Privacy Policy

Synosys is a business registered in Ontario, Canada. We build and operate AI intake systems for service businesses across London and the Greater Toronto Area.

You can reach the person accountable for privacy at Synosys here:

Privacy Officer, Synosys ali@synosys.io London, Ontario, Canada

If you need to reach us in writing by mail, email us and we will provide a mailing address.

The Privacy Officer is accountable for the personal information under our control and for our compliance with this policy. Direct all privacy questions, access requests and complaints to the address or email above.

---

Your information can reach us in four ways. The rules are different for each, so read the section that applies to you.

1. You visit synosys.io. You are browsing our website, reading a knowledge base article, or using the ROI calculator.
2. You contact us or book an audit. You fill in a form, email us, or book a call.
3. We contact you. You received a business email or a message from us as part of our outreach.
4. You interact with an AI intake agent we built for one of our clients. You called a clinic, a law firm or a brokerage, and our system answered, took your details, or booked your appointment.

In situations 1 through 3, Synosys decides how your information is used. We are responsible for it directly.

In situation 4, our client is responsible for your information, not Synosys. We act as their service provider and, where the client is a healthcare provider, as their agent under PHIPA. We handle your information only on their instructions. Their privacy policy governs. Section 8 explains this in detail.

---

3.1 Website visitors

When you visit synosys.io we collect standard technical information automatically:

• IP address and approximate location (city or region level)
• Browser type, device type and operating system
• Pages viewed, time on page, and the link or search that brought you here
• Cookie and analytics identifiers

We do not require you to identify yourself to read our site.

3.2 People who contact us or book an audit

When you submit a form, email us, or book a free audit, we collect:

• Name, business name and job title
• Email address and phone number
• Information about your business that you choose to share, such as call volume, current intake process, software you use, and the problem you want solved
• Notes from our calls and meetings with you
• ROI calculator inputs, if you choose to send them to us

3.3 Prospects we reach out to

For business development we collect and use business contact information from public and commercial sources, including company websites, professional directories, public licensing registries, LinkedIn, and licensed data providers. This is typically:

• Name, job title, business name
• Business email address, business phone number and business address
• Publicly available information about the business, such as practice area, location and size

We use this to decide whether our service is a fit for your business before we contact you.

3.4 Clients and client staff

If you become a client we also collect billing details, account credentials needed to run the service, records of support requests, and configuration information about your intake workflow.

3.5 Callers and end users of an AI intake agent

When our system handles a call, chat or form on behalf of one of our clients, it may collect:

• Your name, phone number and email address
• The reason for your call and what you say during it
• Appointment details, availability and preferences
• Call audio recordings and written transcripts
• Call metadata such as time, duration and outcome
• For healthcare clients, personal health information, which can include your health card number, symptoms, provider name, and appointment type

This information belongs to our client. Section 8 explains what we can and cannot do with it.

---

We collect personal information for these purposes and no others:

If we ever want to use your information for a new purpose, we will identify that purpose and get your consent first, unless the law allows or requires otherwise.

We do not sell personal information. We do not rent or trade contact lists.

---

We get your consent before we collect, use or disclose your personal information, except where PIPEDA allows collection without consent, such as business contact information used to communicate with you in your professional role, or where a legal or regulatory obligation applies.

Your consent can be express, for example when you fill in a form or agree at the start of a recorded call, or implied, for example when you continue a call after being told it is recorded and why.

You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Email ali@synosys.io. If withdrawing consent means we can no longer provide a service, we will tell you before it takes effect.

---

This section matters most, so we are being specific.

We disclose that the agent is AI. Our AI intake agents identify themselves as an automated or AI assistant at the start of the interaction. We do not build agents that claim to be human.

We tell you before we record. Callers are informed at the beginning of the call that the call may be recorded or transcribed, and why. If you continue the call after that notice, your consent is implied. This follows Office of the Privacy Commissioner of Canada guidance on recording customer calls.

You can decline. If you do not want to be recorded or do not want to speak with an AI agent, say so. The call will be transferred to a human, or you will be given another way to reach the business, such as a callback, an online form, or attending in person. Our clients configure this escalation path and we require one to exist.

Limited use. Recordings and transcripts are used only for the purposes named in section 4. We do not use client call content to train general purpose or third party AI models. Where we use call data to improve agent performance, it is used only for that client's agent, under that client's instructions.

Access. You can ask for a copy of a recording of your own call. Requests go to the business you called. See section 11.

---

Our AI agents capture information, answer questions, qualify enquiries and book appointments. They do not make final decisions about your eligibility for care, legal representation, credit, housing or employment. Those decisions are made by the business you contacted. If an agent cannot handle your request or you ask for a person, it escalates to human staff.

---

When we provide intake services to a clinic, medical practice or other health information custodian in Ontario:

• The custodian is responsible for your personal health information. Synosys is not the custodian. We act as an agent of the custodian under PHIPA section 17 and as an electronic service provider under PHIPA and Ontario Regulation 329/04.
• We collect, use, retain and disclose personal health information only as necessary to provide the service, and only on the custodian's instructions and with their authorization. We do not use it for our own purposes.
• We do not disclose personal health information to anyone other than the custodian, except where the custodian directs us to or the law requires it.
• Our staff and any subcontractor with access are bound by the same restrictions in writing.
• We keep and can produce, on the custodian's request, a record of the personal health information we handle on their behalf.
• If personal health information in our care is lost, stolen or accessed without authorization, we notify the custodian at the first reasonable opportunity. The custodian is responsible for notifying affected individuals and the Information and Privacy Commissioner of Ontario.
• We provide the custodian with a written description of our services and safeguards, and we perform privacy and security assessments as required.

If you are a patient and want access to, or correction of, your health information, contact the clinic or provider directly. We will support them in responding, but we cannot release their records to you ourselves.

---

If you received a commercial email from Synosys:

• We sent it under express consent, or under implied consent permitted by CASL, such as an existing business relationship or a business email address that was conspicuously published without a statement refusing such messages, and where the message is relevant to your role.
• Every message identifies Synosys, includes our contact information, and includes a working unsubscribe link.
• Unsubscribe requests are honoured within 10 business days, as CASL requires, and usually immediately.
• We keep a suppression list so an unsubscribed address is not contacted again.
• We send outreach from synosys.email as well as synosys.io. Both are us.

To be removed from all outreach, use the unsubscribe link or email ali@synosys.io.

---

We use cookies and similar technologies for two things:

1. Essential: making the site work, remembering your preferences, and security.
2. Analytics: understanding which pages and articles are read.

Analytics on synosys.io are operated by Synosys. We look at aggregate traffic patterns, not individual visitors, and we do not build advertising profiles from your visit. We do not run third party advertising or retargeting pixels on this site.

You can block or delete cookies in your browser settings. Blocking essential cookies may break parts of the site.

---

We share personal information only with:

• Service providers who help us run the business. These fall into the following categories:

  • Website hosting and application infrastructure
  • Database and file storage
  • Telephony and voice transport for AI intake calls
  • Speech recognition and AI language model processing
  • Calendar and appointment scheduling
  • Customer relationship management and internal notes
  • Business email
  • Payment processing

  We name the specific providers used on your engagement in your service agreement. Clients and prospective clients can request the current list at any time by emailing ali@synosys.io.

• Our clients, where the information was collected on their behalf through an intake agent.

• Professional advisors, such as accountants and lawyers, under confidentiality obligations.

• Authorities, where we are required by law, court order or lawful government request.

• A purchaser, if the business or part of it is sold or merged, subject to appropriate protections.

Every service provider is bound by contract to protect personal information to a standard comparable to ours, and to use it only for the purpose we engaged them for.

---

Our databases are located in Canada. Client records, call transcripts, appointment data and any personal health information we hold on behalf of a custodian are stored on Canadian infrastructure.

Two processing steps happen outside Canada. Speech to text and text to speech are performed on United States regional infrastructure, and AI language model inference is performed by our model provider. In both cases the information is processed in memory only for the moment needed to produce a response, it is not retained by those providers, and it is never used to train their models. The result is written back into our Canadian databases.

While personal information is outside Canada, it is subject to the laws of that country and may be accessible to that country's courts, law enforcement and national security authorities. For healthcare clients we can restrict processing to Canadian regions where the provider supports it. Ask us if this matters to your engagement and we will confirm in writing which providers touch your data and where.

---

When information is no longer needed for the purpose it was collected for, or for legal requirements, we destroy, erase or anonymize it.

---

We use safeguards proportionate to how sensitive the information is:

• Encryption in transit and at rest
• Access limited to staff who need it to do their job, with individual accounts and multi factor authentication
• Written confidentiality and privacy obligations for all staff and subcontractors
• Vendor review before we connect any new service provider
• Logging and monitoring of access to client and patient data
• Secure destruction of information at the end of its retention period

No system is perfectly secure. If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as PIPEDA requires, and we will keep a record of the incident for at least 24 months. Where personal health information is involved, we notify the health information custodian at the first reasonable opportunity so they can meet their PHIPA obligations.

---

You can:

• Access the personal information we hold about you, and be told how it has been used and who it has been disclosed to
• Correct information that is inaccurate or incomplete
• Withdraw consent, subject to legal and contractual limits
• Ask us to delete information we no longer need
• Challenge our compliance with this policy

Email ali@synosys.io. We respond within 30 days, as PIPEDA requires. If we need more time, we will tell you why and when to expect an answer. There is normally no charge. If a request would be costly, we will give you an estimate first and let you decide.

We may need to verify your identity before releasing information. In limited cases the law requires or permits us to refuse access, for example where it would reveal another person's personal information. If we refuse, we will tell you why and how to challenge it.

Patient health records: contact the clinic or provider, not Synosys. See section 8.

---

Start with us. Email ali@synosys.io with "Privacy Complaint" in the subject line. We will acknowledge it, investigate, and tell you the outcome and what we changed.

If you are not satisfied, you can contact:

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 1-800-282-1376 priv.gc.ca

Information and Privacy Commissioner of Ontario (for personal health information) 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8 1-800-387-0073 ipc.on.ca

---

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal information from children. An AI intake agent may collect information about a minor if a parent or guardian provides it when booking care on their behalf. That information is handled under the client's instructions and, for healthcare, under PHIPA.

---

We may update this policy as our services change or the law changes. The effective date at the top shows the current version. If a change materially affects how we handle information we already hold about you, we will notify you directly where we have a way to reach you.

---

Privacy Officer, Synosys Email: ali@synosys.io Location: London, Ontario, Canada

We answer privacy questions in plain language. If something here is unclear, ask.