Privacy Policy

Effective Date: October 16, 2026
Last Reviewed: October 16, 2026
Next Review Date: October 16, 2027
Version: 1.1

1. Introduction

Bridgit ("we," "us," or "our") provides a cloud-based research and innovation workflow service with optional AI drafting features (the "Service"). This Privacy Policy describes how we collect, use, disclose and safeguard personal information when you use the Service and our website, https://askbridgit.ai.

Bridgit is not a medical device, electronic health record or clinical decision support tool, and it is not designed to hold personal health information (see section 5).

Compliance framework: We handle personal information in accordance with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws;
• the General Data Protection Regulation (GDPR), for users in the European Economic Area;
• applicable data protection laws in other jurisdictions where we operate.

Our security and privacy practices are aligned with the principles of ISO 27001 and the SOC 2 Trust Services Criteria. Bridgit is not certified under ISO 27001, SOC 2, HIPAA or any other certification scheme.

Our role:

• Organizational customers. When an organization (for example, a hospital, university or company) subscribes to Bridgit for its users, that organization decides why and how personal information in its workspace is processed. Bridgit acts as a processor (service provider). We process that information on the organization's behalf and according to its instructions and our agreement with it.
• Ontario health-sector customers. Where a customer is a health information custodian under Ontario's Personal Health Information Protection Act, 2004 (PHIPA), Bridgit acts on the custodian's behalf and under its instructions. Bridgit does not use the custodian's information for its own purposes.
• Bridgit's own records. Bridgit is responsible for the account, billing and security records we need to run the Service, and for information from individuals who sign up directly.

Questions about how your organization uses Bridgit should first go to your organization. Questions about this policy should go to our Privacy Officer (section 2).

2. Who We Are and How to Contact Us

Organization: Core Innovation Corp. (operating as Bridgit, askbridgit.ai)
Ottawa, Ontario, Canada
Website: https://askbridgit.ai

Privacy Officer: Matthew Bromwich, CEO and Privacy Officer
Email: info@askbridgit.ai

Security reports: info@askbridgit.ai

For questions about this Privacy Policy, or to exercise your privacy rights, contact our Privacy Officer at info@askbridgit.ai.

3. Personal Information We Collect

We collect the following categories of personal information:

Legal basis for processing (GDPR): We process personal information mainly because it is necessary to perform our contract with you or with your organization (providing the Service). We rely on our legitimate interests to keep the Service secure (audit logs, account lockout, fraud prevention), on legal obligation to keep tax and billing records, and on consent for any optional processing we ask consent for.

PIPEDA: For Canadian users, we collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we limit collection to what we need for those purposes.

4. How We Use Your Personal Information

We use personal information to:

• Provide the Service: operate, maintain and support the Service and its features, including AI features you choose to use;
• Manage accounts: create and manage your account and your access to your organization's workspaces;
• Communicate: respond to inquiries, provide support and send service-related notices;
• Process transactions: manage subscriptions and billing through our payment processor;
• Protect the Service: detect, prevent and investigate security incidents, fraud and misuse, and keep audit records;
• Improve the Service: improve the Service using aggregated usage metrics. We do not use customer content for product development beyond aggregated usage metrics;
• Comply with the law: meet legal obligations and enforce our Terms of Service.

Where the law requires it, we will obtain your consent before using your personal information for a new purpose.

5. AI Features and Automated Processing

Where AI processing happens

When you use an AI feature, we send the following to our AI providers:

• the text of your request;
• the relevant form content;
• any document you attach;
• your name and role.

Our AI providers are Anthropic (Claude) and OpenAI. OpenAI is used for document search indexing and as a fallback model. Both process this information in the United States. Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default).

Optional web and literature searches send only the search query text (which may be taken from your request) to Tavily and to the U.S. National Library of Medicine (PubMed). Both are also in the United States. AI features can also look up public research and data services (OpenAlex, CanLII, CourtListener, openFDA, FRED, Alpha Vantage, SEC EDGAR and YouTube), which receive only AI-generated search query text, in the United States or Canada. If you connect your own Google Workspace account (Drive, Gmail, Calendar or Sheets), AI features can use the content you make available from it.

Other AI providers. Anthropic (Claude) and OpenAI are the AI providers configured in production and used routinely. The platform also supports Google (Gemini), Cohere, Mistral, Perplexity, DeepSeek and Microsoft Azure OpenAI; these are available but are not currently enabled in production. Enabling one, platform-wide or for an organization that selects it, would add a sub-processor that processes the request content (in the United States, or the location stated in the notice) under that provider's commercial / API terms, and we would give customers at least 30 days' notice first.

AI model training

Bridgit does not use your content to train AI models. Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default).

AI records we keep

For each AI request, Bridgit records metadata (time, user, organization, AI provider and model, token counts, cost, IP address and browser; not the text of prompts or responses) for billing, security and troubleshooting. This metadata is retained as described in section 7. The AI assistant's conversation history is saved to your account so you can continue it across devices. It is kept until you clear it, which you can do at any time. AI-generated text that you apply to a form is stored as part of that form.

Health information rule

Bridgit is not designed to hold personal health information. Do not enter personal health information (as defined under Ontario's PHIPA or other applicable law) or patient identifiers anywhere in Bridgit, including AI features, unless your organization has a written agreement with Bridgit that expressly permits it. More generally, avoid submitting sensitive personal data to AI features. We recommend:

• anonymizing data before using AI features;
• reviewing outputs before relying on them;
• understanding that AI features are assistive tools, not decision-makers.

No automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for individuals. AI features are assistive, and users are responsible for reviewing AI-generated content before relying on it or using it in decisions.

GDPR Article 22: You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you. The Service does not make such decisions.

How AI output is shown

AI drafting starts from a control labelled "Generate with AI" by default (a form designer can change the label) or from the AI assistant. The draft is shown to you before you apply it. Once applied, the text is not marked as AI-generated in the form or in exports. If you need to record or disclose that AI helped with a document, do so yourself (Terms of Service, section 6.3). Output from on-submission AI fields is saved to the form without a preview step (Terms of Service, section 6.1).

6. Data Sharing and Disclosure

Service providers (sub-processors)

We share personal information only with service providers that help us operate the Service: AI model providers, cloud hosting, payment processing, email delivery and search services. These include:

• Google Cloud (hosting; see section 8 for locations);
• Anthropic and OpenAI (AI, in the United States; see section 5);
• Tavily and PubMed (search, in the United States);
• public research and data services (OpenAlex, CanLII, CourtListener, openFDA, FRED, Alpha Vantage, SEC EDGAR, YouTube): AI-generated search query text only, in the United States or Canada;
• Google Workspace (Drive, Gmail, Calendar, Sheets), only when a user connects their own account;
• Google (transactional email and optional Google sign-in);
• Stripe (billing).

Sub-processor list: our current sub-processors are listed in our Vendor Management Policy, with what each one processes and where: https://askbridgit.ai/api/v1/legal/policies/vendor-management-policy

Notice of changes: we give customers at least 30 days' notice before adding a sub-processor that processes customer content.

Provider terms: Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default). We do not currently hold signed data processing agreements with our sub-processors.

Legal disclosures

We may disclose personal information where required by law or in response to:

• court orders or legal processes;
• lawful requests from government authorities;
• the need to protect our rights, property or safety;
• the need to prevent fraud or security threats.

Business transfers

If there is a merger, acquisition or sale of assets, personal information may be transferred to the acquiring entity. We will notify you of any such change and of the choices you may have.

No sale of personal information: We do not sell personal information.

7. Data Retention

We keep personal information only as long as necessary for the purposes in this policy, unless a longer period is required or permitted by law. Our Data Retention Policy is the full schedule: https://askbridgit.ai/api/v1/legal/policies/data-retention-policy

In summary:

• Account data and content: kept while the account is active. After a deletion request there is a 30-day grace period. You can cancel the request during the grace period. A weekly deletion job, run on Sundays, deletes accounts whose grace period has ended, so your account and personal data are deleted within 7 days after the grace period ends, except as described in the Data Retention Policy.
• Backups: daily database backups are kept for 7 days, so deleted data ages out of them within 7 days. Full database exports taken before each production release are stored in Montréal and are kept with no automatic expiry today.
• Customer data at the end of a contract: For 30 days after a subscription ends, the customer can export its data or request a copy (provided within 14 days of the request); after that period the data is deleted.
• Audit logs: data changes and exports for 1 year; permission and role changes for 2 years, after which expired entries are flagged for review when the retention job is run (they are never altered or deleted by the application).
• Sign-in sessions: sign-in tokens expire after 7 days (access and refresh tokens). Signing out does not currently revoke them on the server.
• AI request metadata: kept while your account exists, with no automatic expiry; the link to you is removed when your account is deleted.
• AI assistant conversation history: until you clear it.
• Billing records: 7 years, for tax and accounting law; after account deletion they are kept without a link to your account.
• Consent records: kept while your account exists (up to 7 years) and deleted with your account.

When a retention period ends, we securely delete or anonymize the personal information. Retention periods are configured in the platform; automated enforcement is not yet in place, and expired records are deleted or anonymized (audit logs: flagged for review) when the retention job is run.

8. Where Your Data Is Stored and International Transfers

Where your data is stored

Production data (the database, uploaded files, application logs and pre-release database exports) is stored in Google Cloud's Montréal region (northamerica-northeast1), Canada. This applies to all customers; other hosting regions are not currently offered. Automated database backups are stored in the Montréal region.

Transfers outside Canada

Personal information is transferred outside Canada when you use AI features or searches (section 5), and when our email, sign-in and billing providers process it (section 6). Information processed outside Canada is subject to the laws of that country and may be accessible to its authorities. When we transfer personal information outside Canada, we take steps, including contractual terms with recipients, to ensure it receives comparable protection.

GDPR transfers

If you are in the European Economic Area, your personal information is processed in Canada, which the European Commission recognizes as providing adequate protection for commercial organizations. Onward transfers to our United States providers are made under each provider's commercial / API terms.

You may contact our Privacy Officer for more information about the safeguards we use for international transfers.

9. Your Privacy Rights

PIPEDA rights (Canadian users)

Under PIPEDA, you have the right to:

• access your personal information held by us;
• challenge the accuracy and completeness of your information and have it corrected;
• withdraw consent for certain uses (subject to legal or contractual restrictions);
• file a complaint with the Office of the Privacy Commissioner of Canada or, where applicable, a provincial commissioner (section 15).

GDPR rights (EEA users)

Exercising your rights

• Self-service: you can download a copy of your personal data (including your own activity record) from your account's data management settings. You can also request deletion of your account from your account settings.
• By request: contact our Privacy Officer at info@askbridgit.ai.
• Organization accounts: if your account is provided by an organization, requests about content in that organization's workspace may be referred to that organization, because it controls that information. We will help the organization respond.

Response time: We respond within 30 days, extendable by up to 30 more days with written notice.

Identity verification: We may ask for proof of identity before acting on a request.

No fee: We do not charge for rights requests unless they are manifestly unfounded, excessive or repetitive.

10. Cookies, Local Storage and Tracking

Bridgit does not use advertising or analytics cookies or third-party tracking scripts.

To keep you signed in and remember your preferences, the Bridgit app stores sign-in tokens and settings in your browser's local storage. This is required for the Service to work. Signing out removes the sign-in tokens from your browser.

Pages run by third parties that you visit through Bridgit, such as Stripe's payment pages or Google sign-in, may set their own cookies under those providers' policies.

Your choices: You can clear your browser's storage or configure your browser to block storage and cookies. If you do, you may be signed out or unable to use parts of the Service.

Do Not Track: Some browsers send "Do Not Track" signals. The Service does not respond to them, because there is no industry consensus on how to interpret them. We do not track you across other websites.

11. Data Security

We use technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure or destruction.

Technical safeguards

• encryption of data in transit using TLS A minimum of TLS 1.2 is enforced., and encryption at rest (AES-256, managed by Google Cloud);
• additional application-level encryption (AES-256-GCM) of stored integration credentials;
• passwords stored as salted hashes (bcrypt), with complexity and strength rules applied when a password is changed or reset and at self sign-up;
• progressive account lockout after repeated failed sign-in attempts, and sign-in rate limits;
• multi-factor authentication (authenticator app, with backup codes), available to all users;
• membership-based access control that denies access by default, with organization roles (admin, member, lead);
• an organization setting ("Require explicit access") that blocks Bridgit administrators from accessing the organization's data at the organization level unless they are explicitly granted access; extending the block to every access path is being verified. Any emergency access is time-limited, recorded in the audit log and emailed to the organization's administrators;
• databases reachable only over a private network, and application secrets held in a managed secret store;
• audit logging of data changes, personal-data exports, permission and role changes, security events (including account lockouts, sign-ins, sign-outs and failed sign-ins, MFA changes and consent changes) and privileged access;
• secure software development practices: automated tests (including access-control tests) and security review of changes before release.

Organizational safeguards

• a designated Privacy Officer;
• incident response procedures;
• limited Bridgit staff access to customer data;
• annual review of this policy.

An internal security audit was completed in November 2025. No independent penetration test has been performed to date; one is planned.

Breach notification

If we confirm a security incident involving a customer organization's data, we will notify that organization's designated contact without undue delay, and at the first reasonable opportunity after we confirm it. We will tell them what happened, what data was affected, the steps taken, and the information they need to meet their own obligations (for example, a health information custodian's notification duties under PHIPA).

We will also notify regulators and affected individuals as the law requires:

• GDPR: where Bridgit is the controller, the supervisory authority within 72 hours of becoming aware, as GDPR requires.
• PIPEDA: the Office of the Privacy Commissioner of Canada, and affected individuals, as soon as feasible where a breach creates a real risk of significant harm.

12. Children's Privacy

The Service is not directed to children. Accounts are only for people aged 18 or older (see our Terms of Service). We do not knowingly collect personal information from anyone under that age. If we learn that we have collected personal information from a child without the required consent, we will delete it promptly, and in any case within 14 days. If you believe we hold information about your child, contact us at info@askbridgit.ai.

13. Third-Party Links and Services

The Service may link to third-party websites or services that we do not operate. This policy does not apply to them. We encourage you to review their privacy policies; we are not responsible for their privacy practices.

14. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices, legal requirements or the Service.

• This version: we notified users by email and with a notice in the platform when it was published.
• Material changes: we will notify you by email to active users and a notice in the platform, at least 30 days before they take effect.
• Minor changes: we will update the "Last Reviewed" date at the top of this policy.

If you continue to use the Service after changes take effect, you accept the updated policy. Previous versions of this policy are available on request.

15. Contact Information and Complaints

How quickly we respond. We respond to general privacy and support questions within 14 days. Formal requests to access, correct or delete your personal information are answered within the times in section 9.

Contact us

• Privacy Officer: Matthew Bromwich, CEO and Privacy Officer, info@askbridgit.ai
• Security reports: info@askbridgit.ai
• Address: Core Innovation Corp. (operating as Bridgit, askbridgit.ai), Ottawa, Ontario, Canada
• Website: https://askbridgit.ai

We encourage you to contact us first so we can try to resolve your concern directly.

Filing complaints

• Canada (PIPEDA): Office of the Privacy Commissioner of Canada. Website: www.priv.gc.ca. Toll-free: 1-800-282-1376.
• Ontario health-sector customers: where Bridgit handles personal information on behalf of an Ontario health information custodian, questions should first go to that organization. Complaints may be made to the Information and Privacy Commissioner of Ontario (www.ipc.on.ca, 1-800-387-0073).
• EEA (GDPR): you may lodge a complaint with your local supervisory authority.

16. Additional Jurisdiction-Specific Rights

California residents (CCPA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, including:

• the right to know what personal information is collected;
• the right to know whether personal information is sold or disclosed;
• the right to opt out of the sale of personal information;
• the right to deletion;
• the right to non-discrimination.

We do not sell personal information as defined by the CCPA.

Other jurisdictions

If you live in a jurisdiction with specific privacy laws, you may have additional rights. Contact us to learn more.

17. Definitions

• Personal information / personal data: information about an identifiable individual.
• Personal health information: identifying information about an individual's health or health care, as defined in Ontario's PHIPA or other applicable law.
• Health information custodian: a person or organization, such as a hospital, that is responsible for personal health information under PHIPA.
• Processing: any operation performed on personal information, including collection, storage, use, disclosure or deletion.
• Controller: the organization that decides the purposes and means of processing personal information.
• Processor (service provider): an organization that processes personal information on behalf of a controller.
• Sub-processor: a third party engaged by a processor to help process personal information.
• Privacy Officer: the person accountable for Bridgit's compliance with this policy and with privacy law.

18. Consent and Acknowledgment

By using the Service, you acknowledge that you have read and understood this Privacy Policy. Where the law requires it, we will obtain your express consent for specific processing.

Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect processing that took place before it.

End of Privacy Policy