| Controller | Smart Buildings Inc. / ATLAS Habitat Initiative ("we") |
| Product | ATLAS OS (the Habitat Twin) |
| Status | Draft v0.1 — review with privacy counsel before publishing |
| Effective | [date on publication] |
| Contact | Elijah@vfitter.com |
Disclaimer. Template for review by qualified counsel; not legal advice. Bracketed items must be confirmed before this is published to users/residents.
1. Scope
This policy explains how we handle personal information in ATLAS OS and connected habitat services, consistent with PIPEDA (and provincial laws — BC/AB PIPA, Québec Law 25 — and PHIPA where personal health information is involved).
2. What we collect
- Account/operator data: name, email, role (operators only).
- Resident contact data: only what's needed to deliver broadcasts/notifications.
- Operational telemetry: per‑floor energy/water/food/climate/occupancy metrics.
- Presence data: occupancy from camera‑free ESP32 presence sensors (no images).
- Health data (PHI): only if telehealth features are used; handled under PHIPA.
- Technical data: logs needed for security and reliability.
We do not collect more than a feature needs (data minimization), and demo/seed data contains no real individuals.
3. Why we use it (purposes)
Operate and optimize the habitat; triage incidents; deliver resident broadcasts; secure the service; meet legal/audit obligations. We do not sell personal information and do not use telemetry to profile residents beyond operations.
4. Legal basis / consent
We rely on consent and the legitimate operation of the building service. Residents are told what is collected at onboarding and may withdraw consent where applicable (subject to service limitations and legal obligations).
5. Sharing & sub‑processors
Shared only with service providers under contract (hosting, database, email) bound by a Data Processing Addendum, or where required by law. A current sub‑processor list is maintained and available on request.
6. Retention
Per the schedule in Security & Data Compliance §5. We keep personal data only as long as needed for its purpose plus statutory minimums.
7. Your rights
Access, correction, withdrawal of consent, and (where applicable) erasure and portability. Email Elijah@vfitter.com; we respond within statutory timelines. You may also contact the Office of the Privacy Commissioner of Canada (or your provincial/health regulator).
8. Security
TLS in transit, encryption at rest, least‑privilege access, audit logging, breach response. See Security & Data Compliance.
9. Children & cross‑border
[Confirm whether minors are residents and add appropriate protections.] Data may be processed by providers outside your province/country; we use contractual safeguards. We disclose hosting locations on request.
10. Changes
We will post updates here with a new effective date and notify operators of material changes.
This external‑facing policy pairs with the internal Security & Data Compliance framework.