Privacy Policy

Overview

Careviv Health Inc. ("Careviv," "we," "us," or "our") operates a physician recruitment, clinic matching, relocation-support, and healthcare information platform. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit careviv.ca, submit an inquiry, create an account, use a doctor or clinic portal, communicate with us, or otherwise use a Careviv service that links to this Policy (collectively, the "Services").

Privacy notice, not blanket consent

This Policy is a notice about our privacy practices; it is not a request for blanket consent to every activity described below. We rely on the authority permitted by applicable law for each purpose. Where consent is required, including for certain optional disclosures, marketing, or non-essential tracking technologies, that consent is separate from this Policy and may be withdrawn subject to legal or contractual restrictions. Declining an optional use will not prevent access to unrelated features.

Table of Contents

• Scope and People Covered
• Information We Collect
• Sources of Information
• Purposes and Lawful Bases
• Doctor Profiles, Clinic Matching, and Identity Release
• Recruitment Assessments and Profiling
• Credentials, Identity Documents, and Vetting Information
• How We Disclose Information
• Service Providers and Technology Partners
• Cookies, Analytics, and Advertising
• AI-Assisted Features
• International Transfers
• Retention and Deletion
• Security
• Communications and Marketing
• Privacy Rights and Choices
• Children and Third-Party Information
• Changes to This Policy
• Contact and Complaints

1. Scope and People Covered

This Policy applies to personal information about identifiable individuals that is under Careviv's control. Depending on the circumstances, Careviv acts as the organization responsible for deciding why and how that information is processed. This Policy applies to:

• Doctors and prospective candidates, including people who contact us before creating an account.
• Clinic owners, clinic representatives, hiring personnel, and other authorized clinic users.
• People who provide professional references or whose information is supplied as part of a recruitment or relocation process.
• Website visitors, people who submit forms or use public tools, and people who communicate with Careviv.
• Careviv's public clinic and provider directory may contain business and professional information obtained from clinics, providers, and public sources.
• The Services are not designed to receive patient medical records. Do not upload or send patient-identifying or clinical information through recruitment profiles, documents, messages, or support channels.

2. Information We Collect

The information we collect depends on your relationship with Careviv and the features you use. We may collect:

• Account and contact information: name, email address, telephone number, authentication identifiers, account role, communication preferences, account status, and records of notices, choices, consents, or agreements associated with the account.
• Doctor professional information: biography, photograph, current role and employer, employment history, education, qualifications, certifications, languages, specialty, professional references, registration or licensing information, and years of experience.
• Doctor recruitment and relocation information: preferred provinces or cities, practice and clinic preferences, timeline, family or household priorities you choose to share, eligibility-tool answers, pathway progress, opportunity interests, interview availability, interview acceptance, and onboarding or relocation steps.
• Clinic and opportunity information: clinic identity and location, authorized representatives, services, staffing needs, job postings, compensation or overhead information, schedules, supervision and sponsorship capacity, candidate invitations, interview outcomes, and clinic-authored notes.
• Recruitment records: source or referral information, intake reports, internal notes, relationship owner, candidate or clinic stage, readiness and engagement assessments, communications, support messages, and follow-up history.
• Documents and verification information: CVs, passports, medical degrees, GMC, CCT and MRCGP evidence, professional registration documents, Enhanced DBS checks, references, document metadata, file hashes, malware-scan results, administrative notes, and document access history.
• Website, device, and activity information: IP address or a hash derived from it, browser and device information, operating system, referring page, approximate location, pages viewed, clicks, portal visits, login and last-seen information, active days, feature use, posting views, messages, document activity, and other security or diagnostic events.
• Communications and content: emails, form submissions, support requests, portal messages, feedback, reviews, and information you provide during calls or meetings.
• Public directory and legacy-service information: clinic and provider business information and, where still retained, limited records from prior Careviv services for legal, security, accounting, dispute-resolution, or deletion purposes.

3. Sources of Information

We collect information directly from you; from doctors, clinics, referees, and people who refer or introduce a candidate or clinic; from Careviv staff who create intake reports, notes, assessments, and follow-up records; from authentication, hosting, email, analytics, advertising, security, and other service providers; from cookies and similar technologies; and from public professional sources such as regulator registers, clinic websites, professional profiles, and other lawfully accessible sources. If we obtain your information from someone else, we provide this Policy or another appropriate notice when required by law.

4. Purposes and Lawful Bases

We use personal information only for purposes that a reasonable person would consider appropriate and as permitted by applicable law. Under Canadian privacy law, this may be based on consent, an obvious or reasonable purpose, performance of requested services, or another authorization provided by law. Where UK data protection law applies, our principal purposes and lawful bases are:

• Accounts, inquiries, support, and requested services: to respond to you, create and administer accounts, provide portal functions, and take steps you request in connection with recruitment or a potential service relationship. We rely on contract or pre-contract steps and our legitimate interests in operating the Services.
• Recruitment, matching, introductions, and relocation support: to assess potential fit, identify relevant opportunities, facilitate expressions of interest and interviews, support onboarding and relocation planning, and administer clinic relationships. We rely on contract or pre-contract steps, our legitimate interests and those of participating doctors and clinics, and consent where required for an optional disclosure.
• Credential and document review: to verify identity or professional information, assess readiness, protect the integrity of the recruitment process, and support steps you request. We rely on contract or pre-contract steps, legitimate interests, legal obligations, and any additional legal condition required for sensitive or criminal-offence information.
• Safety, security, and service integrity: to authenticate users, control access, scan files, maintain audit logs, prevent misuse, investigate incidents, and protect Careviv, doctors, clinics, and others. We rely on legitimate interests and legal obligations.
• Service administration and improvement: to troubleshoot, measure use, maintain quality, develop features, create aggregated reporting, and prioritize operational follow-up. We rely on legitimate interests and, for non-essential tracking where required, consent.
• Communications: to send interview, account, security, support, relocation, and service messages. We rely on contract or pre-contract steps and legitimate interests. We send marketing based on consent or another basis permitted by applicable electronic-marketing law.
• Legal, regulatory, and corporate purposes: to meet legal obligations, establish or defend legal claims, enforce agreements, complete audits, and manage a financing, reorganization, acquisition, or sale. We rely on legal obligations and legitimate interests.

5. Doctor Profiles, Clinic Matching, and Identity Release

Careviv uses staged profile sharing so clinics can evaluate potential fit before direct identity and contact information are released. A limited profile is pseudonymized, not guaranteed to be anonymous: a clinic may be able to identify a doctor from a distinctive combination of experience, education, certifications, specialty, location, or other professional details.

• When a doctor's visibility setting is "Visible to clinics" (the current default), location-matched clinics may see a limited professional profile. Choosing "Private" removes the profile from clinic discovery, although Careviv staff may continue to use it to provide requested services.
• The limited profile may include a stable internal identifier, headline, biography, years of experience, languages, specialty, target location, relocation timeline and progress, readiness indicators, employment history, education, certifications, and whether the doctor expressed interest in an opportunity. It excludes direct contact information, profile photograph, and professional references before identity release.
• A doctor's name, email address, photograph, and references may be released to a clinic after the doctor accepts that clinic's interview invitation or when Careviv records that an introduction has otherwise been authorized.
• A doctor may initially see a clinic opportunity under a descriptive label without the clinic's direct identity or contact details. When the doctor accepts an interview invitation, the clinic's identity and available contact details may be released to the doctor.
• After identifying information is released, the doctor and clinic communicate directly and the clinic is responsible for its own collection, use, retention, and protection of the information it receives. A clinic may have its own privacy notice and legal obligations.
• Doctors can change profile visibility or withdraw from an opportunity. Withdrawal stops future Careviv sharing but cannot reverse information already lawfully received by a clinic.

6. Recruitment Assessments and Profiling

Careviv uses rules-based assessments to help staff organize the recruitment pipeline, prioritize follow-up, and identify potentially relevant matches. These assessments may use intake answers, qualification or licensing readiness, relocation timing, location preferences, blockers, responsiveness, portal recency and activity, completed steps, documents uploaded, messages, opportunity interests, interview activity, clinic hiring needs, postings, invitations, and recorded outcomes.

• Scores and labels support Careviv staff; they do not replace professional judgment, regulatory review, or a clinic's hiring process.
• Careviv does not currently make final hiring, placement, licensing, or similarly significant decisions solely through automated processing.
• You may ask us to explain information used in an assessment, correct inaccurate inputs, or have a person review an assessment that materially affects how Careviv handles your recruitment relationship.

7. Credentials, Identity Documents, and Vetting Information

The doctor document portal may collect passports, CVs, medical degrees, registration and certification evidence, Enhanced DBS checks, references, and other requested materials. Enhanced DBS information is criminal-offence information under UK law and receives heightened treatment.

• We use these materials to review identity and professional readiness, support recruitment or relocation steps you request, detect fraudulent or unsafe files, and maintain an auditable record of authorized access.
• Documents are stored in non-public storage. Access is limited to the doctor, authorized Careviv personnel, and service providers needed to host, secure, or scan the files.
• Uploads are subject to file validation and malware scanning. We record metadata and access events, which may include the person who accessed a document, action, time, IP address, and browser information.
• We do not disclose uploaded document files to a clinic, regulator, health authority, or other recipient merely because a profile is visible. If a later recruitment or relocation step requires a document to be sent, we will provide appropriate notice and obtain any direction or authorization required by law.
• Please upload a passport, DBS check, or other sensitive document only when Careviv specifically requests it for a current process.

8. How We Disclose Information

We disclose personal information only for the purposes described in this Policy, as you direct, or as otherwise permitted or required by law. Recipients may include:

• Participating doctors and clinics, following the staged matching and identity-release process described above.
• Careviv personnel and contractors who need the information to operate recruitment, support, security, technical, or administrative functions and who are subject to appropriate duties.
• Hosting, authentication, storage, communications, analytics, advertising, security, document-scanning, and technology service providers acting for Careviv.
• Professional advisers, insurers, auditors, financing parties, and prospective purchasers or successors in a proposed or completed corporate transaction, subject to appropriate confidentiality and legal requirements.
• Courts, regulators, law enforcement, health or safety authorities, or other parties when disclosure is required by law or reasonably necessary to protect rights, security, or safety.
• Other recipients when you request or authorize the disclosure.

9. Service Providers and Technology Partners

Depending on the feature and deployment configuration, Careviv uses providers such as Supabase for database, authentication, and storage; Vercel for website hosting and performance analytics; Google for sign-in, analytics, and advertising measurement; Reddit for advertising measurement; Resend or Postmark for email delivery; Sentry for error and performance monitoring; ClamAV infrastructure for malware scanning; and OpenAI for limited AI-assisted functions. We seek to limit the information sent to a provider to what is reasonably necessary for its function. Providers operate under their own terms and our applicable arrangements with them, and the list may change as the Services evolve.

10. Cookies, Analytics, and Advertising

Careviv and its providers use cookies, pixels, scripts, local storage, and similar technologies for authentication, security, preferences, performance, analytics, and advertising measurement. Marketing pages may use Google Analytics, Google Ads conversion tracking and remarketing, Vercel Analytics, and the Reddit Pixel, which can receive device, browser, page, referral, and interaction information. You can limit these technologies through browser settings, provider opt-out tools, and any Careviv preference controls presented to you. Blocking essential technologies may prevent account or portal functions from working. Where consent is the applicable legal basis, you may withdraw it without affecting processing that occurred before withdrawal.

11. AI-Assisted Features

Some public assistant and content-moderation features may send the text you submit and limited conversation context to OpenAI or another AI provider to generate or screen a response. Do not enter passports, DBS information, patient data, confidential clinic data, or other sensitive personal information into a public AI feature. AI output may be incomplete or inaccurate and should be independently verified. Careviv's recruitment priority and engagement assessments are currently rules-based and are not generated by OpenAI.

12. International Transfers

Careviv is based in British Columbia. Our core application database and secure-document storage are configured in Canada. Some service providers or their support personnel may process information in the United States, the United Kingdom, or other jurisdictions. Information in another jurisdiction may be subject to that jurisdiction's laws and lawful-access requirements. Where UK data protection law applies to a restricted transfer, we use an applicable adequacy route, contractual safeguard, or other lawful transfer mechanism and conduct any assessment required by law.

13. Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purpose collected, the recruitment or clinic relationship, security and audit needs, legal obligations, dispute resolution, and enforcement. Retention depends on the record and context:

• Account, profile, inquiry, candidate, clinic, and opportunity records are retained while the relationship or process is active and afterwards for a limited period appropriate to follow-up, placement administration, disputes, and legal obligations.
• Information used to make a decision that directly affects an individual may be retained for at least one year where required by British Columbia law so the individual has a reasonable opportunity to access it.
• Passports, DBS information, credentials, CVs, prior document versions, and document-access records are retained only while needed for the active process, verification, security, audit, or a legal requirement. Access may be restricted before final deletion.
• Marketing records are retained until consent is withdrawn or the record is no longer needed, while a minimal suppression record may be kept to respect an opt-out.
• Security, diagnostic, and audit records are kept for a limited period based on the sensitivity of the event and the time reasonably needed to investigate misuse or meet legal requirements.
• Backups are deleted or overwritten on their normal cycle. De-identified or aggregated information that cannot reasonably identify a person may be retained longer.
• A deletion request may not remove information we must retain by law, need to establish or defend legal claims, or must keep to protect another person's rights. We will explain any material exception that applies.

14. Security

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including access controls, private document storage, authentication, transport security, audit logging, file validation, malware scanning, and staff access restrictions. No service can guarantee absolute security. Protect your credentials, do not share accounts, and notify us promptly if you suspect unauthorized access or disclosure. If an incident creates a legal reporting or notification obligation, we will notify affected individuals and the appropriate authorities as required by applicable law.

15. Communications and Marketing

We send service communications needed to administer accounts, inquiries, opportunities, interviews, security, support, and relocation workflows. You may still receive these messages while using the relevant service. Marketing communications are separate: where consent or another lawful basis is required, we follow applicable electronic-marketing requirements. You can unsubscribe through the message link or contact us, and we may keep a suppression record so we do not contact you again for that marketing purpose.

16. Privacy Rights and Choices

Depending on where you live and the applicable law, you may have rights to ask whether we hold information about you and to request access, correction, deletion, restriction, portability, or an explanation of its use. You may also object to certain processing, withdraw consent where processing relies on consent, complain to a privacy regulator, and request human review of relevant profiling. Rights can be subject to identity verification, legal exceptions, and the rights of other people.

• Account and profile: update available fields in the portal or contact us for assistance.
• Clinic visibility: doctors can select "Private" to stop future clinic discovery and can withdraw from an opportunity.
• Recruitment records: a request may cover source information, intake reports, assessments, portal activity, clinic feedback, and internal notes, subject to applicable exceptions and third-party rights.
• Marketing: use the unsubscribe method in the message or contact us.
• Cookies and similar technologies: use available Careviv, browser, or provider controls.
• UK individuals may complain to the Information Commissioner's Office. Canadian individuals may complain to the Office of the Information and Privacy Commissioner for British Columbia or, where applicable, the Office of the Privacy Commissioner of Canada. We encourage you to contact Careviv first so we can investigate.

17. Children and Third-Party Information

Doctor and clinic accounts are intended for adults with legal capacity and are not directed to children. We do not knowingly create recruitment accounts for anyone under 18. If relocation preferences include a partner or children, provide only the minimum information needed and avoid names, identification documents, medical information, or other sensitive details unless specifically requested with an appropriate notice. If you provide information about a referee or another person, you should be authorized to do so and should direct that person to this Policy.

18. Changes to This Policy

We may update this Policy as our Services, providers, or legal obligations change. The effective date shows when the current version took effect. For a material change, we will provide notice through the Services, email, or another appropriate channel and will request consent where required. A Privacy Policy is a notice; continued use alone is not treated as consent where applicable law requires an affirmative choice.

19. Contact and Complaints

Contact the Careviv Privacy Officer to ask a question, make a complaint, exercise a privacy right, or request information about service providers or international-transfer safeguards. We may need to verify your identity before disclosing or changing personal information.

• Privacy Officer, Careviv Health Inc.
• Location: Vancouver, British Columbia, Canada
• Email: generalinfo@careviv.ca (subject line: Privacy Request)
• Website: https://www.careviv.ca