1. Introduction
Cannabix Technologies Inc. ("Cannabix," "we," "our," or "us") is committed to protecting the privacy of individuals who use our products and services, including the BreathLogix Alcohol Screening devices, BreathLogix Connect platform, Breath Collection Unit ("Cannabix Devices"), and our corporate website. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia’s Personal Information Protection Act (PIPA), and other applicable privacy laws. By accessing our website, creating an account on BreathLogix Connect, or otherwise providing personal information in connection with Cannabix Devices, you consent to the practices described in this Privacy Policy.
2. Information We Collect
-
Identifying information: Name, company, position, address, phone number, and email address.
-
Photos (where uploaded by you or our clients) and other identifiers necessary for device assignment, site access, or user records. We do not collect biometric templates or perform facial recognition.
-
Account information: Login credentials, authentication details (via AWS Cognito), and access permissions.
-
Device and usage information: IP address, browser type, operating system, pages visited, and usage logs collected through cookies and analytics tools.
-
Testing and operational data: Alcohol or substance test results uploaded by clients, employee or subject identifiers, site/location details, equipment identifiers, and calibration records.
-
Communications: Records of emails, support requests, feedback, or other correspondence with us.
We generally do not collect sensitive information such as racial/ethnic origin or religious beliefs. Where workplace or program testing data constitutes health information, we process it only as a service provider to our clients and only with consent or other lawful authority as required by applicable law. Cannabix does not make employment, disciplinary, medical, or legal determinations based on such data.
3. Role of Cannabix (Service Provider / Processor)
In most cases, Cannabix acts as a service provider or data processor on behalf of its clients. Clients determine the purposes and lawful basis for collecting personal information (including workplace or law‑enforcement testing data) and are responsible for providing required notices, obtaining valid consent, or ensuring other lawful authority under applicable laws. Cannabix processes such data solely in accordance with client instructions and applicable agreements.
4. How We Use Personal Information
-
Providing and managing access to BreathLogix hardware and BreathLogix Connect and related services.
-
Delivering reports, alerts, and analytics to authorized users designated by the client.
-
Authenticating and securing accounts (via AWS Cognito and MFA/SSO).
-
Improving the functionality, performance, and security of our platform.
-
Responding to inquiries, support tickets, and service requests.
-
Producing aggregated, de‑identified, or anonymized analytics that cannot reasonably be used to identify an individual (e.g., statistical trends); we do not use identifiable test data for discretionary research.
-
Sending service updates about our products, services, or policies (with opt‑out options for marketing communications).
-
Meeting legal, regulatory, and compliance requirements.
5. Client Responsibilities for Lawful Authority and Consent
Clients are responsible for obtaining all required consents or other lawful authority (including any employment, collective agreement, union, or statutory requirements) prior to submitting personal information to Cannabix or using Cannabix Products. Cannabix does not verify employment, union, or statutory compliance and relies on client instructions for processing.
6. Disclosure of Personal Information
-
Service providers: cloud hosting (AWS), authentication (Cognito), and IT/security providers, bound by confidentiality and data protection obligations.
-
Authorized partners or contractors: for calibration, testing, support, or training services as instructed by clients.
-
Corporate transactions: in the event of a merger, acquisition, or sale of our business assets, subject to appropriate safeguards.
-
Legal obligations: where disclosure is required to comply with applicable laws, regulations, or valid legal processes.
We do not sell personal information to third parties.
7. Data Storage and Security
BreathLogix Connect is hosted on Amazon Web Services (AWS), with data stored in AWS data centers in the United States (North Virginia region). All personal data is encrypted at rest (AES‑256) and in transit (TLS 1.2+). Access to personal information is role‑based and protected by optional multi‑factor authentication (MFA).
8. Data Retention and Deletion/Anonymization
Personal information is retained only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law, and is generally governed by the applicable client contract. Upon contract termination or at client instruction, Cannabix will securely delete or anonymize personal information in accordance with industry best practices, subject to applicable legal, regulatory, or archival requirements (e.g., backup retention cycles). Unless otherwise required by contract or law, Cannabix does not retain identifiable personal information indefinitely
9. International Transfers
Where personal information is transferred to or accessed from outside Canada (including the United States through AWS infrastructure), it may be subject to foreign laws. Cannabix implements contractual, technical, and organizational safeguards designed to protect personal information in accordance with Canadian privacy requirements.
10. Individual Rights
-
Access: you may request access to your personal information, subject to lawful limitations.
-
Correction: you may request correction of inaccurate or incomplete information.
-
Withdrawal of consent: where processing is based on consent, you may withdraw consent going forward.
-
Complaints: you may file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial authority.
-
Routing of requests: in many cases (e.g., workplace or law‑enforcement data), requests must be directed to the client organization that controls the data. Cannabix will assist clients in responding to requests as required by law and contract.
11. Breach Notification
If a data breach occurs that poses a real risk of significant harm, we will notify affected clients and, where applicable and required by law, affected individuals and relevant regulators.
12. Third‑Party Links
Our websites or platforms may contain links to external websites. We are not responsible for the privacy practices of third parties and encourage users to review the privacy statements of any website they visit.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted with the “Last Updated” date. Continued use of our services after changes take effect constitutes acceptance of the revised policy.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:
Attention: Privacy Officer Cannabix Technologies Inc. 501 – 3292 Production Way, Burnaby, BC, V5A 4R4