Privacy Policy
Effective September 22, 2026 · Last reviewed September 22, 2026
This policy is written for transparency and should be read with any applicable institutional agreement.
1. Scope
This policy describes how BriteLink Education Inc. handles personal information through BriteLink Homeschool, BriteLink EDU, BriteLink NEXT, public websites, demonstrations, pilot enquiries and institutional services. A partner agreement may add more specific instructions for a particular implementation.
2. Accountability
BriteLink Education Inc. is accountable for personal information under its control. Keisa Andries is the designated Privacy Lead. Privacy questions, access requests and complaints may be sent to hello@britelink.org with the subject “Privacy”.
3. Information we collect
Depending on the service, BriteLink may collect names, email addresses, account identifiers, organization and role information, learner profiles, accessibility preferences, cohort and assignment information, learning activity, answers, assessment results, progress evidence, support communications, pilot enquiries, campaign source information, session identifiers, IP or operational log information, and information a user chooses to enter into a form or enabled AI feature.
4. Purposes
Information is used to create and secure accounts; deliver and configure learning; assign pathways; record activity and progress; support accessibility; respond to enquiries; operate pilots; prepare agreed reports; troubleshoot, prevent abuse and improve reliability; meet legal or contractual requirements; and communicate about requested services. BriteLink does not sell personal information.
5. Institutional and learner data
For institutional programs, the partner and BriteLink should document who controls each category of information, authorized staff roles, consent or other authority, reporting requirements, retention and deletion. NEXT is not intended for detailed legal case files, clinical notes, correctional records, identity documents or information unrelated to learning delivery.
6. Children and supported participants
BriteLink Homeschool is intended to be managed by a parent or guardian. Institutional programs involving minors or participants who require supported decision-making must establish appropriate authority, notice, consent, safeguarding and access arrangements before launch.
7. AI-assisted functions
Selected functions may send the information needed to generate learning content, evaluate a response or produce speech audio to OpenAI. Users and partners should not include unnecessary identifiers, legal case details or clinical information in prompts. Pilot agreements may limit or disable AI-assisted functions. AI output may be inaccurate and remains subject to human review.
8. Service providers and cross-border processing
BriteLink relies on vetted technology service providers for application hosting, authentication, database, storage and selected AI-assisted functions. Depending on configuration, providers may process information outside Canada, where it may be subject to foreign laws. Detailed infrastructure and subprocessor information is available to qualified institutional partners during security, privacy and procurement due diligence.
9. Website analytics and logs
BriteLink uses first-party analytics to understand page use and pilot conversions. Current marketing events may include route, referring host, campaign tags, event name and a random session identifier. Hosting and security infrastructure may also process IP addresses, user-agent information, timestamps and request logs for operation and abuse prevention. BriteLink does not use the public-site event record to build third-party advertising profiles.
10. Consent and choices
BriteLink seeks consent or relies on another lawful authority appropriate to the context. Individuals should receive understandable notice of what is collected, why, which material third parties receive it and the consequences of declining. Consent may be withdrawn where applicable, although that may prevent continued use of a requested service.
11. Access and correction
Individuals may request access to or correction of personal information about them, subject to applicable exceptions and identity verification. Institutional learners may be directed to the partner organization where it controls the relevant record. BriteLink aims to respond within the period required by applicable law.
12. Retention and deletion
BriteLink retains information only as long as reasonably necessary for the identified purpose, an active service, legal requirements and documented dispute or security needs. Each institutional pilot must define an operational retention and deletion schedule before launch. Authorized deletion requests will be processed within the applicable legal or contractual period; residual copies may remain temporarily in managed backups until their normal expiry.
13. Safeguards and incidents
BriteLink uses managed hosting, authenticated access, role-based permissions, organization-scoped database policies and data-minimization practices. No system is risk-free. Suspected incidents are assessed, contained, documented and notified where required by law or contract. Security concerns should be sent to hello@britelink.org with the subject “Security”.
14. Complaints and regulator contact
Privacy complaints are reviewed by the Privacy Lead through BriteLink’s published complaints process. Individuals may also have the right to contact the Office of the Privacy Commissioner of Canada or another applicable regulator.
15. Changes
BriteLink may update this policy when products, providers or legal requirements change. Material changes affecting an active institutional service should be communicated according to the applicable agreement.