Privacy Policy

Navya AI Inc. ("Navya," "we," "us," or "our") operates the Navya Wellness voice-first AI caregiver platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information, including personal health information ("PHI"), in compliance with the Personal Information Protection and Electronic Documents Act ("PIPEDA"), applicable provincial health privacy legislation including the Personal Health Information Protection Act ("PHIPA") in Ontario, and other applicable Canadian privacy laws.

Account Information

• Name, email address, phone number
• Billing and payment information (processed via Stripe Canada)
• Account preferences and settings

Care Recipient Information (with consent)

• Name, phone number, preferred language
• Health conditions and medical history
• Current medications and dosage schedules
• Emergency contacts
• Call preferences and schedule

Call Data

• Voice conversation transcripts
• Call recordings (only with explicit consent)
• AI-generated wellness assessments (mood scores, health indicators)
• Voice biomarker analysis data

Under PIPEDA and CASL, we obtain meaningful consent before collecting, using, or disclosing personal information. Specifically:

• Express consent is obtained from the care recipient (or their legal guardian/Power of Attorney) before any wellness calls are made
• Express consent is obtained before recording any calls
• Express consent under CASL is obtained before sending commercial electronic messages (SMS alerts, email summaries)
• Consent may be withdrawn at any time by contacting us at privacy@navya.ca

• To provide daily wellness check-in calls to care recipients
• To generate health and mood assessments for family caregivers
• To send real-time alerts when health or safety concerns arise
• To produce weekly health trend reports
• To improve our AI models and voice analysis (only with de-identified, aggregated data)
• To process payments and manage your account
• To comply with legal obligations

All personal health information is stored exclusively within Canada.

• Cloud infrastructure: AWS Canada (ca-central-1, Montreal)
• Data at rest: Encrypted with AES-256
• Data in transit: Encrypted with TLS 1.2+
• Telephony: Twilio (Canadian data processing, DPA signed)
• AI processing: Azure OpenAI (Canada East region)
• No personal health information is transferred outside of Canada

We do not sell personal information. We may disclose information:

• To authorized family caregivers on the account (as configured by the account holder)
• To healthcare providers if requested and authorized by the account holder
• To emergency services (911) when a critical safety concern is detected
• To service providers who process data on our behalf (all with signed Data Processing Agreements)
• As required by Canadian law, regulation, or court order

• Active account data: Retained while your account is active
• Call recordings: Retained for the period specified in your plan (default: 90 days), then automatically deleted
• Health reports: Retained for 2 years or until account deletion
• Upon account deletion: All personal data is deleted within 30 days, except where retention is required by law

You have the right to:

• Access your personal information held by us
• Correct inaccurate personal information
• Withdraw consent for collection, use, or disclosure
• Delete your personal information (subject to legal requirements)
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@navya.ca.

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will:

• Notify the Office of the Privacy Commissioner of Canada within 72 hours
• Notify affected individuals as soon as feasible
• Keep records of all breaches for a minimum of 24 months

We use the following service providers, all with Data Processing Agreements:

• AWS Canada — Cloud infrastructure (DPA signed)
• Twilio — Voice telephony (DPA signed)
• Azure OpenAI — AI processing, Canada East region (DPA signed, data not used for model training)
• Stripe Canada — Payment processing (PCI-DSS compliant)
• ElevenLabs — Voice synthesis (DPA signed)

For questions, concerns, or to exercise your privacy rights:

Privacy Officer
Navya AI Inc.
Email: privacy@navya.ca
Toronto, Ontario, Canada

We may update this policy from time to time. Material changes will be communicated via email and posted on this page with an updated date. Continued use of our services after changes constitutes acceptance.