Last updated: August 5, 2026

Buoyancy Works Software Corp. (“Buoyancy Works,” “Buoyancy,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how personal information is collected, used, disclosed, stored, and protected when you:

• visit the Buoyancy Works marketing website;

• create or use a Buoyancy platform account;

• use the Buoyancy platform through a community organization, charity, educational institution, or other customer organization;

• communicate with Buoyancy Works; or

• otherwise interact with our services.

This Privacy Policy should be read together with our Terms and Conditions.

1. Our role in handling personal information

Buoyancy Works may handle personal information in two different capacities.

1.1 Information controlled by Buoyancy Works

Buoyancy Works determines how and why certain information is collected and used, including information relating to:

• customer-organization administrators and staff accounts;

• prospective customers and business contacts;

• visitors to the Buoyancy Works marketing website;

• support, security, billing, and operational communications; and

• individuals who communicate directly with Buoyancy Works.

For this information, Buoyancy Works is responsible for responding to privacy requests, subject to applicable law.

1.2 Participant information processed for customer organizations

Community organizations and other customers use the Buoyancy platform to deliver programs and services to their clients, residents, participants, students, or other service users.

For this information:

• the customer organization generally determines why the information is collected, which information is required, how it is used, and how long it must be retained;

• Buoyancy Works processes and safeguards the information on the organization’s behalf as its technology service provider; and

• access, correction, deletion, consent, and other privacy requests should ordinarily be directed to the organization that collected the information.

When we receive a request concerning participant information controlled by a customer organization, we may refer the request to that organization or assist the organization in responding.

 

2. Personal information processed through our services

The information processed through the Buoyancy platform depends on the individual’s relationship with Buoyancy Works, how a customer organization configures the platform, and which programs or services that organization provides.

2.1 Information Buoyancy Works collects directly

Buoyancy Works may collect and control limited personal information needed to operate its business and provide the platform, including information relating to:

• customer-organization administrators, staff members, and other authorized platform users;

• prospective customers and business contacts;

• individuals who contact Buoyancy Works for support or other inquiries; and

• visitors to the Buoyancy Works marketing website.

This information may include:

• name;

• business email address and telephone number;

• organization, job title, and role;

• platform account identifiers;

• authentication and account-security information;

• support requests and communications; and

• billing, contracting, or administrative information.

Buoyancy Works uses this information to administer accounts and customer relationships, authenticate users, provide support, communicate about the services, maintain security, and operate its business.

2.2 Information customer organizations collect through the platform

Customer organizations may use the Buoyancy platform to collect, enter, upload, generate, or maintain personal information about their clients, residents, participants, students, household members, or other service users.

Depending on how the customer organization configures and uses the platform, this information may include:

• name and contact information;

• date of birth and age;

• gender and other demographic information;

• address, community, postal code, and general location;

• preferred language and communication preferences;

• household composition and household-member information;

• citizenship, residency, or newcomer-related information;

• education and employment information;

• income sources, household income, expenses, assets, savings, and other financial information;

• housing, transportation, food-security, and basic-needs information;

• program applications and eligibility information;

• program enrolment, participation, attendance, completion, and graduation information;

• appointments, check-ins, referrals, service interactions, and follow-up actions;

• advocate, coach, or other authorized staff notes;

• participant goals, plans, actions, milestones, and progress;

• financial-assistance requests, approvals, payments, and related records;

• savings-program contributions, matching amounts, purchases, transactions, and ledger information;

• forms and supporting documents; and

• other information submitted or recorded in connection with a program or service.

The customer organization determines which information is collected, why it is collected, how it is used, and the applicable retention requirements. Buoyancy Works processes this information on the customer organization’s behalf to provide, operate, secure, and support the platform.

Buoyancy Works does not use participant information for independent advertising, data brokerage, sale, or other purposes unrelated to providing the services, except where required or permitted by law.

2.3 Assessment, survey, and wellbeing information

Where enabled by a customer organization, the platform may be used to collect responses relating to matters such as:

• wellbeing;

• mood and motivation;

• confidence and self-efficacy;

• work readiness;

• employment or vocational interests;

• personality or temperament;

• social support;

• financial wellbeing;

• housing or economic stability; and

• progress toward participant-defined goals.

These tools may be used to support service delivery, reflection, coaching, program evaluation, or outcome measurement.

Unless expressly stated otherwise by the customer organization delivering the service, these tools are not intended to provide a medical, psychological, or other clinical diagnosis.

The customer organization determines which assessments or surveys are used and the purposes for which the resulting information is collected. Buoyancy Works processes the resulting information on the customer organization’s behalf.

2.4 Platform usage, website, and technical information

When an authorized user interacts with the platform, or when someone visits the Buoyancy Works website, Buoyancy Works may automatically generate or receive technical and usage information, including:

• IP address;

• browser, operating system, and device type;

• authentication and session events;

• dates and times of access;

• pages, records, or platform functions accessed;

• actions taken within the platform;

• referring page;

• error and diagnostic information;

• security events; and

• system-performance information.

Buoyancy Works uses this information to:

• authenticate users;

• operate and secure the platform;

• investigate errors, suspected misuse, or security incidents;

• maintain auditability;

• monitor system performance;

• provide technical support;

• understand how the platform is used; and

• improve the reliability and usability of the services.

Where appropriate, Buoyancy Works may use aggregated or de-identified information for service analysis, research, reporting, and product improvement.

Buoyancy Works does not sell personal information.

 

3. How information is collected

Personal information may be collected:

• directly from an individual;

• through account-registration, intake, assessment, survey, and program forms;

• through interactions with an advocate, coach, administrator, or other authorized staff member;

• through service notes, referrals, attendance records, actions, and follow-up activities;

• through documents or information submitted by an individual;

• from a customer organization that is authorized to provide the information;

• through correspondence with us; and

• automatically through server logs, authentication systems, and essential platform technologies.

A customer organization may also obtain information from another organization or public body where the individual has consented or where otherwise permitted by law. The customer organization is responsible for ensuring it has the authority to collect and provide that information.

 

4. How personal information is used

Depending on the relationship and context, personal information may be used to:

• create and administer accounts;

• authenticate users and manage permissions;

• deliver programs, services, coaching, navigation, referrals, and other supports;

• maintain participant and household records;

• enable authorized staff to understand prior interactions and continue providing support;

• record program enrolment, participation, attendance, progress, and completion;

• manage appointments, follow-up actions, referrals, pickups, and other workflows;

• administer financial-assistance and matched-savings programs;

• support outcome measurement and program evaluation;

• create aggregate or de-identified reports for customer organizations and their funders;

• operate, secure, support, test, and improve the platform;

• investigate errors, misuse, security events, and suspected fraud;

• communicate service, account, support, privacy, or security information;

• meet contractual, legal, regulatory, funder, audit, or reporting obligations; and

• carry out other purposes identified by the customer organization and communicated at or before collection.

Buoyancy Works does not sell personal information.

 

5. Artificial intelligence features

5.1 Features that use artificial intelligence

Certain optional platform features use generative artificial intelligence to assist authorized staff. These features may include:

• preparing a draft summary of participant interactions or notes;

• extracting potential actions, topics, or structured information from notes;

• helping authorized staff locate or organize relevant information; and

• producing other draft content intended to support staff workflows.

These features use Anthropic Claude models made available through Amazon Web Services’ Amazon Bedrock service.

5.2 Information provided to AI services

When an authorized user activates an AI-assisted feature, relevant portions of the information being worked on may be sent to Amazon Bedrock for processing. Depending on the feature, this may include interaction notes, form responses, participant circumstances, goals, actions, or other content entered into the platform.

We configure AI features to limit the information submitted to what is reasonably necessary for the requested task.

5.3 Model training

According to Amazon Web Services, customer prompts and model responses submitted through Amazon Bedrock are not used to train the underlying foundation models.

Buoyancy Works does not intentionally use customer participant information to train publicly available artificial-intelligence models.

5.4 Human review

AI-generated content is assistive and may be incomplete, inaccurate, or inappropriate for the circumstances.

AI-generated summaries, extracted information, and suggested actions are drafts. Authorized staff are expected to review, correct, approve, or reject the output before relying on it or adding it to an official participant record.

AI output is not intended to replace professional judgment or determine eligibility, access to services, financial assistance, or other consequential decisions without human review.

5.5 Location of AI processing

The primary Buoyancy platform database is hosted in Canada. However, depending on the Amazon Bedrock model and inference configuration used, information submitted to an AI-assisted feature may be temporarily processed by AWS infrastructure located outside Canada, including in the United States or other jurisdictions.

Information processed outside Canada may be subject to the laws of the jurisdiction in which it is processed, including lawful access requirements.

Buoyancy Works limits cross-border AI processing to the information needed to perform the selected AI task and uses AWS contractual, technical, access-control, and security protections.

Customer organizations should ensure that their use of AI-assisted features is consistent with their privacy obligations, agreements, funder requirements, and notices to participants.

 

6. Legal authority and consent

Buoyancy Works and its customer organizations collect, use, and disclose personal information only as permitted by applicable law.

Depending on the circumstances, the authority for processing may include:

• an individual’s meaningful consent;

• performance of a service requested by the individual;

• a contract with a customer organization;

• compliance with a legal, regulatory, audit, or funder obligation; or

• another authority recognized under applicable privacy law.

Individuals may withdraw consent, subject to reasonable notice and any legal, contractual, program, funder, or service restrictions. Withdrawing consent may affect the ability of an organization to provide some services or maintain an account.

 

7. Disclosure and sharing

Personal information may be disclosed:

7.1 Within a customer organization

Authorized advocates, coaches, administrators, program staff, managers, reviewers, or other personnel may access information where required for their roles.

Access is governed through account permissions and role-based access controls established by the customer organization and the platform.

7.2 To service providers

We use service providers to host, operate, secure, communicate through, and support the platform. These include:

• Amazon Web Services for application hosting, databases, storage, monitoring, email delivery, backups, security services, and related infrastructure; and

• Anthropic Claude models accessed through Amazon Bedrock for enabled AI-assisted features.

Service providers may process information only for the services they provide and are subject to contractual and technical safeguards.

Google services may be used in connection with the public Buoyancy Works marketing website. Google is not integrated into the Buoyancy service-delivery platform for participant-record processing.

7.3 To funders and reporting bodies

Customer organizations may use the platform to produce reports required by funders, governments, collaborative partners, or evaluators.

Where practical and consistent with the reporting requirement, these reports should use aggregated or de-identified information. Identifiable information may be disclosed where the organization has obtained consent or is otherwise authorized or required to do so.

7.4 For legal and security purposes

Information may also be disclosed where reasonably necessary to:

• comply with a subpoena, court order, warrant, or legal requirement;

• investigate fraud, misuse, or a security incident;

• protect the rights, safety, and security of individuals, customer organizations, Buoyancy Works, or the public;

• enforce agreements; or

• complete a corporate transaction, subject to appropriate confidentiality and legal safeguards.

8. Hosting and data location

8.1 Core platform

The Buoyancy platform application and its Amazon Aurora PostgreSQL database are hosted using Amazon Web Services in the Canada West Region, located in Calgary, Alberta (ca-west-1).

Transactional platform email is sent using Amazon Simple Email Service in the Canada Central Region, located in Montréal, Quebec (ca-central-1).

The platform’s primary operational records and database information are therefore stored in Canada, subject to:

• the cross-border AI-processing disclosure in Section 5;

• information contained in email messages sent to recipients or their email providers;

• technical routing and security services that may operate globally;

• authorized customer exports or integrations; and

• legal or operational exceptions described in this Privacy Policy.

We do not represent that every transient network packet, email copy, security signal, or AI-processing operation remains exclusively within Canada.

8.2 Marketing website

The public Buoyancy Works marketing website may use website-hosting, analytics, embedded-content, or related providers that process technical information outside Canada.

The marketing website is separate from the Buoyancy service-delivery platform. Participant service records are not intentionally disclosed to marketing analytics providers.

 

9. Cookies, authentication, and server logs

9.1 Platform authentication

The Buoyancy platform uses token-based authentication and essential session technologies to:

• sign users in;

• maintain secure sessions;

• apply account permissions;

• prevent unauthorized access; and

• protect the platform.

These technologies are necessary for the platform to function. The platform does not use third-party advertising cookies to track participants for behavioural advertising.

9.2 Marketing website cookies

The public marketing website may use cookies or similar technologies for essential functionality, preferences, aggregated analytics, or embedded content.

Where required, visitors will be provided with an appropriate cookie notice or consent mechanism.

9.3 Server logs

IP addresses, device information, timestamps, pages or functions accessed, authentication events, and error information may be recorded in standard server, security, and application logs.

These logs are used to:

• operate and troubleshoot the services;

• detect and investigate security threats;

• prevent misuse;

• understand aggregate service performance; and

• maintain auditability.

•  

10. Security safeguards

Buoyancy Works uses administrative, technical, and organizational safeguards appropriate to the sensitivity of the information handled by the platform.

Safeguards include, as applicable:

• TLS encryption for data transmitted between users and the platform;

• encryption at rest for the Amazon Aurora database, backups, and snapshots;

• application-level encryption for designated sensitive fields;

• role-based access controls;

• organization and tenant access controls;

• scoped AWS Identity and Access Management permissions;

• virtual-private-cloud network isolation;

• authentication and account-security controls;

• automated backups;

• system, application, and security logging;

• Amazon CloudWatch monitoring and alerting;

• secure development and change-management practices; and

• confidentiality and access obligations for personnel and service providers.

Customer organizations are responsible for administering their users, assigning appropriate roles, protecting account credentials, reviewing staff access, and using exports and downloaded information securely.

No Internet-based system can be guaranteed to be completely secure. We continually assess our safeguards and update them as the platform and relevant risks evolve.

 

11. Retention and disposal

Personal information is not subject to a universal one-year retention period.

11.1 Participant information

Participant information is generally retained:

• for the duration of the customer organization’s use of the platform;

• for as long as needed to deliver the applicable program or service;

• for periods required by the customer organization’s funders, contracts, policies, audit requirements, or legal obligations; and

• for a reasonable period needed to support transition, export, dispute resolution, security, or termination of service.

Customer organizations determine the applicable retention requirements for participant information.

At the end of the applicable retention period, information will be securely deleted, destroyed, returned, or anonymized in accordance with contractual requirements, documented instructions, backup-management processes, and applicable law.

11.2 Buoyancy-controlled information

Information controlled directly by Buoyancy Works is retained only as long as reasonably necessary for the purposes described in this Privacy Policy and to satisfy legal, security, accounting, contractual, and operational requirements.

11.3 Backups and de-identified information

Deleted information may remain temporarily in protected backups until those backups are overwritten or expire under the applicable backup schedule.

Aggregated or de-identified information that cannot reasonably be associated with an identifiable individual may be retained for research, analysis, benchmarking, service improvement, and reporting.

 

12. Individual privacy rights

Subject to applicable law, an individual may request:

• confirmation of whether personal information is held;

• access to personal information;

• correction of inaccurate or incomplete information;

• information about how personal information has been used or disclosed;

• withdrawal of consent;

• deletion or removal of information where legally and operationally appropriate;

• closure or deactivation of an account; or

• review of a privacy-related decision.

Some rights are subject to legal exceptions, identity verification, the rights of other individuals, funder or record-retention requirements, and the customer organization’s continuing legal obligations.

12.1 Requests concerning participant records

Requests concerning information collected by a community organization or other Buoyancy customer should first be directed to that organization.

The organization is generally best positioned to verify identity, understand the service context, identify applicable retention obligations, and decide how to respond.

Buoyancy Works will assist customer organizations with valid requests as required by our agreements and applicable law.

12.2 Requests concerning Buoyancy accounts or website information

Requests concerning information controlled directly by Buoyancy Works may be sent to:

Email: data_control@buoyancy.works

Please include sufficient information to identify the relevant account or interaction and describe the request. We may request additional information to verify identity before providing access or making changes.

We will respond within the period required by applicable law. Under PIPEDA, this is generally no later than 30 days, subject to permitted extensions.

 

13. Children and dependent household members

The platform may contain information about children or other dependants when a customer organization requires that information to deliver a program, assess household eligibility, provide family services, or meet reporting requirements.

The customer organization is responsible for determining the appropriate authority, consent, and notices required to collect and use this information.

Buoyancy Works does not knowingly collect children’s personal information directly through the public marketing website for advertising or marketing purposes.

 

14. Privacy incidents

Buoyancy Works maintains processes for identifying, assessing, containing, investigating, and responding to suspected privacy and security incidents.

Where required by applicable law or contract, Buoyancy Works will notify affected customer organizations and cooperate with them in determining whether notice must be provided to individuals, regulators, funders, or other parties.

Where Buoyancy Works directly controls the affected information, we will provide any required notices and maintain records required by law.

 

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the platform;

• new or revised service providers;

• changes to AI features;

• changes to hosting or processing locations;

• legal or regulatory developments; or

• changes to our privacy and security practices.

The current version will be posted on the Buoyancy Works website with its effective date.

Where a change is material, we may also provide notice through the platform, by email, through customer organizations, or by another appropriate method.

 

16. Applicable law and complaints

Buoyancy Works is committed to complying with applicable Canadian privacy law, including:

• the Personal Information Protection and Electronic Documents Act, where applicable; and

• Alberta’s Personal Information Protection Act, where applicable.

An individual who has a concern should first contact Buoyancy Works or the customer organization responsible for the information so that the concern can be investigated.

Questions or complaints concerning Buoyancy Works may be sent to:

Buoyancy Works Software Corp.
Email: data_control@buoyancy.works
Availability: 9:00 a.m. to 5:00 p.m. Mountain Time, Monday through Friday, excluding Canadian statutory holidays.

Individuals may also have the right to complain to:

• the Office of the Privacy Commissioner of Canada;

• the Office of the Information and Privacy Commissioner of Alberta; or

• another provincial or territorial privacy regulator with jurisdiction.

Contacting a privacy regulator does not prevent an individual from first asking Buoyancy Works or the applicable customer organization to resolve the concern.