Skip to main content
BP
Sign InCheck Eligibility
Back to home

Legal

Privacy Policy

BenefitPath.ca - Operated by 14622472 Canada Inc.

Last updated: March 30, 2026

The Short Version

Your disability and health information stays private. We never sell your data. We never share your personal or medical details with advertisers or data brokers. We use your scan answers only to show you which government benefits you may qualify for. Your data is stored on servers in Canada. We use AI to generate suggestions - these are not medical, legal, or tax advice, and you should always verify AI-generated content before using it. You can download or delete all your data at any time from your Account Settings.

1. Who We Are

BenefitPath.ca (“we,” “us,” “our”) is operated by 14622472 Canada Inc., a Canadian corporation based in Ontario. Benefit Path is a web-based information tool that helps Canadians discover and navigate federal and provincial disability benefits. We are not a law firm, accounting firm, medical practice, or licensed financial advisory service.

BenefitPath operates in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where applicable, we also comply with substantially similar provincial privacy legislation, including Ontario's Personal Health Information Protection Act (PHIPA), Quebec's Law 25 (Act Respecting the Protection of Personal Information in the Private Sector), Alberta's Personal Information Protection Act (PIPA), and British Columbia's Personal Information Protection Act (PIPA).

2. What Information We Collect

2.1 Eligibility Scan Data (Before Account Creation)

When you complete the eligibility scan, you provide answers to 13 questions including your province of residence, age, areas of daily life affected by your condition, whether your condition has lasted 12 months or more, your current Disability Tax Credit status, whether you file taxes, your approximate income range, whether you receive provincial disability support, whether you receive life-sustaining therapy, your family status, and whether you have contributed to the Canada Pension Plan.

Before you create an account, this data is stored locally on your device only (in your browser's localStorage). It is not transmitted to or stored on our servers. If you close your browser or clear your browser data, this information is deleted permanently.

2.2 Account Information

If you create an account, we collect your email address, a password (stored in encrypted/hashed form - we cannot see your password), and the scan answers described above (which are then stored on our servers). We do not collect your name, Social Insurance Number (SIN), physical address, or phone number unless you voluntarily provide them in an AI Chat conversation, which we strongly discourage.

2.3 Payment Information

Payment processing is handled entirely by Stripe, Inc. When you make a payment, your credit card or payment details are collected and processed by Stripe on their secure servers. We do not receive, store, or have access to your full credit card number. We receive only a confirmation of payment, the amount paid, and a Stripe customer identifier for the purpose of managing your subscription tier.

2.4 AI Chat and Language Coach Data

When you use the AI Chat or Language Coach features, the text you enter is sent to Anthropic's API (the provider of the Claude AI model) for processing. Anthropic processes this data to generate a response and does not use your inputs to train their models. We store a record of your AI interactions (the questions you asked and the responses generated) on our servers to maintain your conversation history and improve the service. We do not store the content of AI conversations in our analytics or funnel tracking systems.

2.5 Analytics Data

We use self-hosted, open-source analytics (Umami) and built-in hosting analytics (Vercel Web Analytics) to understand how visitors use our website. These analytics tools are cookieless and do not collect personally identifiable information. They track aggregate data such as page views, referral sources, device types, and general geographic location (country/province level, not precise location). We also track anonymous funnel events (such as which scan questions were completed) using session identifiers stored in your browser's localStorage. These session identifiers are not linked to your personal identity unless you create an account.

We do not use Google Analytics, Facebook Pixel, or any advertising tracking tools. We do not serve advertisements. We do not sell, rent, or share your data with advertisers or data brokers.

3. How We Use Your Information

We use your information solely for the following purposes: to provide you with personalized benefit eligibility results based on your scan answers; to generate your personalized benefits roadmap and application guidance; to power the AI Chat and Language Coach features with relevant context about your situation; to process your payment and manage your subscription tier; to track your benefit application progress and deadlines; to send you deadline reminders and important notifications (with your consent); to analyze aggregate, anonymized usage patterns to improve the service; and to comply with applicable Canadian law.

We do not use your information for advertising, profiling, automated decision-making that produces legal effects, or any purpose not described in this policy.

4. Where Your Data Is Stored

Your personal data is stored on servers located in Canada (Supabase, ca-central-1 Montreal region). Our analytics data is stored in a separate database also hosted in Canada. Our website is hosted on Vercel, which processes requests through their global edge network but stores application data in our Canadian database.

When you use AI-powered features (Chat and Language Coach), your input text is transmitted to Anthropic's API for processing. Anthropic may process this data on servers located in the United States. We have reviewed Anthropic's data handling practices and are satisfied that they provide a comparable level of protection as required under PIPEDA Principle 4.1.3. Anthropic does not use customer inputs to train their AI models.

Payment data is processed and stored by Stripe, Inc. on their secure infrastructure. Stripe is PCI DSS Level 1 compliant, the highest level of payment security certification.

5. Third-Party Service Providers

We use the following third-party services to operate BenefitPath. Under PIPEDA, we remain accountable for your personal information when it is being processed by these third parties.

  • Supabase: Database hosting and user authentication. Data stored in Montreal, Canada (ca-central-1 region).
  • Anthropic:AI processing for Chat and Language Coach features. Data processed on Anthropic's infrastructure (may include US servers). Anthropic does not train on customer data.
  • Stripe: Payment processing. PCI DSS Level 1 compliant. We do not receive or store your full payment card details.
  • Vercel: Website hosting and serverless functions. Edge network with Canadian points of presence.
  • Upstash: Rate limiting service to protect against abuse. Processes only IP addresses (hashed) and request counts, not personal data.

We do not share your personal information with any other third parties except as required by Canadian law (for example, in response to a valid court order or legal process).

6. Your Rights Under PIPEDA

Under PIPEDA and applicable provincial privacy legislation, you have the following rights.

  • Right to access:You can request a copy of all personal information we hold about you. Use the “Download my data” feature in Account Settings to receive a JSON export of your data at any time.
  • Right to correction: You can update or correct your personal information through your Account Settings at any time.
  • Right to deletion:You can delete your account and all associated data using the “Delete account” feature in Account Settings. Upon deletion, we permanently remove your profile, scan results, benefit progress, AI conversation history, and all other personal data from our servers. Analytics data that has already been anonymized cannot be attributed back to you and will not be deleted.
  • Right to withdraw consent: You can withdraw your consent to our collection and use of your personal information at any time by deleting your account. Note that withdrawing consent means we can no longer provide the service to you.
  • Right to complain: If you believe we have not handled your personal information appropriately, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or by calling 1-800-282-1376.

Key PIPEDA rights at a glance

You can access, correct, download, and delete your data through your account settings. If you believe we handled your information improperly, you can also contact the Office of the Privacy Commissioner of Canada.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we permanently delete your personal data from our production database within 30 days. Backup copies may persist for up to 90 days after deletion, after which they are permanently purged.

Anonymized, aggregate analytics data (which cannot be attributed to any individual) is retained indefinitely to help us improve the service.

If you complete the eligibility scan but do not create an account, no personal data is stored on our servers. Your scan answers remain in your browser's localStorage until you clear your browser data.

8. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include: encryption of data in transit (TLS/HTTPS) and at rest; row-level security (RLS) policies ensuring users can only access their own data; server-side authentication and authorization for all API endpoints; rate limiting to prevent abuse; secure handling of API keys and secrets (never exposed to client-side code); and regular security audits of our access control policies.

No method of electronic storage or transmission is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

9. Children's Privacy

BenefitPath is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. The eligibility scan may be completed by a parent or guardian on behalf of a child with a disability for the purpose of assessing the child's eligibility for the Child Disability Benefit and related programs. In such cases, the parent or guardian is the user of the service and is responsible for the information provided.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will notify you by posting a prominent notice on the website and, if you have an account, by sending a notification to your registered email address. The “Last updated” date at the top of this policy indicates when it was most recently revised.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights under PIPEDA, please contact us at:

14622472 Canada Inc.

Email: privacy@benefitpath.ca

You may also file a complaint with the Office of the Privacy Commissioner of Canada: priv.gc.ca | 1-800-282-1376