Privacy Policy

Last updated: June 16, 2026

Draft for review. This policy is a starting template prepared for Walter. It is not legal advice. Because Walter processes personal health information, it must be reviewed and adapted by qualified privacy counsel — including for Québec's Law 25, Canada's PIPEDA, and any applicable U.S. (e.g. HIPAA) requirements — before you rely on it.

This Privacy Policy explains how Walter ("Walter", "we", "us") handles personal information in connection with the Walter home-care operations platform (the "Service"). It covers our marketing website and the application used by home-care agencies, caregivers, and families.

1. Our role

For most information processed in the application, Walter acts as a service provider / processor on behalf of the home-care agency (the "Agency") that controls the data. The Agency decides what information is collected and why, and is responsible for obtaining the necessary consents. For our own website and account administration, Walter acts as the controller. If you are a client, caregiver, or family member, please also contact your Agency about its own privacy practices.

2. Information we process

Category	Examples
Account & contact	Name, email, phone, role, agency, login identifiers
Client / care information (PHI)	Client name, address, care plan, visit notes, medication records, condition flags, photos used as visit proof
Caregiver information	Name, phone, email (optional), credentials, availability, GPS clock-in location at the time of a visit
Usage & device	Log data, device/browser info, and product-analytics events (configured to avoid health identifiers)

3. Why we process it

To provide and operate the Service (scheduling, visit verification, messaging, billing support).
To secure the Service, prevent fraud and abuse, and maintain audit logs of access to health information.
To communicate with you (service messages, invitations, reminders) by email and SMS.
To improve the Service using aggregated or de-identified information.
To meet legal and regulatory obligations.

We process personal information based on your or the Agency's consent, to perform our contract, to meet legal obligations, and for our legitimate interests in operating a secure Service — as permitted under Québec Law 25 and PIPEDA.

4. Data residency

Personal health information held in the application's primary database and file storage is hosted in a Canadian region (Montréal, northamerica-northeast1). Some supporting services (for example, transactional email, SMS delivery, and product analytics) may process limited information outside Canada; where that occurs, we use providers and safeguards intended to protect the information consistent with applicable law. We are working to align all processing with Canadian data-residency expectations.

5. Sharing & service providers

We do not sell personal information. We share information only: (a) within the Agency, with users it authorizes (owners, administrators, the assigned caregiver, and invited family members, each scoped to the information they need); (b) with service providers who process data on our instructions (cloud hosting, email, SMS, error monitoring, analytics); and (c) where required by law or to protect rights and safety.

6. Consent (families & clients)

The family portal and the sharing of a client's information with family members depend on the client's recorded consent. Consent can be withdrawn, and when it is, access through the portal is stopped. Discharging a client also stops the portal from serving that client's information.

7. Retention

We retain personal information for as long as needed to provide the Service and as required by law. Health records are subject to retention periods that may be set by the Agency and applicable regulation (commonly several years). When information is no longer required, it is deleted or de-identified. Agencies can request export or erasure of their data, subject to legal retention obligations.

8. Security

We use technical and organizational measures including encryption in transit, access controls scoped by role and agency, audit logging of health-information access, and the principle of least privilege. No system is perfectly secure; we work continuously to protect the information entrusted to us and will notify affected parties of a privacy incident as required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to withdraw consent, and to be informed about automated processing. Under Québec Law 25 you may also have rights regarding de-indexing and data portability. To exercise rights about information held in the application, contact your Agency; for information Walter controls, contact us below.

10. Cookies & analytics

Our website and app use necessary cookies and may use privacy-protective product analytics to understand and improve usage. Analytics are configured to avoid capturing health identifiers. You can control cookies through your browser settings.

11. Children

The Service is intended for use by agencies and adults. It is not directed to children, although care recipients' information may be processed by the Agency under the appropriate authority and consent.

12. Changes

We may update this Policy. We will post the updated version with a new "Last updated" date and provide additional notice where appropriate.

13. Contact & Privacy Officer

For privacy questions, or to reach the person responsible for the protection of personal information, contact privacy@waltercare.com. General inquiries: hello@waltercare.com.