Tootelo Solutions Inc., the parent company of Telmatik and its divisions Message Express, Bixo and Communication LGP (collectively, “Telmatik”, “we”, “us” or “our”), protects the personal information it processes. This policy explains, in simple terms, what information we collect, why we collect it, with whom we share it, how long we retain it, how we use artificial intelligence (AI), and how you can exercise your rights.

This policy applies to individuals who communicate with the Services, visitors to our websites, users of our portal, and representatives of our clients, partners and suppliers. It does not apply to employee information, which is governed by an internal policy.

1. Definitions 

• Personal information: Any information about an identifiable individual, including information that can identify an individual directly or indirectly. This includes your recorded voice, telephone number and location.
• Client: The business, organisation or municipality on whose behalf Telmatik receives your communication.
• Agent, AI Assistant, Request, Services: These terms have the meanings set out in the Terms of Use.
  ‍

2. Privacy officer

• Privacy officer: François Guérin, Pilot, Telmatik
• Telephone: 450 655-1001
• Email: [email protected] (Care of: François Guérin, Privacy Officer)
• Mailing address: 500 rue d’Avaugour, Suite 2500, Boucherville, Quebec J4B 0G6
  ‍

3. Who is responsible for your personal information

Telmatik has two roles, depending on the situation. 

When Telmatik acts on behalf of a Client, a written agreement requires it to use your personal information only to carry out the mandate, protect it, and return or destroy it at the end of the agreement. The Client’s privacy policy also applies. If you have questions about how the Client uses your personal information, please contact the Client first. 

4. Collected information

Sensitive information. Avoid providing information about your health, your Social Insurance Number or banking information unless it is necessary and expressly requested. As part of the absence management service, a health-related reason for an absence is transmitted to your employer without being analysed by Telmatik. An AI Assistant will never ask you for a password or a full payment card number. 
‍

5. Purpose of use

We use your personal information only to:

• receive, understand, record and forward your communication, and schedule or confirm appointments, in accordance with the Client’s instructions;
• follow the emergency or on-call procedures agreed upon with the Client;
• contact you with reminders or follow-up information;
• verify the accuracy of information, such as whether an address exists;
• ensure quality, train personnel and handle complaints;
• provide our Clients with reports and statistics about their communications;
• improve the Services using de-identified information wherever possible (section 6.5);
• manage our business relationships with Clients and prospective clients, and send them commercial information with their consent;
• ensure the security of the Services and prevent fraud; and
• comply with our legal obligations.

We do not sell your personal information. We do not use information received on behalf of a Client for our own marketing purposes. 
‍

6. Use of artificial intelligence 

6.1 Transparency. When an AI Assistant responds, you are informed at the beginning of the interaction that you are interacting with an AI Assistant and that the communication will be recorded and transcribed.

6.2 What it does. The AI Assistant transcribes your speech, determines the nature of your Request, extracts relevant information and asks you to confirm it. It may validate an address using a geocoding service, generate a summary and suggest responses to the Agent during the interaction.

6.3 Human oversight. The AI Assistant does not make decisions about you based exclusively on automated processing. If such processing were introduced, we would inform you no later than when communicating the decision to you. You would then be entitled to obtain information about the personal information and the principal factors used to make the decision, request corrections to the information and submit observations to a person who can review the decision.

6.4 What it does not do. The AI Assistant does not create a voiceprint or use your voice to identify you. It does not assess your mood or personality for profiling purposes.

6.5 No training of third-party models. Your communications are not used to train our providers’ AI models. To improve the reliability of the Services, authorised personnel may analyse samples of transcripts that have been de-identified wherever possible, but only to the extent permitted by our agreements with Clients.

6.6 Risk assessments. Each AI feature that processes personal information is subject to a privacy impact assessment before being deployed and whenever a significant change is made.
‍

7. Consent 

When you communicate with the Services, your personal information is used to handle your communication after you have been informed of the purposes of use and the recording of the communication. For any other purpose, we obtain the required consent from you or the Client, as applicable, unless an exception under the law applies. Consent to the use of sensitive personal information is obtained expressly.

You may withdraw your consent at any time (section 12). However, doing so may prevent us from handling certain Requests through that channel. If you provide personal information about another person, make sure you are authorised to do so.
‍

8. Disclosure to third parties

We disclose your personal information only when necessary:

• to the Client on whose behalf we receive your communication, or to a person designated by the Client (such as an on-call technician, manager or municipal employee);
• to our service providers, who are bound by written agreements requiring them to protect your personal information and use it only in accordance with our instructions:

• where required or permitted by law, such as in response to a court order or to prevent an act of violence where there is a serious risk of significant bodily harm; or
• in connection with a business transaction (such as a merger or sale of a business), subject to an agreement protecting your personal information.
  ‍

9. Hosting and disclosure outside Quebec 

Your personal information is hosted in Canada:

• Our own databases are hosted in Quebec.
• The Microsoft cloud services we use are hosted in the Canada East region, located in Quebec.

However, certain processing activities take place outside Quebec:

• Conversational artificial intelligence. To respond in real time, the Microsoft AI model that powers our AI Assistant may process conversation content (voice, text and transcripts) in one of the data centres where Microsoft makes this model available, either in Canada or abroad, including in the United States, Europe and Asia. This processing is temporary. Stored data remains in Canada, and Microsoft does not use it to train its models.
• Technical support. Our service providers may occasionally access personal information from outside Quebec to maintain the operation and security of their services.
• Websites. Google, Meta and Cloudflare process browsing data, including in the United States.

Before disclosing personal information outside Quebec, we conduct a privacy impact assessment to verify that the information will receive adequate protection in the destination jurisdiction, and we govern the disclosure through a contractual agreement.
‍

10. Conservation period 

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, after which we securely destroy or anonymise it. For personal information processed on behalf of a Client, the retention period agreed upon with that Client applies. 

11. Security and confidentiality incidents 

We implement security measures appropriate to the sensitivity of the information, including encryption in transit and at rest, multi-factor authentication, role-based access restrictions, access logging, staff training and confidentiality commitments.

In the event of a confidentiality incident (unauthorised access, use or loss), we promptly take steps to reduce the risk of harm and maintain a register of incidents. If an incident presents a risk of serious injury, we notify the Commission d’accès à l’information du Québec and the individuals concerned. If the incident involves a Client’s information, we notify the Client without delay.
‍

12. Your rights

You may submit a written request to the Privacy Officer (section 2) to:

• find out what personal information we hold about you and the purposes for which it is used;
• obtain a copy of your personal information, including any recording or transcript relating to you;
• request the correction of information that is inaccurate, incomplete or ambiguous;
• withdraw your consent or request the deletion of information that no longer needs to be retained;
• request that the dissemination of information cease or that it be de-indexed, where provided for by law;
• obtain your personal information in a structured, commonly used technological format; and
• be informed when automated processing has led to a decision concerning you (section 6.3).

We respond within 30 days. Access is free of charge; reasonable fees may apply for transcription or reproduction. We may ask you to verify your identity.

If your request concerns personal information we hold on behalf of a Client, we forward it to the Client without delay and inform you accordingly, as the Client is responsible for responding to your request.

If you are dissatisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec.
‍

13. Cookies and tracking techologies

Our websites use cookies:

• Essential cookies: Required for the operation and security of our websites, portal and chat service. These are always active.
• Audience measurement cookies (Google Analytics): Used to understand how our websites are used.
• Advertising cookies (Google Ad Manager, Meta): Used to promote our services.

Non-essential cookies are disabled by default and are activated only with your consent. You can change your preferences at any time using the “Manage your consent preferences” link or through your browser settings.

Lone worker protection applications may use your device’s location. This feature is enabled only with your permission, and you are informed of how it works and how to disable it.
‍

14. Children under the age of 14

We do not knowingly collect personal information from children under the age of 14 without the consent of their parent or legal guardian. If you believe a child has provided us with personal information, please contact the Privacy Officer to request its deletion. Only the child’s parent or legal guardian may access or request the correction of the child’s personal information. 
‍

15. Links to third-party websites 

The websites of our Clients or other organisations to which we direct you have their own privacy policies. 
‍

16. Changes made to this policy

The current version of this policy is published on this page, together with its last updated date. Any material change will be clearly identified on the website. If we intend to use your personal information for a new purpose, we will obtain your consent where required by law. Simply continuing to use the Services does not constitute consent to a new purpose. 
‍

17. Provisions specific to municipal services 

This section supplements sections 1 to 16 and applies to personal information that Telmatik processes on behalf of a municipality, a regional county municipality (RCM) or another public body (collectively, a “municipality”), including 311 citizen requests, citizen information services and Message Express alerts.

17.1 Applicable legislation. The municipality is subject to the Act respecting Access to documents held by public bodies and the Protection of personal information. The municipality remains responsible for your personal information, and Telmatik acts as its agent under a written agreement.

17.2 Information collected. For a citizen request: name, callback number, municipality, address or location of the situation, nature of the request, recording and transcript. For Message Express: name, telephone number, email address, address or area, language and alert preferences.

17.3 Use. This information is used solely to process your request on behalf of the municipality or send you its alerts, and to provide the municipality with aggregated statistics. It is never used for other Telmatik Clients or for commercial purposes.

17.4 Retention. The municipality’s records retention schedule applies. At the end of the agreement, Telmatik returns the information to the municipality or destroys it, in accordance with the municipality’s instructions.

17.5 Exercising your rights. Direct your access or correction request to the person responsible for access to documents and the protection of personal information at your municipality. If you submit your request to Telmatik, we will forward it to the municipality without delay.

17.6 Unsubscribing from Message Express. You may unsubscribe at any time (Terms of Use, section 17.6). Your contact information will then be removed from the distribution list.
‍

18. Contact us

If you have any questions, requests or complaints regarding this policy, please contact the Privacy Officer (section 2).

‍