Privacy Policy

Effective October 16, 2026

Aeta is home care operations software provided by Aicare Services Inc. ("Aeta", "we", "us"), a company based in British Columbia, Canada. This policy explains what personal information we collect through the website at aeta.care, the Aeta web app and the Aeta mobile app (together, the "Service"), how we use and share it, and the choices you have.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

Our role

Home care agencies ("Customers") use Aeta to manage their staff, clients and visits. That means we handle two kinds of information:

• Customer Data. Information an agency and its users put into the Service, such as client records, care plans, shift reports and staff details, belongs to that agency. We process it on the agency's behalf and under its instructions, as its service provider. If you are a client, family member or staff member of an agency that uses Aeta, the agency's own privacy practices govern how it collects and uses your information, and you should send requests about that information to the agency. We will help the agency respond.
• Information we control. We are responsible for the information we collect to run our own business, such as account and sign-in details, technical information about use of the Service, and messages you send us.

Information we collect

Information agencies and their users provide

Depending on how an agency uses Aeta, the Service may hold:

• Staff information: name, email address, phone number, home address, role, pay rate and payroll type, hire date, certifications, skills, languages, availability and time off, onboarding status (such as criminal record check stage), notes, and documents the agency uploads.
• Client information: name, gender, date of birth, home address and location, access and parking instructions, care plan and care types, notes, emergency contacts, funding and billing details (such as funder and claim numbers), and documents the agency uploads. This can include personal health information.
• Family members and emergency contacts: name, relationship to the client, phone number and email address.
• Visit records: schedules, clock-in and clock-out times, shift reports, notes, care tasks, expenses and receipts, and the edit history of each visit.
• Billing and payroll records produced from the information above.

Account information

Accounts are created only by invitation from an agency. We collect your email address and the role the agency gives you. When you set up your account you create a password, which we store only in hashed form.

Information from your use of the Service

• AI assistant conversations: the messages you send to the Aeta assistant, its replies, and the changes it proposes for your approval.
• Voice dictation: if you dictate a message, your audio is sent for transcription. We keep the resulting text, not the audio.
• Preferences: settings such as your time zone and display options.
• Technical information: our hosting providers automatically record information such as IP address, browser and device type, and the requests made to the Service, to keep it secure and running.

Information from Google

If you connect your Google Calendar to Aeta, we receive the information described in Google user data below.

When you contact us

If you email us or ask for a demo, we collect your name, email address and anything you include in your message.

How we use information

We use personal information only to:

• provide, maintain and secure the Service, including signing you in and showing each user only the information their role allows;
• run the features an agency uses, such as scheduling, attendance, shift reports, invoicing and payroll;
• provide AI features you choose to use, such as the assistant and care plan formatting;
• send service messages, such as invitations, password resets and alerts an agency turns on;
• respond to support requests and communicate with Customers;
• detect, investigate and prevent fraud, abuse and security incidents; and
• comply with the law and enforce our Terms of Service.

We do not sell personal information. We do not use Customer Data for advertising, and we do not use it to train artificial intelligence models.

AI features

When you use an AI feature, the information needed for that request is sent to a third-party AI model provider. For example, if you ask the assistant about a client, that client's details may be sent to the model so it can answer. Depending on the feature and the model selected, these providers include Google, OpenAI, Anthropic and ElevenLabs, reached through OpenRouter. We configure assistant, care plan and voice transcription requests so that providers do not store them or use them to train their models.

The assistant can propose changes to records, but it cannot make them on its own: a person reviews and approves each one. AI output can be wrong, so check it before relying on it.

How we share information

• Within an agency. Users see information according to the role their agency gives them. For example, caregivers see the details of their own visits, and family members see the visits of the client they are linked to.
• Service providers. We use the providers listed below to host and run the Service. They may use personal information only to provide their services to us, and must protect it.
• Integrations an agency turns on. For example, Slack alerts post a caregiver's name, a client's name and visit timing to the agency's own Slack channel, and Google Calendar sync adds an employee's shifts, with each client's name and address, to that employee's own Google Calendar.
• Legal and safety reasons. When the law requires it, such as under a valid court order, or when needed to protect the rights, property or safety of Aeta, our users or others.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may be transferred under the protections of this policy. We will notify affected Customers.

Service providers

Where information is stored

We are based in Canada. Our service providers store and process information in Canada, the United States and other countries where they operate. Information processed outside Canada is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities.

Google user data

An agency can invite its employees to connect a Google Account so their Aeta shifts appear in Google Calendar. This section explains how we handle data from Google when you do this.

• Data we access: your Google Account email address and the events in the calendar Aeta creates. We cannot see or change your other calendars or their events.
• How we use it: we add each of your upcoming shifts to the Aeta calendar with its time, the client's name and the client's address. About every minute we compare that calendar with your schedule and add, correct or remove events so they match. This means events in the Aeta calendar that do not match a shift, including ones you add yourself, are removed. We use Google user data only for this feature.
• How we store it: your Google email address is stored with your employee record and only your agency's admins can see it. Google access tokens are stored encrypted, separately from other data. We read events from the Aeta calendar only to compare them with your schedule, and we do not keep copies of them.
• How we share it: we do not sell Google user data, use it for advertising, or send it to AI model providers. We share it only with the service providers above as needed to run the Service, when the law requires it, or as part of a business transfer.
• Human access: our staff do not read your Google user data unless you ask us to, it is needed for security purposes such as investigating abuse, or the law requires it.
• Retention and deletion: we keep your Google email address and access token only while your calendar is connected. When your agency disconnects it, we delete the Aeta calendar and its events from your Google Account, revoke our access, and delete the Google data we stored. You can also remove Aeta's access at any time in your Google Account settings or delete the Aeta calendar, and we will delete the Google data we stored within minutes. To ask us to delete it, email hi@aeta.care.
• AI models: we do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

Aeta's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and local storage

We use only the cookies and browser storage needed to run the Service: to keep you signed in, to complete invitation and password reset links, and to remember interface preferences such as your selected dates. We do not use advertising or analytics cookies, and we do not track you across other websites. The mobile app stores your sign-in session encrypted on your device.

If an agency links a Google Docs, Sheets, Slides or Drive file in Aeta, opening its preview loads content from Google, and Google's privacy policy applies to that content.

Retention

We keep Customer Data while the agency's account is active, or as the agency directs. Agencies can edit and delete records in the Service. When an agency stops using Aeta, we delete or de-identify its Customer Data within a reasonable time, unless the law requires us to keep it. Copies in backups are removed as the backups expire.

If an agency deletes your account, we delete your sign-in details, preferences and assistant conversations. Records the agency still needs, such as visit and payroll records, remain part of its Customer Data.

Security

• Information is encrypted in transit and at rest.
• Role-based access control and database row-level security limit each user to the records their role allows.
• Passwords are stored only in hashed form.
• Uploaded files are kept in private storage that only authorized agency staff can open.
• Access to production systems is limited to authorized personnel.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected Customers and, where the law requires, affected individuals and privacy regulators.

Your rights and choices

Subject to legal limits, you can:

• ask for access to the personal information we hold about you;
• ask us to correct it;
• ask us to delete it;
• withdraw your consent, although this may mean we can no longer provide the Service to you; and
• complain to us, or to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

To make a request, email hi@aeta.care. We may need to verify your identity, and we respond within 30 days. If your request is about Customer Data, we will pass it to the agency responsible and help it respond. If you live outside Canada, you may have similar rights under local law, and we will honour them as required.

Children

The Service is for agencies and their staff and is not directed to children. Users must be at least 18 years old or the age of majority where they live. Agencies may store information about clients who are minors as Customer Data, with any consent the law requires.

Changes to this policy

We will post any changes on this page and update the effective date. If a change is significant, we will notify Customers by email or in the Service before it takes effect.

Contact us

Questions or concerns about privacy can go to our Privacy Officer at Aicare Services Inc., hi@aeta.care.

Portions of this policy are adapted from the Basecamp open-source policies under CC BY 4.0.