Privacy Policy

Allegro Tests (“Allegro Tests”, “we”, “us”, or “our”) operates Allegro, a cloud-based test management platform for Canadian clinics, and the marketing website located at this domain (the “Site”). This policy explains what personal information we collect through the Site, why we collect it, how we use and protect it, and the choices and rights available to you. It is written to be consistent with Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”), applicable provincial privacy legislation, and, where relevant to visitors located elsewhere, comparable frameworks such as the EU/UK General Data Protection Regulation (“GDPR”) and U.S. state privacy laws. Capitalized terms not defined here have the meaning given in our Terms of Service.

Please read this policy carefully. By using the Site, you acknowledge that you have read and understood it. If you do not agree with our practices, please do not use the Site.

1. Scope of this policy — and what it does not cover

This policy covers personal information collected through the Site — for example, when you submit the contact form, request a demo, or email us directly. It does not cover personal health information or other patient data processed within the Allegro platform by a clinic customer and its staff. That processing is governed by a separate subscription or services agreement between Allegro Tests and each clinic (“Customer Agreement”), under which the clinic remains the custodian, controller, or trustee of its patients' personal health information and Allegro Tests acts solely as its service provider or processor, handling that data only on the clinic's documented instructions and for the purposes set out in the Customer Agreement. If you are a patient of a clinic that uses Allegro, please direct any privacy questions about your own health information to that clinic, not to us.

This policy also does not apply to information collected by any third-party website or service that may be linked from the Site, or to information you provide to a clinic directly rather than to us.

2. Information we collect

2a. Information you provide directly

When you interact with the Site, we may collect:

• Contact and inquiry details you submit through our contact or demo-request form or by emailing us directly, such as your name, work email address, clinic or organization name, and the content of your message. Our contact form opens a pre-filled message in your own email client rather than submitting to a server we control, so this information reaches us only when you send that email, in the same way any other email you send us would.
• Any other information you choose to include in correspondence with us, such as follow-up emails or scheduling replies.

2b. Information collected automatically

When you visit the Site, our hosting and content-delivery infrastructure may automatically generate limited technical information as an ordinary part of serving web pages, such as your IP address, approximate location derived from that IP address, browser type and version, operating system, referring page, pages viewed, and the date and time of your visit. This information is captured in standard server and security logs maintained by our infrastructure providers and is used for the purposes described in Section 3, including keeping the Site secure and diagnosing technical issues. We do not currently combine this log-level data with your identity for marketing purposes.

2c. Cookies and similar technologies

The Site does not set analytics, advertising, or other non-essential cookies as of the date of this policy, and we do not use third-party advertising networks, retargeting pixels, or visitor-identification tools on the Site. If this changes — for example, if we later add privacy-respecting analytics to understand Site performance — we will update this section and, where required by law, seek your consent before doing so. See Section 9 for more detail on cookies.

2d. Information from third parties

We do not purchase or receive marketing lists, lead-enrichment data, or visitor-identification data about Site visitors from data brokers or similar vendors. If you were referred to us by an existing customer or partner, we may receive your name and contact information from that referral source.

We do not sell personal information, and we do not use the Site to collect personal information for cross-context behavioral advertising.

3. How we use information

We use the information described above to:

• Respond to demo requests, inquiries, and support questions;
• Communicate with you about Allegro, including following up on a request you initiated;
• Operate, maintain, and improve the Site;
• Maintain the security, integrity, and proper technical functioning of the Site, including detecting and preventing fraud, abuse, and unauthorized access; and
• Comply with our legal obligations.

We do not use information submitted through the contact form for any purpose beyond responding to your inquiry, unless you separately consent to further communication, consistent with Canada's Anti-Spam Legislation (“CASL”). We do not use it to make any automated decision that produces a legal or similarly significant effect on you.

4. Legal basis for processing

As a Canadian company, our primary authority for collecting, using, and disclosing personal information is Canadian privacy law — principally PIPEDA and applicable provincial statutes, described further in Section 11. Where the GDPR or a similar framework applies to a particular individual, we rely on the following bases: performance of steps you request prior to entering an agreement (e.g., responding to a demo request); our legitimate interests in operating, securing, and improving the Site, where those interests are not overridden by your rights; your consent, where consent is the basis required by law (for example, for any non-essential cookie); and compliance with a legal obligation.

5. How we share information

We do not sell personal information, and we do not share it with third parties for their own independent marketing purposes. We may share the limited information described in Section 2 with:

• Service providers: Companies that host the Site, provide our domain and email infrastructure, or otherwise support our technical operations, acting only on our instructions and only to the extent necessary to provide those services.
• Professional advisors: Lawyers, accountants, and similar advisors, where necessary and subject to confidentiality obligations.
• Law enforcement and legal process: Where required to comply with applicable law, regulation, a valid subpoena or court order, or to protect the rights, property, or safety of Allegro Tests, our users, or others.
• Business transfers: If Allegro Tests is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.
• With your consent: In any other circumstance where you have directed or agreed to the disclosure.

6. Data retention

We keep personal information collected through the Site only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law. As a general guideline:

• Contact and demo-request correspondence is retained for as long as needed to respond to your inquiry and maintain a record of the business relationship, and in any event no longer than three (3) years from your last contact with us, unless you ask us to delete it sooner or a longer period is needed to establish, exercise, or defend a legal claim.
• Server and security logs are retained only for as long as necessary for the security and diagnostic purposes described in Section 2b, typically on the order of weeks, in line with our infrastructure providers' default retention practices.

You may request earlier deletion of your personal information at any time as described in Section 10.

7. Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, use, alteration, or disclosure, including encryption of data in transit between your browser and the Site and restricting access to information on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security safeguards involving personal information collected through the Site that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and any other regulator required by applicable law) without unreasonable delay, in accordance with PIPEDA and applicable provincial breach-notification requirements.

8. Where information is stored and international transfers

Information submitted through the Site is handled using infrastructure located in Canada and, where our hosting or email providers operate infrastructure there, the United States. Where personal information is transferred outside of Canada, it may become subject to the laws of the jurisdiction in which it is held, including lawful requests by government authorities in that jurisdiction. We take reasonable steps to ensure that any such transfer is protected by contractual or other safeguards consistent with PIPEDA's requirements for transfers to service providers.

9. Cookies and tracking technologies

The Site currently uses only cookies or similar local storage that may be strictly necessary for the Site to function (for example, to remember basic display preferences), and does not use advertising, retargeting, or third-party analytics cookies. Most browsers allow you to block or delete cookies through their settings; doing so should not materially affect your ability to browse the Site, since we do not rely on non-essential cookies today. We currently do not respond differently to “Do Not Track” browser signals, as no common industry standard for such signals has been adopted. If we introduce analytics or other non-essential tracking technologies in the future, we will update this section to describe them and, where required, provide a mechanism to accept or decline them.

10. Your privacy rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete personal information;
• Request deletion of personal information we hold about you, subject to any legal obligation we have to retain it;
• Withdraw consent to further contact or processing at any time, subject to legal or contractual restrictions; and
• Complain to us or to the applicable privacy regulator if you believe we have not handled your personal information properly.

To exercise any of these rights, contact us using the details in Section 15. We may ask you to verify your identity before fulfilling a request, and we will respond within the timeframe required by applicable law (generally within 30 days under PIPEDA). If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or the applicable provincial privacy commissioner.

11. Canadian privacy law

As a company operating in Canada, our handling of personal information collected through the Site is governed primarily by:

• PIPEDA, Canada's federal private-sector privacy law, which requires meaningful consent for collection, use, and disclosure of personal information; limits collection to what is reasonably necessary; and gives you the access, correction, and complaint rights described in Section 10.
• Provincial legislation that may apply where you or we are located, including Quebec's Act Respecting the Protection of Personal Information in the Private Sector (as amended by Law 25) and Alberta's and British Columbia's Personal Information Protection Act. Where Law 25 applies, Allegro Tests has designated a person responsible for the protection of personal information, reachable at the contact details in Section 15, and will notify the Commission d'accès à l'information and affected individuals of any breach presenting a risk of serious injury.
• CASL, which governs commercial electronic messages we send. We send marketing or follow-up messages only where you have provided consent (express or implied through an existing inquiry), we identify ourselves and provide our mailing address in each message, and we include a working unsubscribe mechanism honored within 10 business days.

12. Notice to visitors outside Canada (EEA/UK/California and other U.S. states)

Allegro is a Canadian product primarily directed at clinics in Canada, and we do not actively market to individuals located in the European Economic Area, United Kingdom, or elsewhere outside North America. If you access the Site from one of those jurisdictions, we will still honor the rights described in Section 10 to the extent applicable, including any GDPR rights of access, rectification, erasure, restriction, portability, and objection.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and similar statutes in other U.S. states (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) may give you additional rights to know what personal information we collect about you, to request its deletion or correction, and to opt out of its sale or of “sharing” for cross-context behavioral advertising. As noted above, we do not sell personal information and we do not use the Site for cross-context behavioral advertising, so there is currently nothing to opt out of. You may still submit a request under these laws using the contact details in Section 15, and we will respond within the timeframe required by the applicable state law.

13. Children's privacy

The Site is intended for business use by clinic staff and administrators and is not directed at children. We do not knowingly collect personal information through the Site from anyone under the age of 13 (or the applicable minimum age in your jurisdiction). If you believe a child has provided us with personal information, please contact us using the details in Section 15 and we will delete it.

14. Limitation of liability

To the fullest extent permitted by applicable law, and without limiting any rights that cannot be waived under PIPEDA or other mandatory privacy legislation, Allegro Tests's liability arising out of or relating to the collection, use, or disclosure of personal information through the Site is limited as set out in the “Limitation of liability” section of our Terms of Service, which applies equally to claims arising under this Privacy Policy.

15. Contact us

Questions about this policy, or a request to access, correct, or delete your personal information, can be sent to info@allegrotests.ca

16. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The “last updated” date at the top of this page reflects the most recent revision. If we make a material change, we will provide reasonably prominent notice, such as a notice on the Site. Your continued use of the Site after an update takes effect constitutes acknowledgment of the revised policy. We encourage you to review this page periodically.