Privacy Policy

1. Who this policy covers

Flosskit provides accounts and tools for society memberships, events, payments, communications and shared workspaces. This policy describes how FlossKit handles personal information in providing that platform. Contact our privacy contact at help@flosskit.com. Societies and event organizers are responsible for their own activities and may have separate privacy notices. Ask the relevant society how it uses member information outside Flosskit.

2. Information we collect

Account and profile information includes your name, email address, optional phone number, ODA ID if provided, professional status and account preferences. A society may import your details before you first sign in. We retain the source of imported records and use existing account details in preference to conflicting imported details.

Society and event records may include membership categories, active status and expiry dates, executive roles, registrations, questionnaire responses, attendance, tickets and continuing-education certificates. If you use discussion or workspace features, we process your posts, replies, uploaded images or documents, tasks and presence information according to the relevant feature.

Payment records include amounts, status, order and payment-provider references, refunds and transaction history. Stripe handles payment-card collection; Flosskit does not store full card numbers or card security codes.

Technical and security information may include sign-in and session records, cookies, IP-derived rate-limit information, device or request details in infrastructure logs, and audit records. We also record the policy versions you accept, the server-recorded acceptance time, your account email at acceptance and a session reference. Do not submit patient records or patient-identifying clinical information.

3. Why we use information

We use information to create and secure accounts, send requested sign-in messages, match identities to memberships, provide society and event features, process and reconcile payments, issue tickets and certificates, support users, prevent abuse, maintain audit records and meet legal obligations. We use profile details across your societies so you can maintain one account.

Processing needed to operate a feature is distinguished from optional communication choices. We do not sell personal information or use it for targeted advertising. We do not require optional marketing consent as a condition of creating an account.

4. Who can receive information

Authorized society executives and organizers can receive the profile, contact, membership, registration, attendance and other records needed to administer their society or event. Your communication choices remain separate for each society. Changing a shared profile detail can update what each linked society sees. We limit access through account roles and society or event permissions.

Other users may see your name, role, posts, presence or shared content where a feature or sharing setting makes that information available. Public society pages may display executive profiles, approved images and other information intended for publication. Private links to tickets or certificates can disclose their associated information to anyone who has the link; share them carefully.

We use service providers for hosting, databases, storage, content delivery, email and payments. The current platform uses services from Amazon Web Services, Vercel, Heroku/Salesforce and Stripe, and the Hasura database platform. Providers process information to support their services, subject to applicable contractual and legal requirements. We may also disclose information where required by law, to protect rights or safety, or in a business transaction with appropriate safeguards.

5. Where information is processed and safeguards

Information may be stored or processed in Canada, the United States or other countries where our service providers operate. It may be subject to the laws and lawful access requests of those jurisdictions. We remain responsible for information under our control and use appropriate arrangements and safeguards for service-provider processing.

Safeguards include encrypted connections, signed sessions, access permissions, account and administrative audit records, and restricted operational credentials. No system is completely secure. Contact help@flosskit.com if you believe an account or record has been exposed improperly.

6. Cookies, local storage and messages

We use essential cookies and browser storage for sign-in sessions, security, returning you to the page you requested, and remembering navigation or draft choices. These are used to provide requested account features. Blocking them may prevent sign-in or some features from working.

Optional society email and text preferences are separate from accepting these policies. You can change those choices in your account or contact the society. Sign-in codes, security notices, transaction receipts and messages necessary to deliver requested services may still be sent. SMS delivery availability depends on the features currently offered.

7. Retention and account removal

We retain information for as long as reasonably needed to provide the service and fulfill the purposes described here, including accounting, certificate and attendance history, security, agreement evidence, legal requirements and dispute resolution. Different types of records may have different retention needs.

Account removal may block sign-in and deactivate memberships without immediately deleting associated records. Records held independently by a society or payment provider may remain subject to that organization’s retention obligations. You can contact us to request closure, deletion or information about retention; we will explain applicable limitations.

8. Your choices and privacy requests

You can review and correct shared profile details in your account and manage each society’s communication preferences. Contact help@flosskit.com to request access to your information, a correction, withdrawal of consent, account closure or deletion, or to raise a privacy concern. We may need to verify your identity before responding.

We respond in accordance with applicable law and explain any permitted limitation on a request. Withdrawing consent to processing necessary for an account feature may mean we can no longer provide that feature. Consent does not waive our privacy obligations. If a concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction.

9. Updates and your agreement

We identify this policy by its effective date and version. We will provide notice of material changes and request renewed agreement or consent where appropriate before continued use of affected account features. We keep the text and versions of policies you accept, together with their acceptance timestamps, so an updated policy does not erase the earlier record. Optional marketing preferences are not changed by a policy update.