Crisis Response Companion

Privacy Policy

Effective date:: October 1, 2026
Operator:: CounterStress Solutions Inc.
Contact:: privacy@crcompanion.ca
Terms of Use:: crcompanion.com/terms

Definitions

The following terms have defined meanings throughout this document:

“Operator,” “we,” “us,” or “our” means CounterStress Solutions Inc.

“Crisis Response Companion” means the AI-powered tool provided by the Operator.

“CISM” means Critical Incident Stress Management, a structured approach to preventing and mitigating the negative effects of critical incident stress for individuals and groups.

“ICISF” means the International Critical Incident Stress Foundation, the organization that provides training, education, and guidance related to CISM.

“Authorized organizational users” means adults employed by or volunteering with organizations that have been granted access to Crisis Response Companion and who hold appropriate training or roles for its intended purposes.

“Policy” means this Privacy Policy, as updated from time to time.

“Prompt” means data entered into Crisis Response Companion by a user to receive an output or response.

“You” or “user” means any individual who accesses or uses Crisis Response Companion, whether on their own behalf or on behalf of an organization.

1. Introduction

CounterStress Solutions Inc. (“Operator”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal information in accordance with applicable Canadian privacy laws. This Privacy Policy explains how we collect, use, disclose, store, retain, and protect personal information when you access or use Crisis Response Companion, including any website, mobile application, web application, or related tool we operate.

Crisis Response Companion uses artificial intelligence to provide information about psychological first aid, crisis intervention and peer support, response suggestions, reflective prompts, or similar outputs. Crisis Response Companion does not invite or solicit sensitive personal information, including mental-health-related information.

Crisis Response Companion is not intended to receive directly identifying health, mental-health, critical-incident, or third-party information. However, because users may voluntarily include such information in prompts, it may be processed as described in this Policy. Users should provide only the minimum information necessary and should remove names and other identifying details.

This Privacy Policy should be read together with our Terms of Use, disclosures, and any crisis or professional-use notices presented in Crisis Response Companion.

2. Who this policy applies to

This Privacy Policy applies to:

Individuals using Crisis Response Companion for themselves.
Instructors, responders, helpers, professionals, organizations, or authorized personnel using Crisis Response Companion to support others.
Visitors to our website or app.
Account holders, trial users, organizational administrators, and support contacts.

If you use Crisis Response Companion on behalf of an organization, your organization may also have its own privacy, confidentiality, or data-governance obligations that apply in addition to this Privacy Policy.

3. Contact information and privacy officer

If you have questions, concerns, or requests about this Privacy Policy or our privacy practices, please contact:

CounterStress Solutions Inc., Privacy Officer Name: Steven Horner Email: privacy@crcompanion.ca

Canadian privacy law requires organizations to be accountable for personal information under their control and to establish a way for individuals to ask questions or challenge compliance.

4. What personal information we collect

We may collect and store information that you enter into Crisis Response Companion, as described below.

A. Information you provide voluntarily and directly to us such as:

Name, display name, username, or account identifier.
Email address, phone number, or other contact details.
Account credentials or authentication information.
Profile information you choose to provide.
Messages, prompts, responses, reflections, or other content you enter into Crisis Response Companion.
Information you provide when contacting support or submitting a request.
Payment or billing information, if applicable, which may be processed by a third-party payment provider rather than directly by us.

B. Sensitive information you provide directly and voluntarily while using Crisis Response Companion such as:

Crisis response-related information, occupational stress disclosures, peer support reflections, CISM-related reflections or planning content, emotional wellbeing narratives, secondary trauma disclosures, and similar sensitive information entered by users in the course of using Crisis Response Companion.
Information about another person, if entered by you as a helper, instructor, or professional.
Crisis Response Companion may also collect information that users voluntarily disclose about critical incident exposure, traumatic event experiences, occupational health status, or professional role information in the course of engaging with Crisis Response Companion.

C. Technical and usage information

Device type, operating system, browser type, app version, IP address, language settings, session identifiers, and log data.
Usage information, such as features used, time spent, clicks, timestamps, referral pages, and general interaction data.
Cookie, analytics, or similar technology data collected through the website or app, where applicable.

D. Organizational or administrative data

Organization name, team role, subscription details, and administrator instructions, if Crisis Response Companion is provided through an organization.
Audit and access records, where necessary for security, billing, compliance, or support.

Canadian privacy law treats personal information broadly and includes subjective information and inferences about identifiable individuals. Canadian AI guidance also states that inferences about an identifiable individual generated through AI should be treated as personal information.

Crisis Response Companion cannot determine if you have the right to enter identifiable information about third parties or what portion(s) of that information may be lawfully or ethically entered by you.

If identifiable information about another person is submitted contrary to the Terms of Use, it may still be processed and stored under this Privacy Policy until it is deleted, de-identified, or otherwise addressed.

5. How we collect personal information

We collect personal information:

Directly from you when you create an account, enter prompts, use app features, contact us, or otherwise interact with Crisis Response Companion.
Automatically through your use of Crisis Response Companion, including through logs, analytics, cookies, and similar technologies, where used.
From your organization, if your access is provided through an employer, program, school, support organization, or other authorized entity.
From third-party service providers that support authentication, hosting, analytics, payments, communications, or security.

6. Why we collect, use, and disclose personal information

We collect, use, and disclose personal information only for purposes that are appropriate in the circumstances and permitted by applicable law. Depending on Crisis Response Companion and the data you enter, these purposes may include:

providing, operating, maintaining, and improving Crisis Response Companion;
generating AI-supported outputs requested by users;
creating and managing user accounts;
responding to support requests, feedback, or complaints;
personalizing the user experience, where applicable and appropriately disclosed;
monitoring performance, security, misuse, fraud, abuse, or technical issues;
enforcing our Terms of Use and other legal rights;
complying with legal, regulatory, professional, contractual, or safety obligations; or
conducting internal testing, quality assurance, debugging, and programming improvement.

Prompts, outputs, and user content are not used to train, retrain, fine-tune, evaluate, or otherwise refine Crisis Response Companion unless you provide them as part of voluntary feedback pursuant to the Terms of Use.

8. AI-specific privacy disclosures

Crisis Response Companion uses artificial intelligence to generate outputs in response to prompts, inputs, or other instructions. AI-generated outputs are probabilistic and may vary, even when similar inputs are provided. Outputs may be inaccurate, incomplete, biased, unsuitable, or out of date.

We aim to provide users with understandable information about how Crisis Response Companion uses AI, including:

that users are interacting with an AI-enabled system;
what kinds of information are used to generate outputs;
whether prompts or outputs are stored;
whether prompts or outputs are used to improve Crisis Response Companion;
known limitations and failure cases relevant to the intended use;
whether any human review is involved; or
what options or recourse are available where Crisis Response Companion has significant effects on an individual.

Crisis Response Companion is a custom-constructed artificial intelligence system.
Prompts and resulting outputs are not reviewed by humans prior to being delivered to the user.
Authorized personnel may access prompts and outputs where reasonably necessary to respond to a user request, investigate misuse or a security incident, comply with law, or maintain Crisis Response Companion, subject to access controls and confidentiality obligations.
Prompts and resulting outputs are not used to improve Crisis Response Companion unless they are provided by you as part of voluntary feedback pursuant to the Terms of Use.
Prompts and resulting outputs can be deleted by users within the session interface. Deletion is permanent. Once a prompt has been entered and an output generated, that data cannot be altered.

9. What happens if you enter information about another person

If you use Crisis Response Companion to support another person, you must only enter information you are authorized to provide and only where it is lawful and appropriate to do so. Depending on the use case, additional consent, confidentiality, contractual, professional, or organizational rules may apply.

Crisis Response Companion does not condone the entry of identifiable personal information about another person. Information should be anonymized by using an alias, pseudonym, or code name for individuals or locations known only to you in order to ensure Crisis Response Companion does not inadvertently store third-party personal identifying information on your behalf.

Pursuant to Canadian AI privacy guidelines, you should only enter de-identified information. Information that may be used to identify a specific person should not be entered into prompts.

10. When we disclose personal information

We may disclose personal information in the following circumstances, subject to applicable law:

To service providers that help us operate Crisis Response Companion, such as hosting, cloud, analytics, customer support, security, communications, authentication, or payment providers;
To affiliated entities, if applicable and clearly disclosed;
To an organization sponsoring your access to Crisis Response Companion, where Crisis Response Companion is provided to you through that organization and where such disclosure is required by contractual agreement;
Where required or permitted by law, regulation, court order, lawful authority, or urgent safety need;
In connection with a proposed or completed business transaction, where permitted by law and subject to appropriate protections; or
With your consent or direction.

Payment is processed by Polar Software Inc., 3500 South DuPont Highway, Dover, DE 19901, United States of America. You can access their terms of use and privacy policy here: https://polar.sh/legal/checkout-buyer-terms

11. Cross-border transfers and data location

Your personal information may be stored, processed, or accessed in jurisdictions outside your province or territory, including outside Canada, if we or our service providers use cross-border infrastructure or support services. When information is transferred to another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, or regulators there.

The following services are used for the operation of Crisis Response Companion and are subject to change at any time:

Database storage: Supabase (U.S.A.). Their terms of use and privacy policy can be found here: https://supabase.com/
Hosting infrastructure: Vercel (U.S.A.). Their terms of use and privacy policy can be found here: https://vercel.com/

12. Retention and deletion

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, comply with legal or contractual obligations, resolve disputes, enforce agreements, and maintain appropriate records.

Following account closure, account information, profile information, prompts, outputs, usage data, and security records may be retained for up to 90 days to permit account reactivation, resolve support or security matters, and meet legal or contractual obligations.

Support records include support requests, complaints, voluntary feedback, security reports, and related correspondence and may be retained by the Operator indefinitely.

At the end of that period, the information will be deleted or de-identified unless longer retention is required by law or reasonably necessary for billing, tax, dispute, fraud-prevention, security, or legal-compliance purposes.

Backups may retain information for up to 30 additional days beyond the deletion date before being purged from backup systems.

13. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information under our control. These measures may include access controls, encryption, secure hosting, logging, role-based permissions, vendor due diligence, confidentiality measures, staff training, incident response procedures, and periodic review of safeguards.

Because generative AI systems may create privacy and security risks such as prompt injection, model inversion, data leakage, or jailbreak attempts, we aim to implement safeguards and monitoring measures appropriate to the design of Crisis Response Companion.

Do not assume that information entered into Crisis Response Companion is protected by professional privilege or by the confidentiality rules that apply to a formal therapeutic, legal, chaplaincy, health-care, employment, or peer-support relationship. Personal information remains subject to the Privacy Policy and applicable privacy law.

Data is encrypted during transit and processing and while at rest in storage.

14. Accuracy and correction

We take reasonable steps to keep personal information as accurate, complete, and up to date as necessary for the purposes for which it is used. Because AI-generated outputs may be inaccurate or incomplete, users should not assume that outputs are accurate without verification.

You may request correction of personal information we maintain about you, subject to applicable law and operational limitations. Requests for correction of personal information should be made in writing and directed to the Privacy Officer.

15. Access rights

Subject to applicable law, you may request access to personal information we hold about you and information about how it has been used or disclosed. We will respond within the timeframe required by applicable law, subject to any lawful exceptions.

Such requests must be made in writing to the Crisis Response Companion Privacy Officer.

We will verify your identity using information reasonably necessary and proportionate to the sensitivity of the requested records. We will not request government-issued identification unless less intrusive methods are insufficient.

Deleted accounts, and deleted prompts and related outputs are deleted permanently and cannot be retrieved by Crisis Response Companion.

17. Cookies, analytics, and similar technologies

We may use cookies, software development kits, pixels, local storage, or similar technologies to operate Crisis Response Companion, remember preferences, understand usage, improve performance, and maintain security.

18. Age restrictions and emergency use

Because AI systems can create greater risks for children, youth, and individuals experiencing distress, we take a cautious approach to these uses.

Crisis Response Companion should not be used by children or youth under the age of majority.

Crisis Response Companion is not intended for a person seeking immediate crisis intervention, emergency assistance, suicide intervention, or direct clinical support. Adults may use it for general education, preparation, planning, or reflection, provided it is not used as a substitute for timely human assistance.

Persons in crisis should not use Crisis Response Companion as a source of support. While Crisis Response Companion may provide educational information or reflective questions, it is not designed to be a counselling or crisis intervention tool.

A person seeking immediate crisis support should contact an appropriate human support, such as a trusted person, qualified professional, crisis line, or emergency service. In Canada, call or text 9-8-8 for suicide crisis support. Call 9-1-1 where there is immediate danger or an emergency.

19. Organizational accounts and professional use

If Crisis Response Companion is provided through your employer, support organization, educational institution, clinic, program, or other organization, additional terms may apply to how personal information is collected, accessed, and managed.

Unless expressly stated in an organizational-account notice, organizational administrators do not have access to the content of prompts or outputs. They may have access to specified account, subscription, login, usage, security, or billing information. Where a different arrangement applies, users will be informed before using the organizational account.

Users must note that the Operator has no control over what consent may be required by users to access Crisis Response Companion on another organization’s equipment or infrastructure. The Operator does not control logging, monitoring, device-management, network-security, or record-keeping practices independently applied by the organization to its equipment, accounts, or infrastructure.

20. Automated processing and significant effects

Users acting in a professional capacity or on behalf of an organization may have separate legal, ethical, professional, or organizational obligations relating to AI-assisted decision-making. Those users are responsible for determining and complying with the obligations applicable to their role and circumstances. This may include specific AI-related legislation in their jurisdiction.

Crisis Response Companion is not designed to make decisions about individuals, determine eligibility, diagnose conditions, conduct clinical or operational triage, or assign risk scores. Users must not rely on it as the sole basis for decisions that may significantly affect a person.

Crisis Response Companion does not provide any of the following:

automated triage;
risk scoring;
recommendation ranking;
specific escalation triggers; or
professional workflow prioritization.

21. Complaints

If you have concerns about our privacy practices, you may contact us using the contact details above. We will review and respond to complaints in accordance with applicable law.

You may also have the right to contact the appropriate privacy regulator, depending on your location and the nature of your concern.

Depending on your province of residence and the nature of your concern, you may also contact the applicable privacy regulator: the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca; the Commission d’accès à l’information du Québec (CAI) for Quebec residents at www.cai.gouv.qc.ca; or the applicable privacy commissioner for Alberta or British Columbia if the concern relates to activities in those provinces.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in Crisis Response Companion, our privacy practices, legal requirements, or technology. When changes are material, we will provide notice in a manner appropriate to Crisis Response Companion.

Where changes are material, we will provide notice by email to the address associated with your account, by in-app notification, or by posting a prominent notice on our website or within Crisis Response Companion, at least 30 days before the changes take effect, unless a shorter period is required by law.

Your continued use after the effective date may constitute acceptance of changes that do not require renewed consent. Where applicable law requires express, affirmative, or renewed consent, we will obtain that consent before applying the relevant change.

Effective Date: October 1, 2026 Last Updated: October 1, 2026

23. Quebec residents: Loi 25 (Law 25)

If you are a resident of Quebec, you have additional rights under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels).

CounterStress Solutions Inc. acknowledges its obligations under Loi 25, including: providing clear, plain-language privacy policies; obtaining express, meaningful consent for the collection, use, and communication of personal information; implementing a privacy by design framework; conducting privacy impact assessments where required; notifying the Commission d’accès à l’information (CAI) and affected individuals of any confidentiality incident posing a serious risk of harm; and complying with data subject rights including access, correction, deletion, and portability of personal information.

Our Privacy Officer is responsible for ensuring compliance with Loi 25 and may be reached using the contact information in Section 3. Quebec residents may also contact the CAI at www.cai.gouv.qc.ca for information or to make a complaint.

24. Privacy Officer and accountability

CounterStress Solutions Inc. has designated a Privacy Officer who is accountable for the organization’s compliance with this Privacy Policy and applicable Canadian privacy legislation, including PIPEDA and Quebec Law 25.

The Privacy Officer is responsible for: developing and maintaining privacy policies and procedures; receiving and responding to privacy-related inquiries and complaints; overseeing data breach response and notification procedures; conducting privacy training for staff and authorized personnel; and ensuring that privacy impact assessments are completed for new programs or services that involve personal information.

You may contact the Privacy Officer using the contact information provided in Section 3 of this Privacy Policy. We commit to acknowledging your inquiry within 10 business days and responding substantively within 30 business days, unless a longer period is permitted by law.