Personal information governance policy

OralReady · Houssem Ben Salem

Version 1.0 · Approved on November 8, 2026 by Owner, person in charge of the protection of personal information · Effective November 8, 2026

This policy describes how we govern personal information through its whole life cycle: collection, use, communication, retention and destruction. It fits our size: a sole proprietorship with no employees and no user accounts. Our Privacy policy explains what information we collect and why.

1. Scope

This policy applies to all personal information we hold for OralReady, or that our service providers process for us. That is the information of people who practise, buy a pass or write to us.

2. Roles and responsibilities

What we do at each stage

3. Retention and destruction schedule

4. Access, correction and portability requests

1. The request is made in writing to the person in charge, at [email protected] or 2000, rue Saint-Marc, app. 905, Montréal (Québec) H3H 2N9.
2. The person in charge checks the requester's identity without asking for more than needed.
3. They look for the information at Stripe (using the purchase email), in the mailbox and on the server, which holds data only for short periods. They provide it in a structured, commonly used format.
4. They answer in writing within 30 days of receipt. If there is no answer by then, the law treats the request as refused, and the requester can apply to the Commission d'accès à l'information.
5. They log each request: date, type, date of the answer.
6. They adapt how access is given for people with disabilities.

5. Review of an automated estimate

• Anyone can submit comments on an estimate and ask for a review by a person, with the "Ask for a review" button or by email.
• The person in charge looks at the information provided (for example, the printed report), the criteria and the estimate. They correct the information used if needed, for example a transcription error.
• They answer within 30 days, with the reasons and main factors behind the estimate.
• Reviews are free.

6. Complaint handling

1. Make a complaint. Write to [email protected] (subject: "Complaint") or by mail to 2000, rue Saint-Marc, app. 905, Montréal (Québec) H3H 2N9, to the attention of the person in charge of the protection of personal information. Describe the problem and what you would like.
2. Acknowledgement. We acknowledge receipt within 5 business days, with a file number.
3. Review. The person in charge looks into the complaint and may ask you questions.
4. Answer. We send you a written answer, with reasons, within 30 days of receiving the complaint.
5. Recourse. If our answer doesn't satisfy you, you can contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

Complaints are handled free of charge. We keep the file for 24 months after closing it.

7. Confidentiality incidents

A confidentiality incident is, for example, unauthorized access to personal information, or its loss. This is what we do:

1. Reduce the risk. As soon as we have reason to believe an incident happened, we take reasonable steps to reduce the risk of injury and prevent it from happening again.
2. Assess the risk. We consider how sensitive the information is, the possible consequences, and how likely it is to be misused.
3. Notify. If the risk of injury is serious, we promptly notify the Commission d'accès à l'information and the people concerned. If the incident creates a real risk of significant harm under federal law, we report it to the Office of the Privacy Commissioner of Canada and notify the people concerned.
4. Record. We record every incident in the register, even if it creates no serious risk: description, circumstances, dates, number of people affected, risk assessment, notices sent and steps taken. We keep each entry for 5 years.
5. Providers. Our providers must notify us of an incident: OpenAI and Cloudflare without undue delay.

8. Privacy impact assessments (PIAs)

When. We carry out a PIA:

• before launch;
• before acquiring, developing or overhauling a system that handles personal information;
• before communicating personal information outside Québec, or entrusting it to a provider outside Québec;
• before any change of provider or model, for example a new transcription model.

How. We follow the report template of the Commission d'accès à l'information, scaled to our size. For each provider, the PIA describes:

• the information, the purpose, the location and the retention period;
• use for training AI models;
• the written agreement (version and date);
• the legal framework of the destination country, including access by authorities;
• the protection measures, the residual risk and the decision.

It also documents:

• why the biometric rules don't apply: we identify no one by voice and create no voiceprint database;
• why we treat spoken answers as sensitive information;
• the limits of the agreements, which mention neither Québec nor Canada.

We communicate information outside Québec only if the PIA concludes it will be adequately protected, and under a written agreement that reflects it. The person in charge approves and dates each PIA. Current version: 1.0, November 8, 2026.

9. Written agreements with our providers

We review these agreements at each PIA.

10. Review of this policy

The person in charge reviews this policy every year and before any change of provider or model. Each version is approved, dated and published on this page.