Privacy Policy

Synosys is a business registered in Ontario, Canada. We build and operate AI intake systems for service businesses across London and the Greater Toronto Area.

You can reach the person accountable for privacy at Synosys here:

Privacy Officer, Synosys ali@synosys.io London, Ontario, Canada

Mailing address Synosys Unit 1303, 605 Proudfoot Lane London, ON N6H 4S2 Canada

The Privacy Officer is accountable for the personal information under our control and for our compliance with this policy. Direct all privacy questions, access requests and complaints to the address or email above.

---

Your information can reach us in four ways. The rules are different for each, so read the section that applies to you.

1. You visit synosys.io. You are browsing our website, reading a knowledge base article, or using the ROI calculator.
2. You contact us or book an audit. You fill in a form, email us, or book a call.
3. We contact you. You received a business email or a message from us as part of our outreach.
4. You interact with an AI intake agent we built for one of our clients. You called a roofer, a clinic or another business, and our system answered, took your details, or booked your appointment.

In situations 1 through 3, Synosys decides how your information is used. We are responsible for it directly.

In situation 4, our client is responsible for your information, not Synosys. We act as their service provider and, where the client is a healthcare provider, as their agent under PHIPA. We handle your information only on their instructions. Their privacy policy governs. Section 8 explains this in detail.

---

3.1 Website visitors

When you visit synosys.io we collect standard technical information automatically:

• IP address and approximate location (city or region level)
• Browser type, device type and operating system
• Pages viewed, time on page, and the link or search that brought you here
• Cookie and analytics identifiers

We do not require you to identify yourself to read our site.

3.2 People who contact us or book an audit

When you submit a form, email us, or book a free audit, we collect:

• Name, business name and job title
• Email address and phone number
• Information about your business that you choose to share, such as call volume, current intake process, software you use, and the problem you want solved
• Notes from our calls and meetings with you
• ROI calculator inputs, if you choose to send them to us

3.3 Prospects we reach out to

For business development we collect and use business contact information from public and commercial sources, including company websites, professional directories, public licensing registries, LinkedIn, and licensed data providers. This is typically:

• Name, job title, business name
• Business email address, business phone number and business address
• Publicly available information about the business, such as practice area, location and size

We use this to decide whether our service is a fit for your business before we contact you.

3.4 Clients and client staff

If you become a client we also collect billing details, account credentials needed to run the service, records of support requests, and configuration information about your intake workflow.

3.5 Callers and end users of an AI intake agent

When our system handles a call, chat or form on behalf of one of our clients, it may collect:

• Your name, phone number and email address
• The reason for your call and what you say during it
• Appointment details, availability and preferences
• A written note of the details the agent captured for the business, such as your address, the job you need and the time it booked
• Call metadata such as time, duration and outcome
• For healthcare clients, personal health information, which can include your health card number, symptoms, provider name, and appointment type

What you say during the call is processed live so the agent can answer you. We do not keep recordings or transcripts of the call.

This information belongs to our client. Section 8 explains what we can and cannot do with it.

3.6 People who try the live demo on synosys.io

When you try our demo, in your browser or by having it call your phone, we collect:

• The phone number you enter, so the demo can call you and so we can limit misuse
• The date, length and outcome of the demo call
• A live transcript of the demo call, shown to you on the page while the call runs

We keep your number and the call log with our enquiry records and may follow up with you about the demo. The demo transcript is deleted within 24 hours of the call ending; it is not kept as a record. We do not keep a recording of the demo call.

---

We collect personal information for these purposes and no others:

If we ever want to use your information for a new purpose, we will identify that purpose and get your consent first, unless the law allows or requires otherwise.

We do not sell personal information. We do not rent or trade contact lists.

---

We get your consent before we collect, use or disclose your personal information, except where PIPEDA allows collection without consent, such as business contact information used to communicate with you in your professional role, or where a legal or regulatory obligation applies.

Your consent can be express, for example when you fill in a form, or implied, for example when you continue a call after being told at the start how your information will be used.

You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Email ali@synosys.io. If withdrawing consent means we can no longer provide a service, we will tell you before it takes effect.

---

This section matters most, so we are being specific.

We disclose that the agent is AI. Our AI intake agents identify themselves as an automated or AI assistant at the start of the interaction. We do not build agents that claim to be human.

We tell you up front. Callers are told at the beginning of the call how their information will be used. If you continue the call after that notice, your consent is implied.

We do not keep recordings or transcripts. We do not keep recordings or transcripts of your customers' calls. If you called one of our clients, that means no recording or transcript of your call is kept. The agent keeps only the details the business needs, listed in section 3.5.

You can decline. If you do not want to speak with an AI agent, say so. The call will be transferred to a human, or you will be given another way to reach the business, such as a callback, an online form, or attending in person. Our clients configure this escalation path and we require one to exist.

Limited use. The details captured on a call are used only for the purposes named in section 4. Synosys does not use call content to train AI models.

Access. You can ask for the details captured about you on a call. Requests go to the business you called. See section 15.

---

Our AI agents capture information, answer questions, qualify enquiries and book appointments. They do not make final decisions about your eligibility for care, legal representation, credit, housing or employment. Those decisions are made by the business you contacted. If an agent cannot handle your request or you ask for a person, it escalates to human staff.

---

When we provide intake services to a clinic, medical practice or other health information custodian in Ontario:

• The custodian is responsible for your personal health information. Synosys is not the custodian. We act as an agent of the custodian under PHIPA section 17 and as an electronic service provider under PHIPA and Ontario Regulation 329/04.
• We collect, use, retain and disclose personal health information only as necessary to provide the service, and only on the custodian's instructions and with their authorization. We do not use it for our own purposes.
• We do not disclose personal health information to anyone other than the custodian, except where the custodian directs us to or the law requires it.
• Our staff and any subcontractor with access are bound by the same restrictions in writing.
• We keep and can produce, on the custodian's request, a record of the personal health information we handle on their behalf.
• If personal health information in our care is lost, stolen or accessed without authorization, we notify the custodian at the first reasonable opportunity. The custodian is responsible for notifying affected individuals and the Information and Privacy Commissioner of Ontario.
• We provide the custodian with a written description of our services and safeguards, and we perform privacy and security assessments as required.

If you are a patient and want access to, or correction of, your health information, contact the clinic or provider directly. We will support them in responding, but we cannot release their records to you ourselves.

---

If you received a commercial email from Synosys:

• We sent it under express consent, or under implied consent permitted by CASL, such as an existing business relationship or a business email address that was conspicuously published without a statement refusing such messages, and where the message is relevant to your role.
• Every message identifies Synosys, includes our contact information, and includes a working unsubscribe link.
• Unsubscribe requests are honoured within 10 business days, as CASL requires, and usually immediately.
• We keep a suppression list so an unsubscribed address is not contacted again.
• We send outreach from synosys.email as well as synosys.io. Both are us.

To be removed from all outreach, use the unsubscribe link or email ali@synosys.io.

---

We use cookies and similar technologies for two things:

1. Essential: making the site work, remembering your preferences, and security.
2. Analytics: understanding which pages and articles are read.

Analytics on synosys.io are operated by Synosys. We look at aggregate traffic patterns, not individual visitors, and we do not build advertising profiles from your visit. We do not run third party advertising or retargeting pixels on this site.

You can block or delete cookies in your browser settings. Blocking essential cookies may break parts of the site.

---

We share personal information only with:

• Service providers who help us run the business. These fall into the following categories:

  • Website hosting and application infrastructure
  • Database and file storage
  • Telephony and voice transport for AI intake calls
  • Speech recognition and AI language model processing
  • Calendar and appointment scheduling
  • Customer relationship management and internal notes
  • Business email
  • Payment processing

  We name the specific providers used on your engagement in your service agreement. Clients and prospective clients can request the current list at any time by emailing ali@synosys.io.

• Our clients, where the information was collected on their behalf through an intake agent.

• Professional advisors, such as accountants and lawyers, under confidentiality obligations.

• Authorities, where we are required by law, court order or lawful government request.

• A purchaser, if the business or part of it is sold or merged, subject to appropriate protections.

Every service provider is bound by contract to protect personal information to a standard comparable to ours, and to use it only for the purpose we engaged them for.

---

Some of our service providers are outside Canada. Our voice provider processes calls in the United States. That includes speech to text, text to speech and the AI language model that runs the conversation. This processing happens live, during the call.

While personal information is outside Canada, it is subject to the laws of that country and may be accessible to that country's courts, law enforcement and national security authorities. Ask us if this matters to your engagement and we will confirm in writing which providers touch your data and where.

---

When information is no longer needed for the purpose it was collected for, or for legal requirements, we destroy, erase or anonymize it.

---

We use safeguards proportionate to how sensitive the information is:

• Encryption in transit and at rest
• Access limited to staff who need it to do their job, with individual accounts and multi factor authentication
• Written confidentiality and privacy obligations for all staff and subcontractors
• Vendor review before we connect any new service provider
• Logging and monitoring of access to client and patient data
• Secure destruction of information at the end of its retention period

No system is perfectly secure. If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as PIPEDA requires, and we will keep a record of the incident for at least 24 months. Where personal health information is involved, we notify the health information custodian at the first reasonable opportunity so they can meet their PHIPA obligations.

---

You can:

• Access the personal information we hold about you, and be told how it has been used and who it has been disclosed to
• Correct information that is inaccurate or incomplete
• Withdraw consent, subject to legal and contractual limits
• Ask us to delete information we no longer need
• Challenge our compliance with this policy

Email ali@synosys.io. We respond within 30 days, as PIPEDA requires. If we need more time, we will tell you why and when to expect an answer. There is normally no charge. If a request would be costly, we will give you an estimate first and let you decide.

We may need to verify your identity before releasing information. In limited cases the law requires or permits us to refuse access, for example where it would reveal another person's personal information. If we refuse, we will tell you why and how to challenge it.

Patient health records: contact the clinic or provider, not Synosys. See section 8.

---

Start with us. Email ali@synosys.io with "Privacy Complaint" in the subject line. We will acknowledge it, investigate, and tell you the outcome and what we changed.

If you are not satisfied, you can contact:

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 1-800-282-1376 priv.gc.ca

Information and Privacy Commissioner of Ontario (for personal health information) 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8 1-800-387-0073 ipc.on.ca

---

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal information from children. An AI intake agent may collect information about a minor if a parent or guardian provides it when booking care on their behalf. That information is handled under the client's instructions and, for healthcare, under PHIPA.

---

We may update this policy as our services change or the law changes. The effective date at the top shows the current version. If a change materially affects how we handle information we already hold about you, we will notify you directly where we have a way to reach you.

---

Privacy Officer, Synosys Email: ali@synosys.io Mailing address: Unit 1303, 605 Proudfoot Lane, London, ON N6H 4S2, Canada

We answer privacy questions in plain language. If something here is unclear, ask.