Data Protection & Consent Policy

How Bridgit protects personal information, manages consent, supports individuals' rights and records its processing activities. Aligned with PIPEDA and, where it applies, the GDPR; informed by ISO/IEC 27001 controls (Bridgit is not certified).

Document control

1. Purpose

This policy sets out how Core Innovation Corp. (operating as Bridgit, askbridgit.ai) ("Bridgit", "we") protects personal information processed through the Bridgit platform. Its objectives are to:

• process personal information lawfully, fairly and transparently;
• protect the rights of the individuals whose information we hold;
• set clear procedures for consent and for individuals' requests;
• build privacy into the platform's design and defaults; and
• keep a record of our processing activities (section 12).

2. Scope

This policy applies to all personal information Bridgit processes through the platform: about users, organization members, and people named in content users create. It applies to Bridgit personnel and contractors, and to the subprocessors listed in section 9.

It covers the web application, the API, the database (Google Cloud SQL), file storage (Google Cloud Storage), logs and backups, and the third-party services listed in section 9.

What Bridgit is, and is not. Bridgit is a business research and innovation workflow platform with optional AI drafting. It is not a medical device, an electronic health record or a clinical decision-support tool.

No personal health information. Bridgit is not designed to hold personal health information. Do not enter personal health information (as defined under Ontario's PHIPA or other applicable law) or patient identifiers anywhere in Bridgit, including AI features, unless your organization has a written agreement with Bridgit that expressly permits it. Bridgit does not have a technical filter that detects or blocks such information.

3. Data protection principles

3.1 Lawfulness, fairness and transparency

We process personal information only for the purposes described in our Privacy Policy and in section 12, and only on a lawful basis (section 4). We explain our processing in plain language in the Privacy Policy (https://askbridgit.ai/api/v1/legal/privacy-policy), this policy and the Data Retention Policy, and in descriptions within forms.

3.2 Purpose limitation

We collect personal information for specified purposes and do not use it for unrelated purposes. If we want to use personal information for a new purpose that is not compatible with the original one, we will tell affected individuals and, where required, ask for consent before doing so.

3.3 Data minimization

We collect only what the platform needs. A user account needs an email address and password (or Google sign-in); profile details are entered by the user. Form templates mark required and optional fields; optional fields are not pre-filled.

3.4 Accuracy

Users can update their own profile and the records they have access to at any time. Form templates define field types, required fields and allowed values, which are enforced in the user interface, and the API validates and sanitizes input. Organization administrators can correct or remove content and members in their organization.

3.5 Storage limitation

Personal information is kept only as long as needed. Retention periods, deletion and legal holds are set out in the Data Retention Policy (https://askbridgit.ai/api/v1/legal/policies/data-retention-policy), and are applied by the platform's retention job. Retention periods are configured in the platform; automated enforcement is not yet in place, and expired records are deleted or anonymized (audit logs: flagged for review) when the retention job is run. The job checks for legal holds before acting and records what it does.

3.6 Integrity and confidentiality (security)

Technical measures:

• Encryption in transit (TLS). A minimum of TLS 1.2 is enforced.
• Encryption at rest by Google Cloud (AES-256, Google-managed keys), including the database, files and backups
• Additional application-level encryption (AES-256-GCM) for stored third-party sign-in and integration tokens (OAuth tokens and saved website sessions)
• Passwords stored as bcrypt hashes. When a password is changed or reset, it must be at least 8 characters with upper- and lower-case letters, a number and a symbol, and must pass a strength check, including at self sign-up
• Progressive account lockout after failed sign-in attempts (5 failures: 30 minutes; 10: 2 hours; 15: 24 hours)
• Multi-factor authentication (authenticator app, with backup codes) available to all users
• Sign-in tokens expire after 7 days (access and refresh tokens); signing out does not currently revoke them on the server
• Security headers and cross-origin controls on the API

Organizational measures:

• Role-based, membership-based access control (section 8)
• Audit logging of data changes, personal-data exports, permission and role changes, security events (including account lockouts, sign-ins, sign-outs and failed sign-ins, MFA changes and consent changes) and privileged access (section 8)
• Organization administrators can block Bridgit staff access to their organization's data (section 8)

Security incidents are handled under our Incident Response Policy. If an incident involves a customer's data, we notify the customer's designated contact without undue delay, and at the first reasonable opportunity after we confirm it.

4. Lawful bases for processing

Canada (PIPEDA). We rely on the knowledge and consent of the individual, given when they sign up and accept the Privacy Policy, and on implied consent for processing that is necessary to provide the service they asked for. We rely on legal requirements where the law requires us to keep or disclose information.

GDPR (where it applies):

• Contract (Art. 6(1)(b)): providing the platform: accounts, forms, storage, exports, billing.
• Consent (Art. 6(1)(a)): marketing communications, and any optional processing we ask consent for.
• Legal obligation (Art. 6(1)(c)): tax and billing records, responding to lawful requests.
• Legitimate interests (Art. 6(1)(f)): platform security (audit logs, lockout, fraud prevention) and service improvement.

AI features. AI features run only when a user chooses to use them (for example, by pressing an AI button or asking the in-app assistant), or when an organization has configured a form to use AI. The data sent and the providers used are described in section 9. AI features are assistive; users are responsible for reviewing AI outputs. Bridgit does not make automated decisions that have legal or similarly significant effects on individuals.

5. Consent management

5.1 Obtaining consent

Consent is given by an affirmative action. At email sign-up the individual must tick an unticked Privacy Policy checkbox, and the acceptance is then recorded. Accounts created with Google sign-in do not yet record this acceptance (being fixed). Silence, inactivity or pre-ticked boxes do not count as consent.

The platform can record four kinds of consent: privacy (Privacy Policy), terms (Terms of Service), ai_processing (AI processing) and marketing (marketing communications). Today only privacy consent is requested, at sign-up; the other types are supported by the platform but not currently requested.

5.2 Recording consent

Each consent record holds:

• the user's account identifier;
• the type of consent;
• the date and time it was given;
• a link to the version of the policy that was accepted;
• the date and time it was withdrawn, if it was; and
• the IP address and browser at the time of consent.

Consent records are stored in the platform database in Montréal, encrypted at rest. Users can view their own consent records. Consent records are kept while the account exists, for up to 7 years; after 7 years, the IP address and browser are anonymized when the retention job is run. They are deleted when the account is deleted.

5.3 Withdrawing consent

You can withdraw consent at any time by emailing the Privacy Officer at info@askbridgit.ai; in-app withdrawal is planned. Withdrawal is recorded with the date and time, and the processing that relied on that consent stops. Withdrawal does not affect processing that took place before it. Where we can continue some processing on another lawful basis (for example, to provide the service under your contract), we will tell you.

Withdrawing consent to the Privacy Policy or Terms of Service means we can no longer provide the service, and we will explain how to close your account.

5.4 Health information and minors

Health information must not be entered in Bridgit (section 2), so we do not seek consent to process it. Bridgit is not directed at minors. If that changes, parental or guardian consent procedures will be put in place before any minor's information is processed.

6. Data classification

AI features. When a user starts an AI feature, the request can include Confidential data: the request text, the relevant form content, attached or reference documents, and the user's name and role (Privacy Policy, section 5). That data is processed by the AI providers in the United States. Restricted data is not included in AI requests. Customers apply their own data classification to the content they enter: if a customer's rules do not allow a category of its information (for example, confidential corporate information) to be processed outside Canada or by an AI provider, its users must not put that information into AI features.

Personal health information and patient identifiers are not permitted in Bridgit at any level (section 2).

7. Individuals' rights

Requests can be made to the Privacy Officer at info@askbridgit.ai. We verify identity by confirming ownership of the registered email address, and may ask for other details if needed. We respond within 30 days of a verified request, extendable by up to 30 more days with written notice. Requests are free, unless they are manifestly unfounded or excessive.

7.1 Access (PIPEDA Principle 4.9; GDPR Art. 15)

You can download a copy of your personal data at any time in Settings → Data Management → Download My Data (JSON format). It includes your account details, consent records and your own audit trail. On request, we also tell you the purposes of processing, the recipients, retention periods and the source of your data.

7.2 Correction (PIPEDA Principle 4.6; GDPR Art. 16)

You can correct your profile and records directly in the platform, or ask the Privacy Officer or your organization administrator. Changes to records are recorded in the audit log.

7.3 Deletion (GDPR Art. 17)

You can request account deletion in Settings → Account, by email to the Privacy Officer, or through your organization administrator: your organization administrator can ask the Privacy Officer (info@askbridgit.ai) to delete your account on your behalf. Deletion follows a 30-day grace period, during which you can cancel. A weekly deletion job, run on Sundays, deletes accounts whose grace period has ended, so deletion happens within 7 days after the grace period ends. What is deleted, anonymized or kept is set out in section 4 of the Data Retention Policy. In summary: your account, sessions, consent records, memberships and permissions are deleted; AI usage and billing records are kept without your identity; content you created in an organization's workspace stays with that organization; audit log entries are kept for their retention period. Your user profile details are currently kept, unlinked from any account; you can clear them before requesting deletion, or ask the Privacy Officer to remove them. Exceptions (legal holds, legal obligations, legal claims) are described in the Data Retention Policy.

7.4 Restriction (GDPR Art. 18)

You can ask us to restrict processing while the accuracy of your data is contested, if processing is unlawful but you do not want deletion, or while an objection is considered. The Privacy Officer handles restriction requests case by case.

7.5 Portability (GDPR Art. 20)

The personal data export in section 7.1 is structured and machine-readable (JSON). Organizations can request an export of their organization's audit logs as a CSV file.

7.6 Objection (GDPR Art. 21)

You can object to processing based on legitimate interests by contacting the Privacy Officer. We will stop unless we have compelling legitimate grounds, or the processing is needed for legal claims. You can object to marketing at any time, and we will stop.

7.7 Organization data

Where Bridgit processes personal information on behalf of a customer organization (for example, a hospital), that organization controls the data in its workspace. Individuals should send requests about that data to the organization first; Bridgit will help the organization respond.

8. Privacy by design and by default

Built into the platform:

• Access is membership-based and default-deny. Users see only the organizations, projects and records they are members of. There are three membership roles (admin, member and lead), which can be granted at organization, project, innovation or activity level; a "project administrator" or similar is an admin-role membership at that scope, not a separate role; memberships can be given an expiry date. Platform roles separate regular users from Bridgit system administrators.
• Bridgit staff access is controllable. Bridgit system administrators can technically access customer data for support and operations. An organization administrator can switch on "Require explicit access", which blocks that access at the organization level unless an administrator is explicitly granted access; extending the block to every access path is being verified. Emergency (break-glass) access is time-limited to 7 days, recorded in the audit log, and emailed to the organization's administrators.
• Audit logging. The audit log records data changes (create, update, delete, bulk, import), personal-data exports, permission, role and membership changes, account lockouts and unlocks, successful sign-ins, each failed sign-in and sign-outs, MFA verification and removal, consent given or withdrawn, deletion requests, ownership transfers and billing changes, and privileged access. Spreadsheet exports of submissions and file downloads are not yet recorded. Each entry records the user, action, record, the change made (with secrets removed), IP address, browser and time. Record views are not yet recorded.
• Encryption and secrets as described in section 3.6.

Defaults:

• Data is visible only to members of the organization that owns it; sharing between organizations is off unless set up.
• Optional fields are not pre-filled.
• Sign-in tokens expire after 7 days (access and refresh tokens). Signing out does not currently revoke them on the server; they remain valid until they expire. A fix is planned.
• Multi-factor authentication is optional for all users. A setting exists to make it mandatory for Bridgit platform administrators; it is not currently switched on. Organization-level MFA enforcement is not available.
• Progressive account lockout after failed sign-in attempts.

9. Where data is stored and transfers outside Canada

9.1 Storage

Production data (database, application, uploaded files and logs) is stored in Google Cloud's Montréal region (northamerica-northeast1), Canada. Other regions are not currently offered. Automated database backups are stored in the Montréal region.

9.2 Transfers

All transfers are encrypted in transit. Personal information is transferred outside Canada when users use AI features or searches, and for email, sign-in and billing:

Bridgit does not currently hold signed data processing agreements with these subprocessors. Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default). Information transferred outside Canada is subject to the laws of the country where it is processed, and may be accessible to that country's courts and authorities.

We give customers at least 30 days' notice before adding a subprocessor that processes customer content. The current list is maintained in our Vendor Management Policy (https://askbridgit.ai/api/v1/legal/policies/vendor-management-policy).

Other AI providers. Anthropic (Claude) and OpenAI are the AI providers configured in production and used routinely. The platform also supports Google (Gemini), Cohere, Mistral, Perplexity, DeepSeek and Microsoft Azure OpenAI; these are available but are not currently enabled in production. Enabling one, platform-wide or for an organization that selects it, would add a sub-processor that processes the request content (in the United States, or the location stated in the notice) under that provider's commercial / API terms, and we would give customers at least 30 days' notice first.

9.3 Exports

Data leaves the platform only through authenticated exports, limited by the user's role. Personal-data exports are recorded in the audit log; spreadsheet exports of submissions and file downloads are not yet recorded.

10. Transparency and privacy notices

Our Privacy Policy tells individuals who we are and how to contact us; what we collect and why; the lawful basis; who receives it, including subprocessors outside Canada; how long we keep it; their rights, including withdrawing consent; and how to complain. Notices are written in plain language and are available on our website, from links in the platform, and at sign-up.

11. Data quality

Data quality is supported by field types, required fields and allowed values defined in form templates, input validation and sanitization in the API, self-service correction by users, and correction by organization administrators. Data past its retention period is removed under the Data Retention Policy when the retention job is run.

12. Record of processing activities

This section is Bridgit's record of processing activities (GDPR Art. 30). The controller is Core Innovation Corp. (operating as Bridgit, askbridgit.ai), Ottawa, Ontario, Canada; contact: Privacy Officer, info@askbridgit.ai. Security measures for all activities are described in sections 3.6 and 8. Retention follows the Data Retention Policy.

This record is reviewed with this policy, and updated when a new processing activity, subprocessor or retention period is introduced.

13. Roles and responsibilities

14. Review, reporting and enforcement

This policy is reviewed at least annually, and when processing activities, subprocessors, the law or the platform's architecture change significantly. We notified users of this version by email and with a notice in the platform when it was published. We give notice of future material changes by email to active users and a notice in the platform, at least 30 days before they take effect.

Suspected breaches of this policy or security issues can be reported through the Report a Problem form (from the help page or the page footer), or to info@askbridgit.ai (which reaches the Privacy Officer). Users who breach this policy or the Terms of Service may lose access to the platform.

Complaints. Contact the Privacy Officer first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca, 1-800-282-1376). Ontario health-sector customers: where Bridgit handles personal information on behalf of an Ontario health information custodian, questions should first go to that organization, and complaints may be made to the Information and Privacy Commissioner of Ontario (https://www.ipc.on.ca, 1-800-387-0073). EU residents can contact their national data protection authority.

15. Related policies and references

Contact: info@askbridgit.ai