Privacy policy
This policy explains how Quateria Inc. ("we", "us") handles personal information in connection with OBMr, the website at https://obmr.app and the OBMr app. OBMr is operated by Quateria Inc., a corporation incorporated under the laws of Ontario or Canada, with its registered office at registered office address.
Two different roles
When you use OBMr at work, your employer or the organization you volunteer or train with (our "customer") decides what is recorded about you and why. The customer is responsible for that information, and we process it on the customer's behalf under our data processing agreement. For questions about your records, start with your organization. We will help them answer you.
When you visit our website, contact us, or are the person who manages a customer account, we decide how that information is handled, and this policy sets out how.
What we collect
| Information | Where it comes from | Why |
|---|---|---|
| Name, work email, role in the organization | You or your organization, when you are invited | To create your account and show you the right screens |
| Password | You | Stored only as a salted scrypt hash, so nobody, including us, can read it |
| Two-step sign-in secret | Generated when you set it up | Encrypted with AES-256-GCM, used only to check your codes |
| Sign-in records: time, outcome, a one-way hash of the email and network address, and the browser's user agent | Your browser | To keep accounts safe and stop password guessing |
| Workplace profile: job title, employment type, start date, location, team, supervisor | Your organization | To run the organization's directory and supervision |
| Personnel record: personal email, phone, address, emergency contact | You or your organization's HR team | So your organization can reach you or your contact in an emergency |
| Performance records: the behaviours your organization tracks, the observations recorded, diagnostics, interventions and feedback | Your supervisor or organization | Organizational behaviour management chosen by your organization |
| Activity log: who changed what, and when | Generated by the app | Security, accountability and correcting mistakes |
| Messages you send us | You | To answer you |
| Website requests: network address, browser, pages requested | Your browser, through our host | To deliver and protect the website |
We do not collect information about clients or patients your organization serves. OBMr is not designed for health information, and our acceptable use policy forbids entering it.
What we never do
- Sell or rent personal information.
- Show advertising or use advertising trackers.
- Use your information to train artificial intelligence models.
- Make automated decisions about anyone's employment. Graphs and summaries describe records; people make decisions.
- Record keystrokes, screens, cameras, microphones or location.
Who can see your information
Inside your organization, access follows your role. Everyone in the organization can see the directory. Your personnel record is visible to you and to your organization's HR and administrators, and every time someone views it, it is logged. Performance records are visible to you, to the people who supervise you, to your team lead for team records, and to administrators.
Outside your organization, our service providers process information only to run OBMr. They are listed on the subprocessors page. We may disclose information when the law requires it, and we will tell the affected customer first unless the law prevents us.
A small number of our staff can reach the database for operations and support. That access is limited to what the task needs, and changes to logged records are recorded even when we make them.
Where information is stored
OBMr is hosted by Netlify, Inc. in the United States, and its database is provided by Netlify, Inc. (Netlify Database) in database region. Information may therefore be stored and processed outside your province or country, and may be accessible to courts and authorities there. Customers in Quebec should assess this transfer before using OBMr; we will give them the information they need.
We currently offer OBMr to organizations in Canada and the United States. We will publish transfer terms before serving organizations in the European Union or the United Kingdom.
How long we keep it
See the data retention schedule. In short: ended sessions are deleted after 30 days, sign-in records after 90 days, unused invitations 90 days after they expire, and the activity log after 2 years. Your organization's records are kept while it subscribes, and erased within 90 days after it leaves.
Security
Passwords are hashed, two-step secrets are encrypted, two-step sign-in is required for administrators and HR, every connection is encrypted, and the database itself enforces which organization and which person can see each record. More detail is on the security page.
Your rights
You can ask to see the personal information we hold about you, ask us to correct it, withdraw consent where we rely on consent, and complain. For information your organization controls, we will pass your request to them and help them answer within the time the law sets, which is usually 30 days. You can update your own personnel record in the app at any time.
To make a request, email privacy@obmr.app. We will confirm who you are before giving out any information.
Children
OBMr is a workplace tool and is not meant for anyone under 16.
Changes
We will post changes here and change the version and effective date. If a change affects how we use information already collected, we will tell customers at least 30 days before it takes effect.
Contact and complaints
Our privacy officer is name or title of the privacy officer, reachable at privacy@obmr.app or by mail at registered office address.
If we do not resolve your concern, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca), or the privacy regulator in your province or state.