1. Introduction
Your privacy is important to us. This Privacy Policy explains how ARBS Innovations Inc. (“ARBS,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our website at www.arbsinnovations.com (the “Website”) and our AI-assisted, decision-support analysis services for insurers and third-party administrators (for example, reviewing historical closed claim files to identify potential recovery opportunities) and related products and features (collectively, the “Services”).
This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, the Quebec Act respecting the protection of personal information in the private sector as amended by Law 25 (“Law 25”), together with other applicable Canadian privacy legislation.
ARBS handles personal information in two different roles, which this Privacy Policy keeps distinct. First, for information about visitors to our Website and our business contacts, ARBS acts as the organization accountable for that information. Second, for personal information contained in the claim files that our customers provide so that we can perform the Services, ARBS acts as a service provider that processes that information only on the customer's behalf and instructions. Section 3 explains the difference.
2. Definitions
“Personal Information” means information about an identifiable individual, including name, contact details, online identifiers, and any other information described in this Privacy Policy.
“Sensitive Information” means personal information that warrants a higher level of protection, including health or medical information, financial information, and government identifiers. Claim files may contain Sensitive Information, including injury or medical detail relevant to a claim.
“Customer” means an insurer, third-party administrator, or other organization that engages ARBS to perform the Services.
“Consent” means voluntary agreement to the collection, use, and disclosure of personal information for identified purposes, and may be express or implied as permitted by law.
3. Our role and the scope of this Policy
Information ARBS is accountable for. When you visit our Website, contact us, or deal with us as a business contact, ARBS determines the purposes for which your personal information is handled and is accountable for it under PIPEDA and Law 25. Sections 4 to 13 apply to this information.
Personal information ARBS processes for Customers. The Services involve reviewing a Customer's historical closed claim files, which may contain personal information and health information about claimants, policyholders, at-fault third parties, and others named in the file. The Customer is the organization accountable for that information and decides how it is used; ARBS processes it only on the Customer's documented instructions and only to produce that Customer's report. ARBS does not have a direct relationship with these individuals. Individuals with questions about claim-file information should contact the relevant Customer. ARBS's handling of that information is governed by its data processing agreement with the Customer, summarized in Section 14.
4. Information we collect
4.1 Information you provide
We collect personal information you voluntarily provide, including:
- contact and business information such as name, business email address, telephone number, employer, and role;
- information you provide when you request a demonstration, enter into discussions or agreements, or correspond with us; and
- information you submit through forms on the Website.
4.2 Information collected automatically
When you use the Website, we may automatically collect limited technical information, including device and browser type, IP address and approximate location, pages viewed, and analytics and log data. We use cookies and similar technologies for the operation and security of the Website and to understand usage. Cookies that are strictly necessary for the Website to function are used without consent; for analytics and other non-essential cookies and tracking technologies, we obtain your consent before they are set, and you can manage your preferences through your browser settings.
4.3 Personal information processed on behalf of Customers
As described in Section 3, we process the contents of Customer claim files, which may include personal information and Sensitive Information, solely to perform the Services. For pilots, we ask Customers to provide redacted or de-identified historical data wherever possible.
5. How we use personal information
We use personal information for which we are accountable to:
- respond to inquiries, provide demonstrations, and communicate with you about the Services;
- establish, manage, and administer our business relationship and agreements;
- operate, secure, and improve the Website and our business;
- comply with legal and regulatory obligations; and
- with your consent, send you relevant updates, which you can opt out of at any time.
We process Customer claim-file personal information only on the Customer's instructions to deliver the Services, and not for our own purposes. We do not use that information to train AI models except as described in Section 6 and as expressly agreed in writing with the Customer.
6. Consent
We collect, use, and disclose personal information with consent, except where the law permits or requires otherwise. The form of consent we rely on depends on the sensitivity of the information and the circumstances. Where we collect Sensitive Information for which we are accountable, we obtain express consent. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by contacting our Privacy Officer; withdrawing consent may limit our ability to provide certain Services. For claim-file personal information, the Customer is responsible for the consent or other lawful authority for the collection and for instructing ARBS to process it.
7. Artificial intelligence and no model training
The Services use artificial intelligence to analyze claim files. The analysis uses multi-layered AI reasoning with built-in adversarial review, grounded in the Customer's own file evidence, with human review before any recommendation is finalized. ARBS outputs are decision-support recommendations for human review, and are not final claim, payment, legal, or medical determinations. ARBS does not make decisions about individuals based exclusively on automated processing. ARBS is a software and decision-support vendor, not an adjuster, collection agency, or legal or medical decision-maker, and it conducts no collection activity; the customer's staff make all final decisions. We do not use Customer data, or personal information in claim files, to train generative AI models, and we do not permit our AI model providers to do so, unless expressly agreed in writing.
8. Disclosure and service providers
We do not sell personal information. We may disclose personal information to:
- service providers and sub-processors that perform functions on our behalf, including cloud hosting and infrastructure and AI model and inference providers, under contracts that require them to protect personal information and to use it only for the purposes we specify;
- professional advisors, such as lawyers and accountants, under confidentiality obligations;
- a successor in connection with a corporate transaction, subject to appropriate protections; and
- government, regulatory, or law-enforcement authorities where required or permitted by law.
We maintain a list of the sub-processors used to deliver the Services. The current cloud hosting provider and AI model provider(s) and their regions are identified in our sub-processor schedule.
9. Data residency and cross-border transfers
We process and store personal information in a Canadian cloud region. Keeping data in Canada is a deliberate part of our design and supports our Customers' privacy obligations, including assessments required under Law 25 before personal information is communicated outside Quebec. Where personal information subject to Law 25 would be communicated outside Quebec, including to a Canadian region located outside Quebec, we conduct or support a privacy impact assessment and implement appropriate protections before that communication occurs. If we ever transfer personal information outside Canada, we will do so in accordance with applicable law and will use contractual and other measures to ensure a comparable level of protection. Personal information handled by service providers may be subject to the laws of the jurisdiction in which it is held.
10. Safeguards
We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including access controls and least-privilege access, encryption in transit and at rest, audit logging, and a human-review gate before recommendations are finalized. Further detail is set out in our security and vendor-risk materials, available to Customers on request. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Breach notification. If a breach of security safeguards involving personal information for which we are accountable occurs and creates a real risk of significant harm (or, where Law 25 applies, a risk of serious injury), we will report the breach to the Office of the Privacy Commissioner of Canada and, where applicable, the Commission d'accès à l'information du Québec, notify affected individuals, and maintain records of the breach, in each case as required by applicable law. Our handling of breaches involving Customer claim-file personal information is addressed in our data processing agreement with the relevant Customer.
11. Retention and deletion
We retain personal information only as long as necessary for the purposes for which it was collected and to meet legal and contractual requirements. Customer claim-file personal information is retained only for the engagement window needed to produce and support the report, then deleted, with a default of thirty (30) days after the engagement window, in accordance with the applicable data processing agreement, and we will provide a certificate of deletion on request.
12. Your rights: access, correction, and Law 25 rights
Subject to applicable law, you may request access to, and correction of, the personal information we hold about you for which we are accountable, and you may ask about our handling of your personal information. Where Law 25 applies, you may also have the right to receive certain personal information in a structured technological format (portability), to request that we cease disseminating personal information or de-index it in defined circumstances, and to be informed about decisions based exclusively on automated processing. To exercise these rights, contact our Privacy Officer. We will respond within the time required by law. For claim-file information, please contact the relevant Customer, and we will assist the Customer as required under our agreement.
We take reasonable steps to ensure that the personal information for which we are accountable is as accurate, complete, and up-to-date as necessary for the purposes for which it is used.
13. Privacy Officer
We have designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy law. You can reach our Privacy Officer at:
Yuvaraj Balachandar, Privacy Officer
ARBS Innovations Inc., 5 Bremner Street, Whitby, Ontario L1R 0P7
privacy@arbsinnovations.com
14. How we handle Customer data (summary)
When ARBS processes claim-file personal information for a Customer, it does so as a service provider under a data processing agreement that requires ARBS to: process only on the Customer's documented instructions and for the defined purpose; apply appropriate security; not use the data to train AI models unless expressly agreed in writing; use only approved sub-processors with equivalent obligations; keep the data in a Canadian region; notify the Customer of any breach without undue delay and within 72 hours of becoming aware; assist the Customer with its privacy obligations; and return or delete the data at the end of the engagement. The agreement with the Customer governs in the event of any inconsistency with this Section.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The “Last updated” date shows when it was last revised. Material changes will be brought to your attention as required by law. Your continued use of the Website or Services after an update means you accept the revised Privacy Policy.
16. How to contact us and make a complaint
If you have a question or complaint about how we handle personal information, please contact our Privacy Officer at privacy@arbsinnovations.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where Law 25 applies, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).