Privacy policy

1. Who we are and what this policy covers

This policy is issued by AccreditBook, a business name of a corporation existing under the laws of Ontario, Canada ("AccreditBook", "we", "us" or "our"). It applies to personal information we handle through accreditbook.com and its subdomains (the "Website"), the AccreditBook web application (the "Service"), and our related communications, sales, billing and support activities.

The Service is offered only to businesses and other organizations. It is not intended for personal, family or household use.

We have designated a person responsible for our compliance with this policy and with applicable privacy law. You can reach that person at privacy@accreditbook.com.

2. Our two roles

Where we decide how information is used. For information about visitors to the Website, people who contact us, and the individuals who sign up for, administer, pay for or use a lab account, we determine the purposes and means of processing. Depending on the law that applies, we are the "organization", "controller", "business" or "person carrying on an enterprise" for that information, and this policy governs it.

Where we act for a laboratory. The records a customer keeps in the Service, such as equipment, calibration, personnel competence, audits and nonconformities, and the files attached to them ("Customer Data"), belong to that customer. We process personal information within Customer Data only on the customer's behalf and instructions, under our terms of service and data processing agreement. For that information we are a "service provider", "processor" or "contractor", and the customer's own privacy notice governs it. If you are an employee of a laboratory and have a question about your records, contact your laboratory. We will assist it to respond as our agreement requires.

3. Information we collect

Information you give us

• Website forms: laboratory name, work email address, accreditation body and next assessment month when you reserve a seat, or your work email address when you request a template.
• Account information: name, work email address, role, laboratory details, and credentials. Passwords are stored only in salted and hashed form by our authentication provider.
• Billing information: billing contact, billing address, tax identification number and subscription history. Payment card details are collected and held by our payment processor, Stripe; we do not receive or store full card numbers.
• Communications: the content of messages you send us, questions you enter in the in-application help box, and feedback.

Information collected automatically

• With each Website form submission: the date and time, the country from which the request was made (derived from the IP address by our hosting provider), the browser user-agent string and the referring page. We do not store the IP address with the submission.
• Technical and security data: our hosting and infrastructure providers process IP addresses, device and browser information and request logs to deliver, secure and protect the Website and the Service, and keep these logs for limited periods.
• Website analytics, only if you accept: if you accept analytics cookies in the banner on the Website, Microsoft Clarity collects how you interact with pages (clicks, scrolling, mouse movement and page views, which may be replayed as a session recording), together with device, browser, approximate location derived from the IP address, and referring page. Text you type into forms is masked and not collected. If you decline, or your browser sends a Global Privacy Control signal, Clarity is not loaded.
• Usage and diagnostics in the Service: aggregated, cookieless usage statistics, error reports linked to a user identifier, and an audit trail of actions taken within a lab account.

Information from others

We receive limited information from our payment processor (for example, payment status and the last four digits and expiry of a card) and from colleagues who invite you to a lab account (your name and email address).

Please do not send us, or upload to the Service, sensitive personal information (such as health, biometric, financial account or government identification information) that is not needed for a laboratory's quality records. See section 9 of the terms of service.

4. How we use information

We use personal information for the following purposes, and for purposes that are reasonably related and compatible with them:

We do not sell personal information. We do not "share" personal information for cross-context behavioural advertising, and we do not use personal information for automated decision-making that produces legal or similarly significant effects.

5. Consent

Where the law relies on consent, including under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we collect, use and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations. By providing information for a purpose described when you provide it, you consent to its use for that purpose. You may withdraw consent at any time on reasonable notice, subject to legal and contractual restrictions; we will explain the likely consequences of withdrawing, which may include our being unable to provide the Service.

6. How we disclose information

• Service providers that host, secure, support and operate the Website and the Service on our behalf, bound by written obligations to protect the information and use it only to provide their services to us. They are listed, with their purposes and locations, at /legal/subprocessors.
• Microsoft, if you accept analytics cookies on the Website, which provides Clarity. Microsoft processes Clarity data under its own terms and privacy statement, including as an independent controller for some purposes; see privacy.microsoft.com.
• Within your organization: information in a lab account is visible to that account's authorized users, including users with the auditor role whom the customer invites.
• Legal and safety: where we believe in good faith that disclosure is required or permitted by law, including to comply with a subpoena, warrant, court order or other legal process; to enforce our agreements; or to protect the rights, property or safety of AccreditBook, our customers or others.
• Business transactions: to a prospective or actual acquirer, successor or assignee in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business or assets, subject to confidentiality obligations, and to that party afterwards.
• With consent or at your direction.

We may disclose aggregated or de-identified information that cannot reasonably be used to identify you or a laboratory, for any lawful purpose.

7. Artificial intelligence features

Two optional features of the Service use a third-party language model provider, currently Anthropic:

• the in-application help box sends your question, together with the text of our public help articles, to generate an answer; and
• CSV import sends the column headers and up to five sample rows of a file you upload, to propose how columns map to fields. Nothing is written to the account until a user reviews and confirms the mapping.

Certificates, attached files and other records are not sent. Under the provider's commercial terms in effect when this policy was published, inputs sent through its commercial interface are not used to train its models. Outputs of these features may be inaccurate and are subject to the user's review.

8. Where information is stored and transferred

All laboratory data is stored in a single cloud region. The region is confirmed before the first lab enters data and stated on this page and in the data processing agreement. Some of our service providers, including our payment processor, email delivery provider and AI provider, process the limited information they handle in the United States or other countries.

As a result, personal information may be stored or processed outside the province, state or country where you are located, including in jurisdictions whose data protection laws differ from yours. Information held in another jurisdiction may be accessible to that jurisdiction's courts, law enforcement and national security authorities under its laws. Where we transfer personal information from the European Economic Area, Switzerland or the United Kingdom to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Canada is recognized by the European Commission and the United Kingdom as providing adequate protection for personal information handled by organizations subject to PIPEDA.

9. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information, described on our security page. No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for the security of your devices. If we become aware of a breach of security safeguards affecting your personal information, we will notify you and the relevant authorities where and as required by applicable law.

10. Retention

We keep personal information only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law, and then delete, de-identify or securely destroy it. In general:

• Website enquiries and founding-lab list: until you ask us to delete them, and in any case no longer than 24 months after our last interaction with you.
• Account information: for the life of the lab account and the post-termination periods in our terms of service.
• Customer Data: as directed by the customer and as set out in our terms of service and data processing agreement. Copies in backups expire on the normal backup cycle.
• Billing, tax and accounting records: for the period required by tax and corporate law, currently up to 7 years.
• Security logs and audit trails: for the periods needed to protect the Service and the integrity of customer records.

Where information is the subject of a request, complaint, dispute or legal hold, we may keep it until the matter is resolved.

11. Your rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, to have it corrected, to have it deleted, to receive it in a structured, commonly used and machine-readable format, to restrict or object to certain processing, and to withdraw consent. To make a request, write to privacy@accreditbook.com.

We will respond within the time required by applicable law. We may need to verify your identity, and the authority of anyone acting on your behalf, before responding. We may decline or limit a request where the law permits, for example where fulfilling it would reveal personal information about another person, interfere with legal proceedings, or where the information is held as a service provider for a customer, in which case we will refer you to that customer. We do not charge a fee for reasonable requests.

12. Region-specific information

Canada

You may challenge our compliance with PIPEDA by contacting us at privacy@accreditbook.com. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or, where applicable, a provincial privacy authority. Residents of Quebec also have the rights provided by the Act respecting the protection of personal information in the private sector, and may contact the Commission d'accès à l'information du Québec.

European Economic Area, Switzerland and the United Kingdom

In addition to the rights in section 11, you may lodge a complaint with the data protection supervisory authority where you live or work, or where an alleged infringement occurred, including the UK Information Commissioner's Office. Where we rely on legitimate interests, you may object to that processing on grounds relating to your particular situation.

United States

Certain US state laws give residents rights regarding their personal information, which may include the rights to know what personal information we collect, use and disclose; to access and obtain a copy; to correct; to delete; and to opt out of the sale or sharing of personal information or of targeted advertising. We do not sell or share personal information, and we do not engage in targeted advertising. We do not use or disclose sensitive personal information for purposes that require an opt-out right. We will not discriminate against you for exercising your rights. You may designate an authorized agent to make a request on your behalf, subject to verification. If we deny your request, you may appeal by writing to privacy@accreditbook.com with the subject line "Appeal". The categories of personal information we collect, their sources, our purposes and the categories of recipients are described in sections 3, 4 and 6. We honour Global Privacy Control signals as a request to opt out of sale or sharing, although we do not sell or share personal information.

13. Marketing messages

We send commercial electronic messages only where permitted by Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act and similar laws, for example where you have consented or have made an enquiry. Every marketing message identifies us, includes our mailing address and contains an unsubscribe mechanism, and we act on unsubscribe requests within the period the law requires. You may also opt out by writing to privacy@accreditbook.com. Service messages, such as security notices, billing notices and the due-list email that your lab has enabled, are not marketing and are sent as part of the Service.

14. Cookies and similar technologies

Website. The Website sets no cookies unless you accept analytics in the banner. It stores your choice in your browser's local storage so we do not ask again. If you accept, Microsoft Clarity sets first-party cookies (such as _clck and _clsk, which keep a visitor and session identifier for up to one year and one day respectively) and Microsoft may set its own cookies (such as MUID) to identify your browser across sites that use Microsoft services. We do not use advertising cookies. You can change your choice at any time with "Cookie settings" in the footer, or by clearing your browser's site data.

Service. The Service uses only cookies and local storage that are strictly necessary to keep you signed in, to remember which lab you are working in, and to protect against abuse. Usage statistics in the Service are collected without cookies.

15. Children

The Website and the Service are intended for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

16. Third-party sites and services

The Website and the Service may link to or integrate with services operated by others, such as our payment processor's checkout pages. Their privacy practices are governed by their own policies, and we are not responsible for them.

17. Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page with a new effective date. Where a change materially affects how we handle personal information already collected, we will provide notice in advance by email to account owners or within the Service, and obtain consent where the law requires.

18. Contact

Privacy questions, requests and complaints: privacy@accreditbook.com.