Privacy Policy

Last updated: November 14, 2026

In short: this website collects very little. We don’t sell personal information, we don’t use advertising trackers, and health information that care organizations store in the Cenvetra platform belongs to them. We process it only to provide the service, under a written agreement.

1. Who we are

Cenvetra is a care-operations software platform provided by Ditstek Canada [full legal entity name and registration], with its registered office at [registered address, city, province, postal code], Canada (“Ditstek”, “we”, “us” or “our”).

We are responsible for the personal information described in this policy. We have appointed a Privacy Officer who is accountable for our compliance. You can reach them at info@cenvetra.com (subject line “Privacy”).

2. Scope

This policy applies to:

• visitors to cenvetra.com and its subdomains used for marketing (the “Website”);
• prospective customers, design partners and others who contact us or request a demo; and
• business contact information of our customers’ administrators and billing contacts.

It does not govern how a care organization (our customer) handles information about its clients, patients, residents, participants, families or staff within the Cenvetra platform. That is covered by the customer’s own privacy notice and by our agreement with that customer. See section 5.

3. Information we collect

Information you give us

• Contact and enquiry details: your name, work email, phone number, organization, role, organization size and the content of your message when you email us, book a demo or apply to our design partner program.
• Meeting information: notes from demos and discovery calls, and recordings only if you agree to them at the time.
• Business account details: names and contact details of the people who manage a customer account or receive invoices.

Information collected automatically

• Server logs: when you visit the Website, our hosting provider records technical data such as IP address, browser type, pages requested, referring URL and time of request. We use these logs for security, troubleshooting and capacity planning.
• Fonts: the Website loads typefaces from Google Fonts. Your browser connects to Google’s servers to fetch them, which shares your IP address and browser details with Google. See Google’s Privacy Policy.

We do not use advertising cookies, cross-site tracking or social-media pixels on the Website. If we add privacy-friendly analytics in future, we will update this policy first.

Please do not send us health information about any individual through our contact channels. We cannot use it and will delete it.

4. How we use information

We collect only what we need for these purposes and use it only for them, unless you consent to something else or the law requires or permits it. Where the EU or UK GDPR applies, our legal bases are your consent, steps taken at your request before entering into a contract, performance of a contract, our legitimate interests in operating and promoting our business, and compliance with legal obligations.

5. Data in the Cenvetra platform

Care organizations use Cenvetra to manage information about the people they serve and their staff, which may include personal health information. For that information:

• the care organization decides what is collected and why, and is the custodian, controller or covered entity (as applicable law describes it);
• Ditstek acts as a service provider and processes that information only on the organization’s documented instructions and under a written agreement. Depending on the jurisdiction, that agreement may be a data processing agreement, an information-manager or service-provider agreement, or, for U.S. covered entities, a Business Associate Agreement;
• we do not sell this information, use it for advertising, or use it to train general-purpose AI models;
• access by our personnel is limited to what is needed to provide, secure and support the service, and is logged; and
• if you are a client, patient, resident, family member or staff member of a care organization and want to access or correct your information, please contact that organization. We will help them respond.

Product screens shown on the Website use synthetic demonstration data only.

6. AI features

The Cenvetra platform includes optional AI features (“AI coworkers”) that prepare, rank, draft and coordinate administrative work. Each customer decides whether to enable them and at what level of autonomy. In the platform:

• AI features receive only the minimum data needed for a task, within data categories the customer’s configuration permits;
• AI output is recorded and attributed separately from human actions, and consequential decisions remain with authorized people;
• AI features do not make clinical diagnoses or treatment decisions; and
• where an AI model provider processes data, it does so as our sub-processor under contractual terms that prohibit using customer data to train its models.

7. How we share information

We do not sell or rent personal information. We share it only:

• with service providers who help us run our business, such as website and cloud hosting (DigitalOcean), email and productivity tools, scheduling and AI model providers. They are bound by contract to use it only to provide services to us and to protect it;
• with our affiliates, including Ditstek Innovations Private Limited, where they help develop and support Cenvetra under equivalent safeguards;
• with professional advisers such as lawyers and accountants, under confidentiality;
• if required by law, or to protect the rights, safety or property of anyone; or
• as part of a business transaction, such as a merger or sale, subject to confidentiality and this policy.

A current list of sub-processors that handle platform data is available to customers on request.

8. Where information is stored

The Website is hosted in DigitalOcean’s Toronto, Canada region. Some of our service providers and affiliates operate in, or store data in, other countries, including the United States and India. When information is processed outside your province, state or country, it may be accessible to authorities there under local law. We use contractual and technical safeguards to give comparable protection.

For the platform, customers can discuss data-residency options with us. Our agreement with each customer records where its data is hosted.

9. Cookies and similar technologies

The Website does not set cookies. Your browser may store limited technical data, such as cached files, to load pages faster. If we introduce cookies or analytics, we will update this section and ask for consent where the law requires it.

10. How long we keep information

• Enquiry and prospect information: up to 24 months after our last interaction, unless you become a customer or ask us to delete it sooner.
• Customer account and billing records: for the duration of the relationship, plus the period required for tax, accounting and legal purposes, typically up to 7 years.
• Server logs: normally no longer than 90 days, unless needed to investigate a security incident.
• Platform data: as set out in the customer agreement, including return or deletion when the agreement ends.

11. Security

We protect personal information with safeguards suited to its sensitivity, including encryption in transit, access controls based on least privilege, tenant isolation, audit logging and staff confidentiality obligations. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals, regulators and customers as the law requires.

12. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and learn how it is used and disclosed;
• ask us to correct information that is inaccurate or incomplete;
• withdraw consent, subject to legal or contractual limits;
• ask us to delete information, or to stop or restrict certain processing;
• receive certain information in a portable format; and
• complain to a privacy regulator, such as the Office of the Privacy Commissioner of Canada, your provincial privacy commissioner, or a data protection authority.

To make a request, email info@cenvetra.com. We will confirm who you are before acting and respond within the time the law requires, normally 30 days. We will not discriminate against you for exercising your rights. We encourage you to contact us first so we can try to resolve any concern.

13. Notice to U.S. residents

Some U.S. state laws, including those of California, Colorado, Connecticut, Virginia and others, give residents additional rights. In the past 12 months we have collected the categories of personal information described in section 3 (identifiers, professional information and internet activity) for the purposes in section 4. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not knowingly collect sensitive personal information through the Website. You or an authorized agent may exercise your rights as described in section 12. If we deny a request, you may appeal by replying to our decision.

14. Marketing emails

We send commercial electronic messages only with your consent or as otherwise permitted by Canada’s Anti-Spam Legislation (CASL) and the U.S. CAN-SPAM Act. Every message identifies us and includes a working way to unsubscribe, which we honour within 10 business days.

15. Children

The Website is intended for businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16 through it.

16. Changes to this policy

We may update this policy as our services and the law change. We will post the new version here with a new “Last updated” date and, if the changes are significant, give notice on the Website or by email.

17. Contact us

Privacy Officer, Ditstek Canada
[Registered address, city, province, postal code], Canada
Email: info@cenvetra.com