Privacy Policy

Last updated October 8, 2026 · Vanguard Health Systems [legal name and business number once registered]

Who we are and what Vanguard does

Vanguard is software that Ontario applied behaviour analysis (ABA) and developmental services agencies use to schedule their teams, track credentials and BACB supervision, pay workers and invoice families. Agencies, their workers and the families they serve sign in to Vanguard.

Who is responsible for your information

The agency you work for or receive services from decides what information goes into Vanguard and why. Under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), the agency is usually the health information custodian. Vanguard acts for the agency as its agent and electronic service provider: we store and process information only to provide the service to that agency, and we don’t use it for our own purposes. Questions about your records, and requests to see or correct them, should normally go to your agency first. We will help the agency respond.

For account information that Vanguard holds itself, such as an agency owner’s sign-in details and billing contact, Vanguard is responsible under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

What we store

• Accounts: name, email address, role, and an encrypted password (we can’t see it). If you turn on two-step sign-in, a code secret for your authenticator app.
• Team members: job role, availability and preferences, credential types and expiry dates, uploaded credential documents, BACB certification number and expiry, pay rate, and for contractors an optional mailing address and HST number.
• Clients (children receiving services): name or initials, age group, scheduling needs (days, times, outing distance, support needs such as hygiene assistance), preferred workers, and guardian name and email. Families may add a phone number and short logistics notes.
• Scheduling and service records: shifts, who worked them, check-in and check-out times, whether the family confirmed a session, cancellations and no-shows.
• Supervision records: date, length, type and modality of each BACB supervision contact, and who took part.
• Money: worker invoices and timesheets, mileage claims, family invoices, payments recorded by the agency, and funding programs (for example OAP or Passport) with budgets.
• Technical: sign-in events, and records of unexpected app errors (the error message, the page, and your browser type, never form contents). Error records are deleted after 90 days.

What Vanguard is not for: clinical information. Vanguard is not a clinical record. It has no place for diagnoses, treatment plans, session notes or behaviour data, and agencies are told not to enter them in any notes field.

How information is used

• To provide the service the agency signed up for: scheduling, reminders, credential and supervision tracking, pay and invoicing.
• To send notifications. Email subjects never include a child’s name or care details. Families receive invoices for their own child only.
• To keep the service secure and working: preventing misuse and fixing errors.

We don’t sell information, use it for advertising, or use agency data to train artificial intelligence models.

Who can see what

Each agency’s information is kept separate from every other agency’s by rules enforced inside the database, not just in the app. Within an agency, access depends on role. The owner sees everything. Admins and schedulers see only the areas their level allows. Workers see their own shifts, pay and the clients they’re assigned to. Families see their own child’s schedule and invoices.

Where information is stored, and service providers

When information is handled outside Canada, it is subject to the laws of that country. We choose providers with strong security and contracts that limit how they use data.

Security

• Encrypted connections (HTTPS) everywhere, and encryption of stored data by our database provider.
• Database-level separation between agencies, and role-based access within each agency.
• Optional two-step sign-in. Once it’s on, a password alone can’t open any agency data.
• Private document storage. Files open only through links that expire after two minutes.
• Supervision records can be voided with a reason but are never deleted, so the audit trail stays complete.

If a privacy breach affects your information, we will notify the agency without delay so it can meet its own obligations, including notifying affected people and Ontario’s Information and Privacy Commissioner where PHIPA requires it.

How long information is kept

Information is kept while the agency uses Vanguard. Agencies decide their own retention, for example BACB supervision documentation is typically kept for at least 7 years. An agency owner can export everything at any time, and can close the agency, which permanently deletes its records, files and logins. Workers and family members can delete their own login. Records the agency must keep, such as shifts worked or invoices, stay with the agency. Error records are deleted after 90 days.

Your choices and rights

• Ask your agency to see or correct the information it holds about you or your child.
• Turn email notifications off in Vanguard (in-app notifications stay on).
• Delete your login from My account.
• Contact us with any privacy question or complaint, or contact the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada.

Contact

Privacy officer: [name] · [privacy email, e.g. privacy@vanguardhealthsystems.com] · Vanguard Health Systems, [mailing address], Ontario, Canada.

Changes

We will post changes here and tell agency owners in the app before a material change takes effect.