Loader

Privacy Policy

Effective Date: August 1, 2026
Last Updated: August 1, 2026*

17817215 CANADA INC. (hereinafter the “Company”) is committed to protecting the confidentiality and security of personal information collected in connection with the use of its application (hereinafter “LYCHii”). This Privacy Policy (hereinafter the “Policy”) describes the nature of the personal information we collect, how we collect it, the purposes for which we use it, the persons who have access to it, and the rights available to users in respect of that information. The Policy is intended to ensure compliance with the Act respecting the protection of personal information in the private sector (hereinafter “Law 25”) and other applicable privacy laws.

For the purposes of this Privacy Policy, a “user” means any natural person who accesses or uses the Application, including to review, enter, manage, or process information concerning employees under that person’s supervision. A user is generally a supervisor, manager, or other person authorized by the organization to use the Application in the course of that person’s duties.

By using LYCHii, you acknowledge that you have read this Policy and agree to its terms.

What is personal information? Personal information is information concerning a natural person that allows that person to be identified, directly or indirectly. Certain information may be considered sensitive because of its nature or the context in which it is used, including information relating to employment, conduct, health, or disciplinary action.

1. Personal Information Collected

In connection with the use of LYCHii, we may collect the following personal information concerning employees:

  • First and last name;
  • Job title;
  • Employee number;
  • Employment start date;
  • Summary of events giving rise to disciplinary action.

No other personal information is collected beyond what is necessary to fulfil the purposes described in section 3 of this Policy.

2. How Personal Information Is Collected

Personal information is collected primarily through the form integrated into the Application, which is completed or updated by an authorized person, such as a supervisor, a member of the human resources team, or a member of the legal team.

When personal information concerning an employee is disclosed to LYCHii by a client organization or an authorized user, LYCHii acts as a service provider to the client organization and processes the information only to the extent necessary to perform the services contemplated by the applicable agreement. The client organization remains responsible for ensuring that the collection, use, and disclosure of the information are authorized by law and limited to what is necessary for the purposes pursued.

3. Purposes for Which Information Is Collected

The personal information collected is used exclusively for the following purposes:

  • to open, document, and maintain an employee file;
  • to analyze facts relevant to a disciplinary matter;
  • to support the handling and resolution of disciplinary measures;
  • to generate customized recommendations concerning progressive discipline;
  • to ensure the operation, security, integrity, technical support, and improvement of the Application;
  • to comply with applicable legal, regulatory, and contractual obligations.

LYCHii does not use personal information for purposes incompatible with the foregoing, except
with the consent of the person concerned or as authorized by law.

3.1 Decisions Based on Automated Processing and Human Oversight

LYCHii does not make any decision on an automated basis. Recommendations, suggested progressive-discipline measures, draft letters, and other content generated by LYCHii’s automated technologies or artificial intelligence systems are decision-support tools only and must, at all times, be reviewed and validated by an authorized human person before any decision, communication, or disciplinary measure. In accordance with Law 25, any person
concerned by a decision based exclusively on automated processing of their personal information may request to be informed of the use of that process, of the main factors and parameters that led to the decision, and of the means available to submit observations to a person able to review the decision.

4. Cookies and Similar Technologies

LYCHii may use cookies, device identifiers, technical logs, or other similar technologies to operate the Application, authenticate authorized users, maintain session security, prevent unauthorized access, measure Application performance, diagnose errors, and improve the services.

Certain cookies or technologies are strictly necessary for the secure operation of the Application and cannot be disabled without affecting access or certain functionality. When non-essential cookies or technologies are used, including for measurement, analytics, or improvement purposes, LYCHii uses them in accordance with applicable consent, notice, and privacy-setting requirements.

Users can generally control certain cookies or similar technologies through their browser or device settings or, where applicable, settings offered within the Application. Disabling certain cookies or settings may, however, limit access to certain features, reduce the quality of the experience, or prevent secure authentication.

5. How to Object to the Collection of Your Personal Information

Any person concerned may contact the person responsible identified in section 9 to ask a question or submit a request concerning the use of that person’s personal information.

Where information is processed by LYCHii on behalf of a client organization, LYCHii may forward the request to that organization or cooperate with it in responding, according to their respective responsibilities and applicable legal requirements. A request to object to or cease a use will be assessed in accordance with the rights provided by law and applicable legal and contractual obligations.

6. Persons with Access to Personal Information

Access to personal information collected is strictly limited to the following persons, to the extent
required for the performance of their duties:

  • The legal and human resources teams, in connection with employee files and disciplinary matters;
  • The supervisor of the employee concerned, to the extent necessary to perform the supervisor’s management responsibilities.
  • LYCHii’s legal team, which oversees the proper use and operation of the Application.

LYCHii does not sell or rent personal information. When a service provider has access to personal information, LYCHii requires the provider to protect it, keep it confidential, use it solely to perform its mandate, and implement appropriate security safeguards. The provider must also promptly notify LYCHii of any breach or attempted breach of its confidentiality obligations and allow LYCHii to conduct any reasonable verification in that regard.

LYCHii may also disclose personal information without consent where permitted or required by law, including in response to an order of a court or competent authority, to prevent or investigate fraud or a security incident, or to protect the rights, property, or safety of LYCHii, its clients, the persons concerned, or the public.

7. Privacy Settings and Protection of Personal Information

By default, LYCHii applies a high level of confidentiality to information recorded in the Application. No personal information is to be accessible beyond authorized persons unless a setting is knowingly changed by a person authorized to do so.

LYCHii implements reasonable administrative, technical, contractual, and physical safeguards to protect personal information against loss, theft, unauthorized access, viewing, disclosure, copying, use, or modification, and against any other confidentiality incident.

These safeguards include encryption of personal information in transit using secure protocols such as TLS 1.2 or later; encryption of data at rest using robust encryption standards such as AES-256 or an equivalent standard; role-based access and authorization controls; authentication of authorized users; access logging and monitoring; segregation of data among different client organizations; secure data backups; secure management of secrets and access credentials; and contractual commitments requiring our service providers to apply appropriate
confidentiality and security safeguards.

Despite these safeguards, no method of electronic transmission or storage is completely secure. Any person who believes that an account, password, or the confidentiality of information has been compromised must notify LYCHii without delay.

7.1 Notification in the Event of a Confidentiality Incident

In the event of a confidentiality incident presenting a risk of serious harm to a person concerned, LYCHii takes reasonable measures to reduce the risk that harm will be caused and to prevent further incidents of the same nature, maintains a register of confidentiality incidents in accordance with the law, and notifies the Commission d’accès à l’information du Québec and the persons concerned, within the time limits and in the manner prescribed by law. Where the incident occurs in the course of a mandate performed on behalf of a client organization, LYCHii
also notifies that organization without delay so that it may comply with its own legal obligations.

8. Rights of Persons Concerned

Any person whose personal information is collected has the following rights:

Right of access: the right to obtain disclosure of the personal information concerning that person that is held by LYCHii;

Right of rectification: the right to have personal information concerning that person updated or corrected, including where it is inaccurate, incomplete, or outdated.

Right to withdraw consent: the person concerned by the collection of information may withdraw consent at any time, subject to LYCHii’s legal or contractual obligations and the reasonable consequences that such withdrawal may have on the employment relationship or the services offered;

Right to lodge a complaint: any person dissatisfied with LYCHii’s response to an access, rectification, or consent-withdrawal request, or who believes that personal information has been handled contrary to applicable law, may lodge a complaint with the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca).

To exercise any of these rights, the person concerned must contact the person responsible identified in section 9 below. LYCHii will respond to each request within 30 days, in accordance with applicable privacy laws.

8.1 Persons Concerned Who Are Not Users (Employees)

The rights set out in this section 8 belong to the “person concerned,” that is, the natural person whose personal information is processed (including an employee who is the subject of a file recorded in LYCHii), who is distinct from the “user” within the meaning of this Policy (generally a supervisor, manager, or other authorized member of the client organization). LYCHii generally has no direct contractual relationship with the person concerned where that person is not themselves a user. It is the client organization’s responsibility to inform its employees of the collection and processing of their personal information in LYCHii, in accordance with its own transparency obligations under the law. LYCHii forwards or supports the handling of any request received from a person concerned in accordance with section 5 of this Policy and the respective responsibilities of LYCHii and the client organization.

9. Person Responsible for Access to Personal Information

Any question, access or rectification request, or complaint regarding this Policy may be directed to: Lina Aristeo (lina@lychii.app).

10. Retention, Destruction, and Anonymization of Personal Information

LYCHii retains personal information only for the period necessary to achieve the purposes set out in section 3, or for the period required or permitted by law. Retention periods may vary according to the nature of the information, the context in which it was collected, applicable legal, regulatory, or contractual obligations, the need to address a request, complaint, dispute, or confidentiality incident, and reasonable record-management requirements.

Personal information may be stored by LYCHii or its service providers, including outside Québec or Canada. In such cases, LYCHii takes reasonable measures to ensure that the information receives adequate protection. Where personal information is transferred outside Québec, LYCHii conducts a privacy impact assessment prior to the transfer, in accordance with the law, to ensure that the information will receive adequate protection.

11. Electronic Messages and Unsolicited Communications

LYCHii complies with applicable laws governing electronic communications, including rules concerning commercial electronic messages and unsolicited communications. If a user no longer wishes to receive certain promotional or informational electronic communications, the user may use the unsubscribe mechanism provided in those communications or contact LYCHii to manage communication preferences.

LYCHii may nevertheless continue to send necessary or transactional communications concerning an account, access to the Application, a support request, a contractual obligation, a security incident, or a material change to the services or to personal information practices, where such communications are permitted or required by law.

12. Amendments to This Policy

LYCHii may amend this Policy to reflect changes in its practices relating to the collection, use, disclosure, retention, or protection of personal information, changes to its services or technologies, or applicable legal requirements.

Any amendment will be published in the Application or otherwise brought to users’ attention, together with a revised update date. Users are encouraged to review this Policy regularly to remain informed of any changes.

This Policy is made available in French and English. In the event of any discrepancy, contradiction, or inconsistency between the versions, the French version prevails unless otherwise required by law.

13. Questions, Comments, Suggestions, or Complaints

For any question, comment, suggestion, or complaint concerning this Policy or LYCHii’s personal information protection practices, persons concerned may contact the person responsible for the protection of personal information identified in section 9.

LYCHii will review any complaint submitted in good faith, conduct such reasonable inquiries as the circumstances warrant, and, where the complaint is substantiated, take appropriate steps to correct the situation, limit possible consequences, and improve its practices where required.