Privacy Policy

1. Purpose and Scope

This policy applies to BraveHeart First Aid Incorporated and all training and services delivered by us. It explains how we collect, protect, and use personal information for learners, clients, contractors, and employees in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial statutes.

Our designated Privacy Officer is the Owner/CEO, Eli Castson, who oversees an annual review of these practices every June, or sooner if required by legislation or certification-body requirements.

2. Personal Information We Collect

We collect several categories of personal information:

• Identification — Names, course-certificate numbers, course rosters, and enrollment forms.
• Contact Details — Email addresses, phone numbers, and mailing addresses.
• Training Data — Course types, completion status, assessment results, and expiry/recertification dates.
• Payment Information — Payment processing is handled by a PCI-compliant gateway. We do not store full credit card numbers.
• Accessibility/Medical Notes — Optional information provided by learners for accommodation purposes.
• Employment Data — Information related to staff and contractors, such as resumes and police-records checks.
• AED Applications: For our Holiday4Hearts campaign, the organization’s name, the applicant’s name, role, email address and phone number, and what they tell us about the space where the AED would go. We do not ask for health information about anyone.

We do not intentionally collect information from children under 13 without parental or guardian consent.

3. How We Use Your Information

• Deliver Services — Registering learners, verifying prerequisites, issuing certificates, and sending recertification reminders.
• Legal and Compliance — Meeting requirements for certification bodies, insurance audits, incident reporting, and mandatory record-keeping.
• Operations — Processing payments and refunds.
• AED Applications: Reviewing applications and choosing the recipient. BraveHeart staff running the campaign read each application, in our email and in the campaign’s Google Sheet. We do not publish applications, and we name the chosen organization only with its permission.

4. Consent

We obtain meaningful consent before collecting, using, or disclosing personal information. By registering for a course or service, you consent to the collection and use of your information as described in this policy. You may withdraw your consent at any time by contacting the Privacy Officer, subject to legal or contractual obligations.

5. Third-Party Sharing

We utilize third-party providers for services such as booking systems, payment processing, and email delivery. We maintain data-processing agreements to ensure these providers maintain secure data storage.

We also advertise with Google Ads and Meta (Facebook and Instagram). Their tags and server-side conversion tools share your website activity and your completed orders with Google and Meta so that we can measure which advertising works. We also use PostHog (hosted in the United States) for website analytics and masked session replay to improve the booking flow. Section 9 sets out what is sent to each service.

No cross-border transfer of data occurs unless the third-party provider offers safeguards equivalent to PIPEDA and adheres to contractual Standard Contractual Clauses.

6. Data Retention

We follow a specific retention schedule based on the type of record:

Once the retention period expires, digital files are irretrievably erased and paper records are cross-shredded and pulped.

7. Security Safeguards

We employ physical, administrative, and technical measures to protect your data:

• Physical — Locked filing cabinets and controlled office entry.
• Administrative — Role-based access and confidentiality agreements for staff and contractors.
• Technical — AES-256-encrypted cloud storage, TLS 1.3 transport encryption, multi-factor authentication on admin accounts, and daily off-site backups.

8. Breach Notification

Our incident response plan includes a procedure to provide breach notification within 72 hours to affected individuals and the Office of the Privacy Commissioner of Canada where required.

9. Cookies and Advertising

This website uses session cookies to keep your cart and your registration working. You can block or delete cookies in your browser settings without affecting course registration.

We advertise with Google Ads and Meta (Facebook and Instagram). The Google tag and the Meta pixel run on our public pages (never on private booking-management, waitlist-leave, or staff pages). They set advertising cookies and report the pages you visit, booking steps such as viewing a course or starting checkout, and whether you complete an order, including the order number and the amount before tax, so we can tell which advertisements lead to registrations.

When you complete an order, your email address is converted into a one-way SHA-256 hash inside your browser and sent to Google and Meta. When payment is confirmed on our server, your email address, name, phone number, and country (Canada) are converted into one-way SHA-256 hashes on our server and sent—along with the order number, the amount before tax, and any Meta click or browser cookie identifiers as they are (which identify the advertisement click and the browser, not you)—to Meta’s Conversions API, so a completed registration can be matched to an earlier advertisement. Neither Google nor Meta receives a readable copy of your contact details this way.

We use PostHog (hosted in the United States) to measure how visitors use our course finder and checkout. PostHog records which pages and course dates visitors view, browser performance metrics, and masked recordings of the booking flow. All form inputs and learner or buyer summary text are masked (***), and we never send learner or buyer names, email addresses, or phone numbers to PostHog.

If you reach this site from an advertisement or a campaign link, we store the click and campaign identifiers carried in that link and keep them with your order, so we can tell which advertising is working. Those identifiers describe the advertisement, not you.

10. Your Rights

You have the right to request access to, correction of, or deletion of your personal information.

• Submit a written request to our Privacy Officer.
• We will verify your identity and respond within 30 days.
• Corrections are made promptly. Deletion requests are honored, except where records are legally required to be retained by law or certification-body requirements.