Version 1.1   |   Last updated: April 6, 2026.

 

1. Introduction

These terms and conditions apply specifically to BreathLogix Connect clients and are supplementary to the general terms of Cannabix Technologies Inc., including those relating to Trading, Website, Privacy, Warranties, and Refunds.

In the event of a conflict, these BreathLogix Connect specific terms take precedence.

BreathLogix Connect provides access to key testing data, including reports, graphs, summaries, and automated alert notifications.

2. Data Custodianship and Control

As between the parties, clients retain ownership and control of all data uploaded to or generated through the BreathLogix Connect platform, including test results, employee or subject identifiers, site and location information, equipment identifiers, and calibration records (“Client Data”).

Cannabix Technologies Inc. acts solely as a service provider and data processor with respect to Client Data and processes such data only on behalf of and in accordance with client instructions, applicable agreements, and applicable law.

Cannabix does not determine the purposes for which Client Data is collected or used and does not make employment, disciplinary, medical, legal, or compliance decisions based on Client Data.

3. Client Data Access Rights

During active subscriptions, clients are granted secure access to view and export their data through the BreathLogix Connect interface, subject to these terms and usage limitations.

4. Intellectual Property Ownership

Cannabix Technologies Inc. retains full ownership of all platform-related intellectual property, including:

• Data insights, statistical trends, and analytics
• Proprietary algorithms and reporting tools

This ownership ensures platform integrity, supports long-term analytics, and enables continuous service improvement while maintaining strict data privacy and security standards.

5. Data Licensing

By using BreathLogix Connect, clients grant Cannabix Technologies Inc. a royalty-free license to:

• Process and store client data as needed to deliver services
• Generate anonymized analytics and benchmarking from client data
• Use data for platform improvement, research, and development
• Retain and use anonymized insights after termination of client agreements

6. Privacy Compliance

Cannabix Technologies Inc. is committed to compliance with applicable privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada and comparable international standards.

We will:

• Collect only the personal information necessary to provide BreathLogix Connect services
• Handle personal information in accordance with our Privacy Policy
• Implement technical and administrative safeguards to protect data
• Provide individuals with access to their personal information upon request
• Only use or disclose personal information for the purposes collected, unless permitted or required by law

7. Client Responsibilities

Clients are solely responsible for the collection, use, management, and protection of all Client Data submitted to or accessed through BreathLogix Connect.

Clients represent and warrant that:

• Lawful Collection & Use
  All Client Data has been lawfully obtained and processed in accordance with applicable privacy, employment, workplace, and law enforcement laws, including obtaining all required notices, consents, and authorizations.
• Data Accuracy
  All data provided to the platform is accurate, complete, and up to date to the best of their knowledge.
• Access Control & Security
  Clients are responsible for:
  • Managing user accounts, roles, and permissions
  • Maintaining the confidentiality of login credentials
  • Promptly revoking access for former employees or unauthorized users
  • Preventing unauthorized access, misuse, or disclosure of Client Data within their organization
• Use of Exported Data
  Any data exported, downloaded, or otherwise removed from BreathLogix Connect is solely the responsibility of the client. Cannabix Technologies Inc. is not responsible for the security, storage, or use of such data once it leaves the platform.
• Internal Policies & Compliance
  Clients are responsible for implementing and enforcing their own internal policies regarding:
  • Data retention
  • Employee privacy
  • Workplace testing procedures
  • Use of test results in decision-making
• Regulatory Compliance
  Clients are solely responsible for ensuring their use of BreathLogix Connect complies with all applicable laws and regulations in their jurisdiction.

Cannabix relies on client representations and does not independently verify compliance with such obligations.

8. Data Breach Response

In the event of a data breach, Cannabix Technologies Inc. will:

• Notify affected clients without undue delay and, where feasible, within 24 hours of confirmation of a security incident that poses a real risk of significant harm.
• Provide details of the breach, affected data, and remediation steps
• Where required by law, notify regulators such as the Office of the Privacy Commissioner of Canada (OPC) or equivalent body
• Assist clients in meeting notification obligations to affected individuals

A detailed incident report will be provided as information becomes available, and generally within seven (7) days of initial notification.

9. Data Processing Purposes

Cannabix Technologies Inc. processes your data to:

• Deliver the BreathLogix Connect web platform and testing dashboards
• Maintain and improve functionality and security
• Provide technical support and troubleshooting
• Comply with legal and regulatory requirements
• Generate anonymized analytics

10. Archiving and Retention

BreathLogix Connect data is archived at regular intervals.

• Subject to applicable law and client agreements, clients with active subscriptions are provided access to historical data as available.
• Access to older data, or retrieval for inactive accounts, may incur additional service fees.

Retention periods vary:

• Personal information: Retained only as long as necessary or legally required
• Test results: 1 year from creation
• System logs: 1 year
• Anonymized analytics: Indefinitely
• Account and billing information: 1 year after closure

Clients may request earlier deletion of certain personal data, subject to legal requirements.

11. Termination and Data Deletion

Upon termination of your BreathLogix Connect subscription:

• You retain access to your data for 30 days for export
• After the 30-day post-termination access period, Client Data may be archived and retrieval may be subject to additional service fees.
• Immediate deletion may be requested, subject to legal obligations
• Anonymized analytics may be retained indefinitely

12. Administration and Setup

BreathLogix Connect is a self-service platform.

• Customers are responsible for user management, alerts, and permissions
• Initial setup includes configuration of one company profile and one admin account
• Additional setup or profile changes may incur an administrative fee

13. Platform-Specific Usage

• Account administrators manage roles (Admin, Manager, Staff) with defined permissions
• Customers must revoke access for former employees promptly
• Shared credentials are strictly prohibited
• Two-Factor Authentication (2FA) is available via email or SMS
• Reports can be viewed online or exported (export limitations may apply)

14. Data Upload Responsibilities

By uploading data, clients warrant that:

• The data has been lawfully obtained
• Collection and use complies with privacy and workplace laws
• Data is accurate to the best of their knowledge

15. API Usage

API usage for BreathLogix Connect is subject to fair use limits designed to ensure stability and equitable access. Cannabix Technologies Inc. reserves the right to introduce or adjust rate limits, record retrieval caps, and throttling mechanisms as necessary. Excessive or abusive API usage may result in warnings, temporary suspension, or permanent restriction of API access.

16. Data Location and Security

BreathLogix Connect is hosted on Amazon Web Services (AWS), a leading global cloud provider that complies with internationally recognized security and privacy standards.

• Data Residency: All primary client data is stored in AWS data centers located in North American availability zones. This ensures compliance with Canadian privacy requirements (PIPEDA, BC PIPA) and minimizes cross-border data transfers.
• Infrastructure Security: AWS maintains ISO 27001, SOC 1/2/3, and PCI DSS certifications. BreathLogix Connect leverages these security controls to safeguard sensitive data.
• Encryption: All data is encrypted in transit (TLS 1.2 or higher) and at rest using AES-256 encryption standards.
• User Authentication:
  BreathLogix Connect uses AWS Cognito for identity and access management.
  Cognito provides secure user authentication, password policies, and account recovery workflows.
  It supports multi-factor authentication (MFA) via SMS, email, or authenticator apps (TOTP), as well as integration with corporate Single Sign-On (SSO) providers (SAML/OAuth 2.0).
  Session tokens and credentials are managed securely through Cognito’s identity pools, reducing exposure to unauthorized access.
• Access Control: User access is managed via role-based permissions, ensuring individuals only have the level of access required for their responsibilities. Account administrators are responsible for promptly revoking access for former employees.
• Shared Responsibility Model: AWS provides the infrastructure and physical security, while Cannabix Technologies Inc. manages application-level security, including authentication workflows, data handling, and access policies.
• Regular Testing: We conduct regular vulnerability assessments and partner with AWS to ensure security patches and updates are applied without delay.
• Business Continuity: AWS availability zones provide built-in redundancy, allowing rapid failover in the event of hardware or network failures.

17. Backup and Recovery

• BreathLogix Connect uses AWS native services such as Amazon S3 and Amazon RDS automated backups.
• Data is backed up daily with point-in-time recovery available for a minimum of 7 days.
• Long-term archives may be stored in Amazon S3 Glacier for cost-efficient retention.
• Disaster recovery leverages multiple AWS availability zones, enabling restoration within 24 hours (excluding weekends/holidays).

18. System Availability & Liability

BreathLogix Connect leverages AWS’s high-availability infrastructure, targeting 99.9% uptime (excluding scheduled maintenance). Redundant deployments across AWS availability zones help ensure service continuity.

• Service credits may be applied for downtime exceeding 24 consecutive hours
• Liability is limited to fees paid in the preceding 12 months
• Cannabix Technologies Inc. excludes liability for indirect or consequential damages to the extent permitted by law

19. Force Majeure

Neither party is liable for delays caused by events outside their control, including natural disasters, cyberattacks, or infrastructure failures.

20. Dispute Resolution

Before legal action, parties agree to:

• Attempt direct negotiation within 14 days of notice
• If unresolved, participate in mediation in British Columbia, Canada
• If mediation fails, disputes may be referred to arbitration under the BC Arbitration Act.

21. Governing Law

These terms are governed by the laws of British Columbia, Canada. Parties submit to the exclusive jurisdiction of its courts for unresolved matters.