Privacy Policy
Unlock Benefits Inc. · Effective date: June 4, 2026
1. About This Policy
This Privacy Policy explains how Unlock Benefits Inc. ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our services at unlockdtc.ca, unlockbenefits.ca, and related properties (collectively, the "Services").
We are committed to protecting your privacy in accordance with:
- The Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA);
- The Personal Information Protection Act (British Columbia) (BC PIPA);
- The Personal Information Protection Act (Alberta) (Alberta PIPA);
- Other applicable Canadian privacy legislation.
Our Services are currently offered in English to residents of Canada outside the province of Quebec. We do not presently serve Quebec residents, and this Policy does not address the additional requirements of Quebec's Law 25; that would be added if and when we begin serving Quebec.
If you have questions about this Policy or our privacy practices, contact our Privacy Officer at privacy@unlockbenefits.ca.
2. What Personal Information We Collect
We collect personal information in three categories:
2.1 Account and Contact Information
- Full legal name
- Email address
- Phone number (optional)
- Mailing address
- Date of birth
- Social Insurance Number (only when required for CRA submission)
2.2 Eligibility Assessment Information
When you complete our eligibility quiz or application questionnaire, we collect information about:
- Medical conditions, diagnoses, and impairments
- Functional limitations (daily activities affected)
- Duration and severity of conditions
- Medications, therapies, and treatments
- Healthcare providers and certifying practitioners
- Tax history relevant to retroactive years
This information is sensitive personal health information and is treated with the highest level of protection. See Section 3 for how we obtain consent for this collection.
2.3 Technical Information
- IP address
- Browser type and version
- Device type
- Operating system
- Pages visited and time spent
- Referring website
- Cookie identifiers (see our Cookie Notice for details)
2.4 Payment Information
We do not directly collect or store payment card numbers. Payment information is collected and processed by our payment processor, Stripe (Canada). We receive only confirmation of successful payment and limited transaction metadata (date, amount, last four digits of card).
3. How We Obtain Your Consent
3.1 General Consent
By providing information to us through the Services, you consent to our collection and use of that information as described in this Policy.
3.2 Express Consent for Sensitive Information
For health-related information (Section 2.2), we obtain express consent before collection through:
- Clear consent language presented before the eligibility quiz begins;
- A specific consent checkbox before payment and before application preparation begins;
- Plain-language disclosure of how the information will be used and shared.
3.3 Express Consent for Automated Processing
Before we use automated tools to process your application information, we obtain your express consent through a specific consent disclosure presented during the application process. See Section 5 for details on automated processing.
3.4 Withdrawing Consent
You may withdraw your consent at any time by contacting privacy@unlockbenefits.ca. Withdrawing consent may mean we can no longer provide some or all of our services to you. We will inform you of the consequences of withdrawal before processing it.
Withdrawal of consent does not affect processing that occurred before withdrawal.
4. How We Use Your Personal Information
We use your personal information for the following purposes:
4.1 Service Delivery
- Conducting case evaluation against CRA eligibility criteria
- Preparing your Disability Tax Credit application (Form T2201)
- Coordinating with your chosen medical practitioner
- Submitting your application to CRA via our Authorized Representative status
- Tracking your application status and communicating with you about it
- Preparing and filing appeals if your application is denied
4.2 Account Management
- Creating and maintaining your account
- Processing payment
- Sending service-related notifications (e.g., application status updates)
- Providing customer support
4.3 Legal and Regulatory Compliance
- Complying with our obligations under the Income Tax Act, PIPEDA, and other applicable laws
- Responding to lawful requests from government agencies (including CRA)
- Maintaining records required by tax and corporate law
- Defending legal claims and exercising legal rights
4.4 Service Improvement
- Analyzing aggregated, de-identified usage patterns to improve our Services
- Improving our own case-evaluation processes
We do not use your personal information — including your health information — to train third-party artificial intelligence models.
4.5 Marketing and Communications
With your separate express consent (CASL-compliant), we may send you marketing communications about additional services that may be relevant to you (e.g., information about RDSP, Child Disability Benefit, annual tax preparation). You can withdraw this consent at any time. See our CASL Marketing Consent Notice for details.
5. Automated Tools and Decision-Making
5.1 What Automated Tools We Use
We use automated tools (sometimes referred to as artificial intelligence or machine learning services) to:
- Score eligibility quiz responses against CRA published criteria;
- Draft initial application content from questionnaire responses;
- Organize case information for human review;
- Cross-reference questionnaire responses for consistency.
5.2 Human Oversight
Every Disability Tax Credit application that we submit to CRA is reviewed by a human Authorized Representative (Dilani Sanmugathas) before submission. Automated tools assist in preparation but do not make the final filing decision.
5.3 Significant Automated Decisions
Where we make significant automated decisions affecting you:
- We disclose this to you before the decision is made;
- We provide an explanation of the factors used;
- You have the right to request a human review of the automated decision.
5.4 Where Automated Processing Occurs
Some of the automated tools we use are operated by third-party service providers. Some of these providers process data outside of Canada, including in the United States. By consenting to our use of automated tools, you understand and accept that:
- Your information may be processed outside Canada;
- Information processed outside Canada is subject to the laws of those jurisdictions, which may differ from Canadian privacy law;
- We require all such providers to maintain appropriate safeguards consistent with PIPEDA;
- We have entered into contractual agreements with these providers requiring confidentiality and appropriate data handling.
5.5 Withdrawing Consent to Automated Processing
You may withdraw consent to automated processing at any time by contacting privacy@unlockbenefits.ca. Note that without automated processing, we may not be able to deliver our services at the same cost or timeline.
6. How We Share Your Personal Information
We share your personal information only as described below. We do not sell your personal information.
6.1 With Service Providers
We share personal information with third-party service providers who help us deliver our Services, including:
- Payment processing (Stripe, Canada)
- Cloud infrastructure and data storage (Supabase, ca-central-1 region in Canada)
- Email delivery and communication services
- Automated processing tools (see Section 5)
- Customer relationship management
All service providers are contractually required to:
- Use the information only for the purposes we authorize;
- Maintain appropriate security safeguards;
- Comply with applicable privacy laws;
- Return or destroy information when no longer needed.
6.2 With CRA
To deliver our services, we share necessary information with the Canada Revenue Agency for purposes of:
- Submitting your Disability Tax Credit application;
- Responding to CRA requests for additional information;
- Filing Notices of Objection;
- Other communications directly related to your application.
6.3 With Your Healthcare Provider
With your specific consent, we share relevant information with the medical practitioner you choose to certify Part B of Form T2201.
6.4 With Legal and Regulatory Authorities
We may disclose personal information when required by law, including:
- In response to subpoenas, court orders, or other legal process;
- To respond to lawful requests by government agencies (e.g., CRA, Office of the Privacy Commissioner);
- To establish or exercise our legal rights;
- To defend against legal claims.
6.5 Business Transfers
If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice before personal information becomes subject to a different privacy policy.
7. Cross-Border Data Flow
7.1 Data Residency
Our primary data storage is in Canada. Customer accounts, application content, and case information are stored in Canada (Supabase, ca-central-1 region).
7.2 Foreign Processing
As described in Section 5.4, some automated processing services we use process data outside Canada, primarily in the United States. This processing is subject to:
- Contractual safeguards we have put in place with the service providers;
- The laws of the jurisdiction where processing occurs;
- Our consent disclosure before processing begins.
7.3 Your Rights
If you have concerns about cross-border processing, you may:
- Withdraw consent to automated processing (Section 5.5), which will limit our ability to provide some services;
- Contact our Privacy Officer to discuss alternatives;
- File a complaint with the Office of the Privacy Commissioner of Canada.
8. How We Protect Your Personal Information
We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:
8.1 Technical Safeguards
- Encryption in transit (TLS) for all communications with our Services
- Encryption at rest for data stored in our systems
- Access controls limiting employee and contractor access to personal information
- Regular security updates and patches
- Logging and monitoring of access to personal information
8.2 Administrative Safeguards
- Privacy and security training for personnel
- Written confidentiality agreements with all personnel and service providers
- Screening, including background checks, of any future personnel or contractors who would have access to personal information
- Documented privacy and security policies
- Regular review of access permissions
Currently, access to personal information is limited to the company's two principals (including the Privacy Officer). The personnel measures above apply to any staff or contractors we engage in the future, who will be screened and bound by confidentiality before being given access to personal information.
8.3 Physical Safeguards
- Data centers operated by our cloud infrastructure providers are physically secured and monitored
- Paper records (if any) are stored in secured facilities
8.4 Limitations
No security measures are perfect. We cannot guarantee absolute security of your information. If a privacy breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as required by law.
9. How Long We Keep Your Personal Information
9.1 Retention Periods
We retain personal information only as long as necessary for the purposes described in this Policy and as required by law:
- Account and application information: Retained for 7 years after CRA decision, to support potential reassessments, future-year claims, and audit requirements under the Income Tax Act.
- Payment records: Retained for 7 years as required by tax law.
- Marketing consent records: Retained while consent is active, plus 3 years after withdrawal.
- Technical/usage information: Retained for 24 months in identifiable form, then aggregated or deleted.
- Customer support communications: Retained for 3 years after the communication.
9.2 Deletion
After retention periods expire, we securely delete or anonymize personal information.
9.3 Your Right to Deletion
Subject to legal retention requirements, you may request deletion of your personal information by contacting privacy@unlockbenefits.ca. We will respond within 30 days. Where deletion is restricted by legal retention requirements, we will inform you and explain.
10. Privacy Breach Notification
10.1 Our Obligations
If we experience a privacy breach involving your personal information that creates a real risk of significant harm to you, we are required by PIPEDA to:
- Report the breach to the Office of the Privacy Commissioner of Canada as soon as feasible;
- Notify you as soon as feasible;
- Keep records of all breaches.
10.2 What "Significant Harm" Means
PIPEDA defines significant harm to include: bodily harm; humiliation; damage to reputation or relationships; loss of employment, business, or professional opportunities; financial loss; identity theft; negative effects on credit record; damage to or loss of property.
10.3 What We Will Tell You
In the event of a notifiable breach, we will provide:
- A description of what happened;
- The personal information involved;
- Steps we have taken or will take to address the breach;
- Steps you can take to reduce risk of harm;
- Our contact information for follow-up questions.
11. Your Rights
You have the following rights regarding your personal information:
11.1 Right to Access
You have the right to know what personal information we hold about you and how we are using it. To request access, contact privacy@unlockbenefits.ca. We will respond within 30 days.
11.2 Right to Correction
If your information is inaccurate or incomplete, you have the right to request correction. Contact privacy@unlockbenefits.ca with details of the correction needed.
11.3 Right to Withdraw Consent
You may withdraw consent to our processing at any time, subject to legal or contractual restrictions (Section 3.4).
11.4 Right to Deletion
You may request deletion of your information, subject to legal retention requirements (Section 9.3).
11.5 Right to Complain
You have the right to file a complaint with:
- Our Privacy Officer (privacy@unlockbenefits.ca);
- The Office of the Privacy Commissioner of Canada (priv.gc.ca);
- Your provincial privacy commissioner (BC, Alberta, Quebec have provincial commissioners).
11.6 Right to Object to Automated Decisions
For significant automated decisions affecting you, you have the right to:
- Receive an explanation of the factors used;
- Request a human review;
- Challenge the decision.
12. Children's Privacy and Applications on Behalf of a Child
The Disability Tax Credit is available for children, and a parent or legal guardian typically applies on the child's behalf. Where you use our Services as the parent or legal guardian of a child who is the DTC applicant:
- You provide consent on the child's behalf for the collection and use of the child's personal information (including health information) as described in this Policy;
- We collect the child's information only as needed to evaluate eligibility and prepare the application;
- The same protections, retention rules, and rights described in this Policy apply to the child's information.
We do not knowingly collect personal information directly from a child under 18 except through a parent or legal guardian as described above. If we learn we have collected a child's information without appropriate parental or guardian consent, we will delete it.
13. Privacy Officer
Our Privacy Officer is responsible for our compliance with this Policy and applicable privacy laws, and can be reached using the contact details below. We will provide the name of the individual holding this role on request.
Privacy Officer Unlock Benefits Inc. 5307 Victoria Dr #1239 Vancouver, BC V5P 3V6 Canada
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will:
- Update the "Last updated" date at the top;
- Notify you by email if you have an active account;
- Post a notice on our website for at least 30 days before changes take effect.
Your continued use of our Services after changes take effect constitutes acceptance.
15. Contact Us
For questions, requests, or concerns regarding this Privacy Policy or our handling of your personal information:
Privacy Officer Unlock Benefits Inc. 5307 Victoria Dr #1239 Vancouver, BC V5P 3V6 Canada
Marketing communications (CASL)
1. What This Is
Canada's Anti-Spam Legislation (CASL) regulates commercial electronic messages (CEMs) sent to electronic addresses in Canada.
This document explains:
- When we send you marketing messages;
- The consent we need;
- How you can unsubscribe.
2. What Counts as Marketing
We treat the following as marketing communications:
- Emails about new services we offer (e.g., "We've launched RDSP setup services");
- Educational content about disability benefits that may interest you (e.g., "Did you know about the Child Disability Benefit?");
- Promotional offers or partner promotions;
- Newsletters about disability benefits topics.
These do not count as marketing (we send these without separate consent):
- Service-related notifications (e.g., "Your application has been submitted to CRA");
- Account-related communications (e.g., "Password reset request");
- Required legal or regulatory communications (e.g., privacy policy changes);
- Direct responses to your questions or support requests;
- Refund and billing notifications.
3. Express Consent
When We Ask for Consent
We ask for your express consent to receive marketing communications:
- During account creation (separate optional checkbox);
- During paid service signup (separate optional checkbox);
- On marketing sign-up forms on our website.
What Express Consent Means
Express consent means you actively opted in (e.g., checked a box) after seeing clear information about:
- The purpose of the communications;
- What kinds of messages you'll receive;
- How to unsubscribe;
- Our identity and contact information.
Consent Records
We keep records of your consent, including:
- When and how you consented;
- The version of the consent language you saw;
- Your IP address at time of consent.
4. Implied Consent
We may also send marketing communications under "implied consent" under CASL, including:
4.1 Existing Business Relationship
If you have purchased our services in the last 2 years, CASL implies your consent to receive marketing communications from us about related services. This implied consent expires 2 years after your last purchase.
4.2 Existing Non-Business Relationship
If you have given us your email address in the context of inquiring about our services in the last 6 months, CASL implies your consent for that 6-month period.
4.3 Conspicuous Publication
If your email is conspicuously published (e.g., on a professional website) without a "do not contact" indication and the message is relevant to your business role, CASL allows us to contact you.
In all cases, we provide a clear unsubscribe option in every marketing communication.
5. Unsubscribe
How to Unsubscribe
Every marketing communication includes:
- A clear "unsubscribe" link or button;
- Plain language explaining the unsubscribe;
- A working unsubscribe mechanism that doesn't require additional account creation or login.
Timeline
We honor unsubscribe requests within 10 business days, as required by CASL.
What Unsubscribing Means
Unsubscribing from marketing does NOT:
- Cancel your account or service;
- Stop service-related communications (e.g., application status updates);
- Stop required legal communications.
To close your account entirely, contact hello@unlockdtc.ca.
6. Contact Information in Marketing Communications
Every marketing message we send includes:
- Our legal name (Unlock Benefits Inc.) and any operating name used (unlock.dtc);
- Our physical mailing address (5307 Victoria Dr #1239, Vancouver, BC V5P 3V6);
- A way to contact us (hello@unlockdtc.ca);
- A clear unsubscribe mechanism.
These are CASL requirements.
7. Specific Consent Requests
7.1 General Marketing
Consent to receive newsletters and information about disability benefits topics that may be relevant to you.
Default: Opt-in. Checkbox is unchecked by default; you must actively check it.
7.2 Service-Specific Marketing
Consent to receive information about specific new services we launch (e.g., RDSP setup, Child Disability Benefit applications).
Default: Opt-in. Separate checkbox for each.
7.3 Partner Marketing
We do not currently send marketing on behalf of partners or affiliates. If we add this in the future, we will request separate consent.
8. Withdrawing Consent
You can withdraw consent at any time:
- Click "unsubscribe" in any marketing email;
- Email privacy@unlockbenefits.ca with the subject "Unsubscribe";
- Update preferences in your account settings.
Withdrawal:
- Takes effect within 10 business days;
- Does not affect any service relationship you have with us;
- Does not affect your right to receive non-marketing communications.
9. Penalties Under CASL
CASL imposes significant penalties for violations (up to CAD $10 million for businesses). We take CASL compliance seriously.
If you believe we have sent you a CEM without consent or otherwise violated CASL, please contact us at privacy@unlockbenefits.ca. You may also file a complaint with the Canadian Radio-television and Telecommunications Commission (CRTC) at fightspam.gc.ca.
10. Quebec Residents
We do not currently serve residents of Quebec, and we do not send marketing communications to Quebec residents. Our services and communications are offered in English only. If we begin serving Quebec in the future, we will add French-language marketing materials and the additional consent and data-portability requirements of Quebec's Law 25 before doing so.
11. Changes to This Document
We may update this document if our marketing practices or CASL requirements change. We will update the "Last updated" date and notify you of material changes.
12. Contact
For questions about marketing communications:
Privacy Officer Unlock Benefits Inc. 5307 Victoria Dr #1239 Vancouver, BC V5P 3V6 Canada