an existing business relationship with you giving rise to implied consent under CASL Section 10(1), and you have not yet unsubscribed

Every commercial electronic message we send includes: (a) clear identification of HEAL28 Academy Corporation as the sender; (b) valid contact information; and (c) a functional one-click unsubscribe link. We will process unsubscribe requests within 10 business days, as required by CASL Section 11.

Transactional communications — such as account confirmation, care plan delivery, security alerts, and responses to your direct enquiries — are not commercial electronic messages and are not subject to marketing consent requirements.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make changes:

• We will update the "Last Updated" date at the top of this page
• For material changes to this policy, we will notify you by email at least 14 days before the change takes effect, giving you time to review and, where relevant, withdraw consent
• For significant changes to how we process health data — including new purposes or new categories of sharing — we will request fresh explicit consent before continuing to process your health information under the revised terms

Your continued use of TravelCarePlans after the effective date of any update constitutes your acceptance of the non-material changes. Material changes do not take effect without your affirmative acknowledgement.

18. Contact and Regulatory Complaints

If you are not satisfied with our response to a privacy inquiry or complaint, you have the right to escalate to the relevant regulatory authority: