Privacy Policy
Last updated October 2026
Draft for legal review
This policy is a starting template aligned with PIPEDA and must be reviewed by counsel before launch.
What we collect
Account details (name, email, phone), employer details, plan membership, dependants you add, bank details for reimbursements, claims, receipts and related health information, and technical logs.
Why we collect it
To run your Health Spending Account: verifying eligibility, deciding and paying claims, billing employers, preventing fraud, meeting legal and tax obligations, and supporting you.
Who sees it
Plan members see their own information. Claims reviewers (people and automated systems) see receipts to decide claims. Employers see member names, plan limits, amounts and categories, but not receipts or medical details. Partners see client-level totals. Service providers (hosting, email, payments, AI document reading) process data on our behalf under contract.
AI processing
We use automated tools, including AI models, to read receipts and help decide claims. People review exceptions, and you can ask for a human review of any decision.
Security
Data is encrypted in transit and at rest. Bank account numbers are encrypted separately. Access is role-based and logged.
Retention
We keep claim records for at least seven years to meet CRA requirements, then delete or anonymise them.
Your rights
You can ask to access or correct your information, or withdraw consent where the law allows, by writing to info@hsabenefits.ca.
Contact
Privacy Officer, HSA Benefits · info@hsabenefits.ca