Data processing agreement
The short version: your agency owns its clients' information, Willa keeps it in Canada, uses it only to run your inquiries and follow-up, and deletes it when you ask.
1. Roles
Your agency controls the personal information of the families and clients who contact it. Willa processes that information only on your agency's behalf and on your documented instructions, as your service provider.
2. Purpose
Willa uses personal information only to answer and qualify inquiries, book assessments, follow up with families who contacted your agency, and report results to you. We do not sell it, share it between agencies, or use it to train public AI models.
3. Canadian data residency
Your agency's records are stored in Canada, in a Montréal data centre, separate from our US deployment. Where a subprocessor handles information outside Canada, such as call audio for voice AI, it is listed on our subprocessors page with its location.
4. Safeguards
We protect information with encryption in transit and at rest, per-agency isolation, role-based access, append-only access logging and retention controls, in a way aligned with PIPEDA and the provincial health privacy laws that apply to your agency, including PHIPA (Ontario), HIA (Alberta) and PIPA (British Columbia and Alberta).
5. Subprocessors
We engage subprocessors only under written terms at least as protective as this agreement, and we publish the current list. We will give notice before adding a subprocessor that handles client information.
6. Breaches
We will notify your agency without undue delay after discovering a breach of security safeguards involving your information, and give you the details you need to meet your own reporting duties to the Privacy Commissioner and affected individuals.
7. Individual requests
We help your agency respond to requests from individuals to access or correct their personal information, and to withdraw consent.
8. Return and deletion
When your agency closes its account, we delete or return its information on your instruction, subject to any retention the law requires.
Related: Security and privacy · Subprocessors · Privacy policy. Questions: privacy@heywilla.ai