Privacy policy

Aviora Compass (“Aviora Compass,” “we,” “us,” or “our”) is an online planning service for autistic people and the families who support them in British Columbia. It helps you keep track of autism funding, school supports, and life-planning steps, and tells you what to do next. Our services include family profiles, personalized next steps, funding and IEP trackers, a secure document vault, “What changed” updates, plan emails, and, on the Navigator plan, messages with a family navigator.

We know the information you share can be very sensitive, especially information about a diagnosis, disability-related needs, or school records. This policy explains what we collect, why, who can see it, where it is stored, how long we keep it, and the choices you have. It applies when you visit avioracompass.ca, create an account, use our services, upload documents, or contact us.

We follow British Columbia’s Personal Information Protection Act (PIPA) and other privacy laws that apply to us. Aviora Compass is a planning service, not a health-care provider, and we do not decide anyone’s eligibility for government programs.

Please read this policy together with the consent notice we show before you add your first family profile.

We collect only what we need to provide the service, keep accounts secure, respond to you, and meet our legal obligations.

A. Account and contact information

• Your name and email address.
• Your password. It is handled by our login provider in protected (hashed) form; we never see it.
• Your mobile number, only if you choose to add it for text alerts.
• Your preferences: how we contact you, how often you receive plan emails (weekly, monthly, or off), whether you prefer no phone calls, and your language.

B. Subscription and billing information

• Your plan, subscription status, renewal dates, and the customer number our payment processor (Stripe) gives you.
• Your card details and billing address are entered on Stripe’s secure payment page and held by Stripe. We never receive or store your full card number.

C. Family profiles

When you add a family member (a child, yourself if you are an autistic adult, or another person you support), we collect:

• Their name, date of birth, and relationship to you.
• Diagnosis status (diagnosed, waiting for an assessment, or exploring).
• School district and type of school.
• Which supports are already in place, such as autism funding, an IEP, the Disability Tax Credit, an RDSP, CLBC, PWD, the At Home Program, or Supported Child Development, and your main priority.
• Optional questions: Indigenous identity, and whether the person also has an intellectual disability or FASD. These are always optional, include “Prefer not to say,” and we explain why we ask (for example, Indigenous children may qualify for extra supports through Jordan’s Principle or the Inuit Child First Initiative).

D. Trackers and your plan

• Funding details you enter: the program, when the funding period ends, the amount, and how much has been used.
• IEP details you enter: the meeting date, the case manager’s name, and your notes.
• Which next steps you have marked done or snoozed.

E. Documents (Family and Navigator plans)

Files you choose to upload to the document vault, such as IEPs, assessments, letters, or funding forms, along with the file name and who uploaded it. Documents may contain information about other people, such as educators or professionals. Please upload only what you need, and remove unrelated personal information where you can.

F. Messages (Navigator plan)

Messages between your household and your family navigator, including who sent each message and when.

G. People you invite

If you invite a partner, caregiver, or your autistic adult to share your household, we collect their email address and the role you give them.

H. When you contact us

If you use our contact form or email us, we collect your name, email, the topic, and your message. Contact-form messages are delivered to our business email inbox.

If you live outside BC and join our waitlist, we collect your email, your province or territory, and your first name if you give it. We use it only to tell you when Aviora Compass launches where you live.

I. Technical information

Our hosting provider records basic technical information needed to run and secure the website, such as IP addresses, browser and device type, pages requested, and error logs. We use login cookies to keep you signed in (see section 12). We do not use advertising trackers or third-party analytics.

J. Information that stays on your device

• Answers to the free Next Step Finder are worked out in your browser and are not sent to us.
• Your display “comfort settings” and any unsaved family-profile form are kept in your browser’s storage on your device. The unsaved form is cleared once you save it.

We use personal information only for the purposes explained here and when we collect it:

• Creating and running your account and household.
• Building each family member’s personalized next steps, timelines, and trackers.
• Keeping your documents in one secure place.
• Sending the emails and texts you choose: weekly or monthly plan emails, urgent text alerts if you turn them on, and account emails such as invites and password resets.
• Showing “What changed” updates that match the ages of the people in your household.
• Connecting Navigator-plan families with their navigator.
• Processing subscriptions, payments, refunds, and billing questions.
• Answering your questions and providing support.
• Keeping the service secure, preventing fraud and misuse, and fixing problems.
• Keeping the records the law requires.

We will not use your information for a new purpose without telling you and getting any consent the law requires.

We do not sell or rent personal information. We do not use family profiles, diagnosis information, IEPs, documents, or messages for advertising or marketing profiles.

Before you add your first family profile, we ask you to agree to a consent notice that explains what we store and why, including health information. We record the date you agreed and the version of the notice.

Aviora Compass accounts are for adults. By adding information about another person, you confirm that you have the authority to share it for these purposes, for example as their parent or legal guardian, or with their permission. Having an account does not by itself give someone authority over another person’s information. We may ask you to confirm your identity or authority when it is reasonably necessary, for example before releasing information.

Autistic adults can manage their own plan, or be invited to share their family’s household with their own login. Where a young person is able to make their own privacy decisions, we take that into account.

You can withdraw consent at any time by deleting a family profile or your account (section 9), or by changing optional answers to “Prefer not to say.” Withdrawing consent may mean we can no longer provide the parts of the service that depend on that information.

We do not require you to consent to more than is reasonably necessary to provide the service.

Aviora Compass does not use artificial intelligence (AI) to process family profiles, diagnosis information, IEPs, funding records, documents, or messages. Your next steps are built from fixed rules about BC programs, not by AI.

We do not allow AI tools to use your family’s information for training or any other purpose. If we ever plan an AI feature that would use family information, we will first assess the privacy impact, update this policy, and ask for any consent the law requires before turning it on.

People in your household

On the Family and Navigator plans, people you invite to your household can see your household’s profiles, plan, trackers, and documents. The account owner can remove someone at any time. If a plan changes to Essentials, sharing is paused.

Aviora Compass staff

Staff access is limited by role and protected by individual logins:

• Admins can see the list of members (email, plan, billing status, and how many profiles a household has), and what navigators see, below. When it is needed to fix a problem, respond to your request, or meet a legal requirement, an admin can open a read-only view of your household’s profiles, trackers, and the names of uploaded documents (not their contents). Each time, the admin must give the reason, and the view is recorded in our staff activity log.
• Navigators can see, for Navigator-plan households only, the names, dates of birth, and diagnosis status of family members, and the messages exchanged with that household.
• Editors write public content and cannot see member information.

Staff actions in the admin area are logged. Staff are expected to keep member information confidential.

When the law requires it

We may disclose information when required or allowed by law, such as under a court order, or without consent in an emergency that threatens someone’s life, health, or safety, where the law permits.

We do not share identifiable family profiles, diagnosis information, IEPs, documents, or funding records with schools, health-care providers, government agencies, or other organizations unless you ask us to or the law requires it.

Your family profiles, trackers, documents, and messages are stored in Canada, in our database provider’s Canada (Central) region.

Some processing happens outside Canada, mainly in the United States: website requests passing through our hosting provider, payment processing, and sending emails and texts. Information processed outside Canada may be subject to the laws of that country, including lawful requests from its authorities. We choose providers with strong security practices and agreements that limit how they can use your information.

We protect your information with safeguards suited to its sensitivity, including:

• Encryption in transit (https) on every page, and encryption of stored data by our database provider.
• Database rules that let each household see only its own information.
• Private document storage: files can only be opened by members of the household after a login check.
• Role-based staff access, individual staff logins, and logging of staff actions.
• Strong password rules for member logins, and individual, restricted access to our business systems.
• Regular software updates and security monitoring.

No online service can be completely secure. If you think your account has been accessed by someone else, change your password and contact our Privacy Officer right away.

• While your account is open: we keep your information, including after you cancel a paid plan, so it is there if you return.
• Deleting your account: from Account → Delete account. If you own the household, this cancels your subscription and permanently deletes your household’s profiles, trackers, documents, and messages, then deletes your login. If you were invited to a household, it deletes your login and removes your access; the household stays with its owner. You can also ask our Privacy Officer to delete your account.
• Membership and billing records: we keep a record of your membership (email, plan, and dates) and billing records for at least six years after the end of the tax year they relate to, as Canadian tax law requires. Stripe also keeps its own payment records.
• Messages to our inbox: kept for as long as needed to respond to you and keep a reasonable record of our conversation.
• Waitlist: kept until we launch in your province and let you know, or until you ask to be removed (reply to any waitlist email or write to privacy@avioracompass.ca).
• Backups: if deleted information remains in a database backup, it is kept secure and removed automatically when that backup expires.

When we no longer need information, we securely delete it or make it anonymous.

Under PIPA, you can:

• Ask for a copy of the personal information we hold about you, and how it has been used and shared.
• Correct information that is wrong or incomplete. Most information can be updated directly in your account.
• Withdraw your consent, subject to legal or contractual limits.
• Ask us to delete your information when we no longer need to keep it.
• Change how we contact you, at any time, in your account settings.

To make a request, email our Privacy Officer at privacy@avioracompass.ca. We will need to confirm your identity and, for someone else’s information, your authority to act for them. We will respond within 30 business days, as PIPA requires, or tell you if we need more time and why. If we cannot fully meet a request, we will explain why, as the law allows.

Many of the people in our families are children. Adults who add information about a child must have the authority to do so. We take particular care with children’s diagnosis information, IEPs, school details, and documents.

Family profiles are never public. Only members of your household, and the limited staff described in section 6, can access them.

If you believe a child’s information was shared without proper authority, or accessed by someone who should not have it, contact our Privacy Officer right away.

We use only essential cookies:

• Login cookies that keep you signed in securely.
• A preview cookie used only by our staff when testing.

We also save your comfort settings and unsaved form drafts in your browser’s storage (section 2J). Stripe sets its own cookies on its secure payment page, under Stripe’s privacy policy.

We do not use advertising or tracking cookies. If we add privacy-friendly visitor statistics, we will update this policy first. You can clear cookies and storage in your browser settings, but you will need to sign in again.

If we learn of a suspected privacy breach, we will act quickly to contain it, investigate, reduce harm, and prevent it from happening again. We will notify affected people and the Office of the Information and Privacy Commissioner for British Columbia where the law requires, or where it is otherwise appropriate.

If you have a concern about how we handle your information, please contact our Privacy Officer first so we can try to fix it. You can also contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.

We may update this policy as our services or the law change. The current version is always posted on this page. If we make a significant change to how we collect, use, or share personal information, we will email account holders at least 30 days before it takes effect and ask for consent where the law requires.

Our Privacy Officer is responsible for our privacy practices, requests to access or correct information, and privacy questions and complaints.

Privacy Officer, Aviora Compass. Email: privacy@avioracompass.ca

This policy is governed by British Columbia’s Personal Information Protection Act and other privacy laws that apply to Aviora Compass. Nothing in it limits any privacy right or legal remedy that cannot lawfully be limited.