This Canadian Privacy Supplement (“Supplement”) applies to users of PsychReport.ai (the “Service”), operated by Cobalt Sail LLC (“PsychReport.ai,” “we,” “us,” or “our”), who access the Service from Canada or who input personal information about individuals located in Canada.

This Supplement adds to, and where there is a conflict for Canadian users takes precedence over, our general Privacy Policy. Capitalized terms not defined here have the meaning given in the Privacy Policy.

1. Our Role and Your Role

PsychReport.ai is a tool used by licensed and credentialed mental health professionals. Under Canadian privacy law, the relationship works as follows:

You (the clinician) are the custodian / trustee / controller of the personal information and personal health information you enter about your clients. You are a “health information custodian” (Ontario), “custodian” (Alberta), “trustee,” or equivalent under your applicable provincial health-privacy law, or an organization subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) or a substantially similar provincial private-sector law.
PsychReport.ai is your service provider, agent, and information manager. We process personal information only on your instructions and on your behalf, solely to provide the Service. We do not use it for our own purposes.

Because you are the custodian, you remain responsible for obtaining any consent required from your clients, for the lawfulness of the information you collect, and for your professional and regulatory obligations. We are responsible for handling that information in accordance with this Supplement, our agreements with you, and applicable law.

2. Cross-Border Transfer to the United States

Your data is stored and processed in the United States. PsychReport.ai operates on infrastructure located in the United States. When you use the Service from Canada, personal information and personal health information you enter is transferred to, stored in, and processed in the United States.

You should be aware, and where required should inform the individuals whose information you enter, that:

While in the United States, this information is subject to United States law, including lawful access by U.S. courts, law enforcement, and government authorities (for example, under the U.S. CLOUD Act), which may apply regardless of Canadian law.
The data-protection laws of the United States differ from those of Canada and your province.
We remain accountable for the information through contractual and technical safeguards designed to provide a comparable level of protection, consistent with the accountability principle under PIPEDA and applicable provincial law.

By using the Service, you consent to this transfer and confirm that you have the authority to do so on behalf of your clients to the extent required by your professional and legal obligations.

Public-sector and school-district users: The Service is not currently offered to public bodies, school boards, or other organizations that are subject to Canadian data-residency requirements that mandate storage of personal information within Canada (for example, Nova Scotia's PIIDPA, or British Columbia FIPPA obligations for public bodies). If you are such an organization, contact us before using the Service. A Canadian-hosted arrangement may be required.

3. Consent

We rely on you, the clinician, to obtain and document any consent your clients are entitled to under your applicable health-privacy law and professional standards, including consent to the use of an AI-assisted drafting tool and to cross-border processing where required. We will provide you with the information you reasonably need to do this.

4. Service Providers and Sub-Processors

To deliver the Service we use a limited set of sub-processors, each engaged under a written agreement requiring privacy and security protections:

Cloud infrastructure: Google Cloud Platform (hosting, storage, database).
Artificial intelligence / report generation: large language model services from Google (Vertex AI), and, as configured, OpenAI and Anthropic.

Before personal health information is sent to any AI service provider, it is de-identified. Our agreements with all AI providers prohibit the use of any personal information or personal health information processed through PsychReport.ai for training their models. We maintain Business Associate Agreements and equivalent data-processing terms with sub-processors that may access protected health information.

A current list of sub-processors is available on request.

5. Your Clients' Rights

Individuals in Canada have rights in respect of their personal information, including to access it, request correction, withdraw consent (subject to legal and contractual limits), and complain to a regulator. Because you are the custodian, these requests are normally directed to and fulfilled by you. The Service provides tools to locate, export, correct, and delete records so that you can respond. We will assist you in responding to a verified request.

6. Breach Notification

If we become aware of a breach of security safeguards involving personal information you control, we will notify you without unreasonable delay and provide the information you need to assess whether the breach poses a “real risk of significant harm” and to meet your notification obligations to affected individuals and to the Office of the Privacy Commissioner of Canada or your provincial regulator.

7. Retention and Destruction

We retain the personal information you enter only as long as needed to provide the Service to you, or as required by law. On termination, you may request export of your data, and we will securely delete it in accordance with our agreement with you and our retention schedule.

8. Quebec — Law 25

If you or your clients are in Quebec, the following also applies:

Privacy Officer. Our designated Privacy Officer is responsible for compliance and can be reached at [email protected].
Transfer Impact Assessment. Because the Service transfers personal information outside Quebec, we will provide you with the information you reasonably need to complete your own assessment of the transfer (commonly called a Transfer Impact Assessment) before you communicate personal information outside Quebec, and we will enter into the written agreement that assessment requires.
Automated processing. Report drafts are generated with the assistance of AI. Generated content is an assistive draft that requires your professional review and approval; no decision affecting an individual is made solely by automated means within the Service.
Complaints. You and affected individuals may contact our Privacy Officer and may also complain to the Commission d'accès à l'information du Québec.

9. Provincial Health-Privacy Law

We acknowledge that, depending on your province, you are subject to a health-privacy law such as Ontario's PHIPA, Alberta's HIA, Nova Scotia's PHIA, or British Columbia's PIPA, and that we act as your agent / information manager / electronic service provider under that law. We will handle personal health information consistent with that role and will enter into a written agreement with you reflecting it.

10. Contact

Privacy Officer — Cobalt Sail LLC (PsychReport.ai)
Email: [email protected]
Subject line: Canadian Privacy Inquiry

You may also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial privacy regulator.