CarbonFibre Financial Inc.
Email: privacy@carbonfibrefinancial.ca
Website: carbonfibrefinancial.ca
1. Introduction
CarbonFibre Financial Inc. (“CarbonFibre”, “we”, “us”, or “our”) operates the CarbonFibre PHSP platform at app.carbonfibrefinancial.ca. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use our platform to establish and manage a Private Health Services Plan (“PHSP”) under the Income Tax Act (Canada).
By creating an account or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the platform.
2. Information We Collect
2.1 Account & Identity Information
When you register, we collect your name, email address, and authentication credentials. If you sign in with Google, we receive your Google profile name and email. For corporation setup we also collect your business legal name, business number, registered address, and administrator contact details.
2.2 Health Expense & Claims Data
To adjudicate PHSP claims, we collect receipts, expense descriptions, provider details, and amounts. Receipts may contain health-related information. We treat all claims data as sensitive personal health information.
2.3 Financial Information
We collect bank account details solely for the purpose of processing reimbursements to plan beneficiaries. Payment processing is handled through secure, PCI-compliant third-party providers.
2.4 Usage & Technical Data
We automatically collect IP addresses, browser type, device information, and usage patterns to maintain security, prevent fraud, and improve the platform. We use session cookies and authentication tokens; we do not use third-party advertising trackers.
3. How We Use Your Information
We use personal information to provide, maintain, and improve the CarbonFibre PHSP platform, including: processing and adjudicating health expense claims; verifying plan eligibility and CRA compliance; processing reimbursements; communicating with you about your account, claims, and plan status; generating audit-ready records as required by the Canada Revenue Agency; and protecting against fraud, unauthorized access, and abuse.
4. Data Sharing & Disclosure
We do not sell your personal information. We may share information with: authorized adjudicators who review claims on behalf of your plan; financial institutions for processing reimbursements; the Canada Revenue Agency or other government bodies when required by law or during a CRA audit; service providers who assist with hosting, email delivery, and platform operations (subject to confidentiality agreements); and as required to comply with legal obligations, enforce our terms, or protect rights and safety.
5. Data Residency & Security
All personal information, health data, and uploaded documents are stored exclusively in AWS data centres located in Canada (ca-central-1, Montreal). Your data never leaves Canadian jurisdiction.
We implement industry-standard security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), multi-factor authentication, role-based access controls, and append-only audit logging. Bank account changes are subject to a cooling-off period to protect against unauthorized modifications.
6. Data Retention
We retain PHSP records, claims data, and audit logs for a minimum of seven (7) years following the end of the plan year in which they were created, in accordance with CRA record-keeping requirements under the Income Tax Act. You may request deletion of your account, but we are legally required to retain certain records for the mandatory retention period.
7. Your Rights
Subject to applicable law and our legal retention obligations, you have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; request deletion of your personal information (where not subject to mandatory retention); withdraw consent for optional communications at any time; and receive a copy of your data in a portable format.
To exercise any of these rights, contact us at privacy@carbonfibrefinancial.ca.
8. Cookies & Similar Technologies
We use strictly necessary cookies and short-lived authentication tokens for session management. We do not use advertising cookies, social media trackers, or analytics cookies that track you across other websites.
9. Children’s Privacy
Our platform is intended for use by incorporated professionals and their authorized representatives. We do not knowingly collect personal information from individuals under 18. Dependent information submitted as part of a PHSP claim is collected and managed by the plan holder.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the platform or by email. Your continued use of the platform after changes take effect constitutes acceptance of the revised policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at:
© 2026 CarbonFibre Financial Inc. All rights reserved.