Legal

Privacy Policy

Effective Date: April 9, 2026 — Last Updated: July 28, 2026

1. Introduction

MapOutcomes Inc. ("we," "our," or "us") operates the MapOutcomes accreditation platform (the "Platform"). We are committed to protecting the privacy and security of personal information collected through our Platform. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian privacy laws.

MapOutcomes is a B2B SaaS platform serving Canadian post-secondary institutions, initially launched for engineering programs seeking CEAB (Canadian Engineering Accreditation Board) and ABET accreditation. We are expanding into additional accreditation domains including nursing (CASN), pharmacy (CCAPP), and AI governance compliance. All data is hosted in Canada.

Contact: [email protected]

2. Information We Collect

2.1 Personal Information Collected

When you use the MapOutcomes Platform, we collect the following personal information:

Account and Profile Information

Full name
Professional email address (institutional email preferred)
Job title and role within your institution
Institution name and affiliation

Usage Information

Login credentials (password hashes; we do not store plaintext passwords)
Login timestamps and IP addresses (for security and audit purposes)
Feature usage patterns and navigation paths within the Platform
Export and download activity

Content You Create and Upload

Course descriptions and learning outcomes
Program-level accreditation mappings
Assessment criteria and rubrics
Aggregate scoring data and analysis
Exemplar documents (e.g., student work samples) — Note: These documents contain no direct student PII (names, student IDs, etc.) and only include aggregate scores
Institution-specific configuration and settings
Nursing platform note: Clinical competency assessments and placement data may be health-adjacent information. MapOutcomes handles such data in accordance with applicable provincial health privacy laws (PHIPA in Ontario, PIPA in BC/Alberta, Act 25 in Quebec). The Platform does not function as an electronic health record (EHR) system.

Technical Information

Device type and operating system
Browser type and version
Domain and IP address (for security monitoring)
Referring URL and access timestamps

2.2 Information We Do NOT Collect

MapOutcomes does not collect the following:

Student names, student IDs, or any directly identifying student information
Social insurance numbers (SIN) or government-issued identifiers
Financial information (credit cards, bank accounts) — billing is handled separately through institutional purchase orders
Health information or sensitive personal data — Exception: The nursing accreditation platform may handle clinical competency data that is health-adjacent but is not treated as Protected Health Information (PHI). See Section 2.1 for details.
Biometric data

3. How We Use Your Information

3.1 Primary Business Purposes

Service Delivery: To operate and maintain the Platform, including user authentication, access control, and feature functionality
Institutional Accreditation Support: To help your institution manage CEAB/ABET accreditation processes, including course-program-outcome mapping and gap analysis
Customer Support: To respond to inquiries, troubleshoot technical issues, and provide training materials
Account Management: To manage user accounts, process institutional billing, and maintain service records

3.2 Operational Purposes

Security: To monitor for unauthorized access, prevent fraud, and protect Platform integrity
Service Improvement: To analyze usage patterns and improve Platform features and performance
Compliance: To meet legal obligations, including PIPEDA requirements and potential regulatory audits

3.3 Communications

We may send you:

Service announcements (maintenance, updates, security notices)
Account-related notifications (password resets, login alerts)
Product updates and new feature announcements
Training materials and best practices

You may opt out of marketing communications at any time by clicking "unsubscribe" in email communications or updating your communication preferences in your account settings. Service announcements and account notifications cannot be opted out of as they are essential to Platform operation.

4. Legal Basis for Processing (PIPEDA Compliance)

Under PIPEDA, we collect, use, and disclose personal information with your consent and only for purposes that a reasonable person would consider appropriate in the circumstances.

Consent: By using the MapOutcomes Platform, you acknowledge that your institution has authorized your access and use of the Platform for accreditation management purposes. Your use of the Platform constitutes consent to the collection, use, and disclosure of personal information as described in this Privacy Policy.

Necessity: We collect only the personal information necessary to provide our services. The information we collect is reasonably required for:

Providing accreditation management services to your institution
Maintaining security and preventing unauthorized access
Complying with legal obligations

5. How We Share Your Information

5.1 We Do NOT Sell Your Data

MapOutcomes does not sell, trade, or rent personal information to third parties.

5.2 Limited Sharing Scenarios

We share personal information only in the following circumstances:

With Your Institution:

Your institution's administrators may have visibility into their organization's data
Access is role-based and limited to authorized personnel within your institution

Service Providers (Data Processors):

We engage trusted third-party service providers who assist in operating the Platform. These providers have access to personal information only to perform their functions and are contractually obligated to:

Use information only for specified purposes
Maintain confidentiality and security
Comply with PIPEDA requirements

Our current service providers include:

Hosting: Canadian-based hosting infrastructure (data hosted in Ontario, Canada)
Email delivery: Transactional email service for account notifications
Customer support: Ticketing system provider (access limited to support staff)

Legal Requirements:

We may disclose information if required to do so by law or in response to valid requests by governmental authorities (e.g., court orders, search warrants).

Business Transfers:

In connection with a merger, acquisition, or sale of all or substantially all of our assets, personal information may be transferred as part of the transaction. We will provide notice before personal information becomes subject to a different privacy policy.

5.3 No Third-Party Advertising

We do not use third-party advertising cookies or share personal information with advertising networks.

6. Data Retention

6.1 Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Data Type	Retention Period	Notes
Active user accounts	Duration of institutional subscription	Account remains active while subscription is current
Inactive user accounts	90 days after account deactivation	Allows for reactivation if needed
Deleted account data	30 days after deletion	Recovery window; then permanently deleted
Usage logs (IP, timestamps)	12 months	Security and audit purposes
Exemplar documents	Duration of subscription	User-controlled deletion available
Support tickets	24 months after closure	Customer service records
Billing records	7 years	Tax and accounting compliance

6.2 Data Deletion

Upon institutional subscription cancellation:

Your institution's data will be exported (if requested) within 30 days
Personal information will be permanently deleted from active systems
Backups containing your data will be purged according to our backup retention schedule (up to 90 days)

To request account deletion, contact: [email protected]

7. Security Measures

7.1 Technical Safeguards

We implement industry-standard security measures to protect personal information:

Encryption in transit: All visitor traffic is encrypted via TLS at our CDN edge (Cloudflare). Origin server TLS encryption is being deployed.
Password security: All passwords are hashed using bcrypt before storage.
Access Control: Role-based access control (RBAC) limits data access to authorized personnel.
Application security: CSRF token protection on all forms; input validation and output encoding to prevent injection attacks.
Network Security: Firewall protection (pfSense); physical server security controls.

Security roadmap: Origin server TLS, intrusion detection (fail2ban), and annual penetration testing are planned deployments tracked in our DevOps backlog.

7.2 Administrative Safeguards

Employee Training: All employees receive privacy and security training
Access Reviews: Quarterly reviews of employee access to personal information
Incident Response: Documented procedures for responding to security incidents
Vendor Management: Due diligence and contracts for all third-party service providers

7.3 Data Hosting

All MapOutcomes data is hosted in Canada on Canadian infrastructure. We do not transfer data to servers outside Canada without explicit consent and appropriate safeguards.

8. Your Rights Under PIPEDA

8.1 Access

You may request access to the personal information we hold about you. We will respond to access requests within 30 days. Requests should be submitted to: [email protected]

8.2 Correction

If you believe your personal information is inaccurate or incomplete, you may request correction. We will amend your information as appropriate and notify any third parties to whom we disclosed the incorrect information.

8.3 Withdrawal of Consent

You may withdraw your consent to our collection, use, or disclosure of personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may limit our ability to provide certain services.

8.4 Deletion

You may request deletion of your personal information. We will comply with deletion requests unless we are required to retain the information for legal, contractual, or legitimate business purposes.

8.5 Complaints

If you wish to file a complaint about our privacy practices, please contact us first at [email protected]. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

Website: www.priv.gc.ca
Phone: 1-800-282-1376

9. Breach Notification

9.1 What Constitutes a Breach

A personal information breach occurs when there is unauthorized access to or disclosure of personal information under our control, including:

Accidental or unauthorized collection, use, or disclosure
Accidental loss or destruction of personal information
Unauthorized access to personal information

9.2 Our Breach Response

In the event of a personal information breach that poses a real risk of significant harm to individuals, we will:

Contain and Assess: Immediately contain the breach and assess the risk of harm
Notify: Promptly notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA
Document: Maintain a record of the breach including facts, effects, and remedial actions taken
Remediate: Take steps to prevent future occurrences

9.3 Notification Content

Notifications will include:

A description of the breached information
Contact information for further inquiries
Steps individuals can take to minimize potential harm
Our remedial actions

9.4 Regulatory Notification

In addition to notifying affected individuals, MapOutcomes complies with regulatory notification requirements:

PIPEDA: Notify the Office of the Privacy Commissioner of Canada (OPC) when a breach poses a real risk of significant harm. Website: www.priv.gc.ca
Quebec Law 25: Notify the Commission d'accès à l'information du Québec (CAI) and the Office of the Privacy Commissioner of Quebec (CPIQ) when a breach involving Quebec resident data poses a real risk of significant harm. CNCPST (Centre de cybersécurité du Québec) notification applies for cybersecurity incidents. Website: www.cai.gouv.qc.ca

10. Children's Privacy

MapOutcomes is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

11. International Transfers

All MapOutcomes data is hosted in Canada. We do not transfer personal information to jurisdictions outside Canada without:

Explicit consent from the affected individuals
Appropriate safeguards (e.g., standard contractual clauses)
A legal basis under PIPEDA section 8

12. Multi-Site Architecture and Data Isolation

MapOutcomes operates multiple platform sites for different accreditation domains:

Engineering: mapoutcomes.com (CEAB/ABET accreditation)
Nursing: nursing.mapoutcomes.com (CASN/ACEN/CCNE accreditation)
Pharmacy: pharmacy.mapoutcomes.com (ACPE/CCAPP accreditation)
AI Governance: aigov.mapoutcomes.com (AI governance compliance)

All sites are supported by shared database infrastructure with logical data isolation. Your institution's data is segregated by institution identifier and accreditation domain, ensuring that data from your institution is not accessible to other institutions. Data from one institution or accreditation domain is not shared with other institutions or domains unless you explicitly authorize such sharing.

If you use multiple MapOutcomes sites, each site maintains separate data, separate consent records, and separate account settings at the application layer. Data isolation is maintained through database-level access controls and scoping rules. You may withdraw consent or request deletion independently for each site or accreditation domain.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to users via email and/or a notice on the Platform at least 30 days before the changes take effect.

To review the current version, visit: mapoutcomes.com/privacy-policy

14. Contact Information

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:

MapOutcomes Inc.
Email: [email protected]
Support: [email protected]
Website: mapoutcomes.com

Privacy Officer: For privacy-related inquiries, contact our Privacy Officer at [email protected].

15. Glossary

CEAB: Canadian Engineering Accreditation Board — the body that accredits Canadian engineering programs
ABET: Accreditation Board for Engineering and Technology — US-based accreditation body with international recognition
PIPEDA: Personal Information Protection and Electronic Documents Act — Canadian federal privacy law governing how private-sector organizations collect, use, and disclose personal information in the course of commercial activities
Personal Information: Information about an identifiable individual (includes name, contact information, location, opinions, etc.)
Exemplar Documents: Sample work products submitted for accreditation review — may include student work but contain no direct student identifiers (names, IDs, etc.)

This Privacy Policy is for informational purposes and represents MapOutcomes' current privacy practices. It does not constitute legal advice. For legal advice regarding privacy compliance, consult a qualified Canadian privacy lawyer.