Privacy Policy

Sorig Inc. (“we,” “us,” “our,” or the “Company”) operates the website located at https://sorig.ca (the “Website”), through which we provide healthcare recruitment and travel nurse placement services connecting healthcare professionals with opportunities across Canadian provinces. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the Website, our recruitment and placement services, and any related email, phone, or messaging (e.g., WhatsApp) communications.

This Policy has been prepared to comply with the Personal Information Protection and Electronic Documents Act (“PIPEDA”), the federal private-sector privacy law of Canada, and reflects PIPEDA’s ten Fair Information Principles. Where applicable, it also reflects the requirements of Canada’s Anti-Spam Law (“CASL”) for electronic marketing communications. Protecting your personal information is not simply a legal obligation for us — it is a core part of how we do business.

If you have any questions about this Policy or our privacy practices, please contact our Privacy Officer using the details in Section 15 below.

Our Commitment to Your Privacy

Sorig Inc. believes that trust is earned, not assumed. We collect only the personal information we genuinely need, we are transparent about why we collect it, we never sell personal information, and we hold our service providers to the same high standard we hold ourselves. This Policy describes those commitments in detail.

Scope of This Policy

This Policy applies to personal information collected:

• Through the Website (including contact forms, inquiry forms, newsletter sign-ups, account registrations, and any chat or support widgets);
• Through email, phone, or WhatsApp correspondence with us;
• Through our customer relationship management (“CRM”) and business communication platform, Zoho, which we use to manage inquiries, store contact records, and communicate with users (see Section 5 for important details on Zoho and data residency);
• Through our Housing Partner Application, which is embedded on the Website but is hosted and processed by Zoho Forms as part of the same Zoho environment described in Section 5; and
• Through any other channel where we explicitly direct you to this Policy.

This Policy does not apply to third-party websites, plug-ins, or services that may be linked from our Website, which are governed by their own privacy policies (see Section 6).

What Personal Information We Collect

As a healthcare recruitment and travel nurse placement agency, the categories of personal information we collect depend on whether you are simply visiting the Website, submitting a general inquiry, or actively pursuing a placement opportunity with us:

• Identity & Contact Information — full name, email address, phone number, WhatsApp contact, mailing address.
• General Inquiry Information — information submitted through our “Join Us” / contact form (name, email, phone, and any message content you choose to provide).
• Housing Partner Information (for property owners applying to list housing) — full name, email, phone number, property address, property type and description, availability, pricing, photographs, and any other details submitted through our Housing Partner Application.
• Professional & Credentialing Information (for candidates pursuing placement) — nursing license/registration details, provincial registration status, certifications, employment history,
  references, resume/CV content, and other professional credentials required for licensing, compliance, and credential verification.
• Sensitive Information (where applicable to a specific placement) — immunization records, criminal background check results, or other compliance documentation required by a hospital/employer
  client. We treat this as sensitive personal information and will only collect, use, or disclose it with your express, informed consent, and only to the extent required for the specific placement.
• Technical & Non-Personal Information — IP address, browser type, device type, referring URL, pages visited, approximate geographic location (city/region), and similar usage data, typically
  collected via cookies or analytics tools. This information is generally aggregated and does not by itself identify you.
• Communication Content — messages, emails, call notes, or WhatsApp messages exchanged with our recruitment team.

We collect sensitive categories of personal information (such as health-related compliance documents or background check results) only where necessary for a specific recruitment or placement purpose that has been clearly explained to you, and only with your express consent. We do not collect such information from general Website visitors.

How We Collect Personal Information

We collect personal information directly from you when you:

• Submit the “Join Us” contact/inquiry form on the Website (name, email, phone, message);
• Contact us via WhatsApp or phone;
• Email us directly;
• Apply for or discuss a specific travel nurse placement opportunity with our recruitment team, including submitting your resume, credentials, licensing information, or other documentation
  requested for that purpose; or
• Interact with a Zoho-powered form, chat widget, or booking tool embedded on the Website — including our Housing Partner Application, through which prospective housing partners submit property details, availability, pricing, and contact information to apply to list housing for placed nurses.

We do not collect personal information from third-party sources except where you have authorized such sharing (e.g., a professional reference, a hospital/employer client confirming credentialing
requirements) or where required by law.

Use of Zoho, WhatsApp, and Data Residency

Zoho — Canadian Data Residency

Personal information submitted through the Website, by email, or by phone is processed and stored using Zoho Corporation’s suite of business applications (“Zoho”), which we use for customer relationship management, form processing, and email/communication management. We have configured our Zoho environment so that this information is stored and processed within Zoho’s Canadian Data Centre — notwithstanding that the Website’s front-end is hosted on servers located in the United States, the personal information you submit through forms, email integrations, or related tools is not stored on that US infrastructure.

This includes our Housing Partner Application: although the application form is presented and embedded on the Website, it is in fact a Zoho Forms form, and submissions are transmitted directly to and hosted within our Canadian-resident Zoho environment rather than being stored on the Website’s US-based front-end infrastructure.

We have executed a Data Processing Addendum (DPA) with Zoho that contractually obligates Zoho to process personal information only on our instructions, maintain appropriate security safeguards, restrict sub-processing and onward transfers, notify us promptly of any data breach, and support our compliance with PIPEDA.

WhatsApp — Important Limitation on Data Residency

Please read this carefully:

Unlike our Zoho environment, WhatsApp is operated by Meta Platforms, Inc. Messages you send us via WhatsApp are transmitted and, depending on Meta’s infrastructure and your and our device settings, may be stored or processed outside Canada, including in the United States. Our Canadian-data-residency commitment in Section 5.1 applies to information stored in our Zoho environment; it does not extend to the underlying transmission and storage of WhatsApp messages, which is governed by Meta’s own privacy policy and terms. If you would prefer that your information remain solely within our Canadian- resident systems, we encourage you to use email or our Website contact form instead of WhatsApp.

We recommend reviewing WhatsApp’s own privacy policy before using it to send us sensitive information, including credentialing or health-related documentation. Where practical, we ask that
sensitive documentation be submitted via our Website forms or secure email rather than WhatsApp.

Links to Other Websites

The Website may contain links to third-party websites, job boards, hospital/employer career pages, or social media platforms that are not owned or operated by Sorig Inc. We are not responsible for the privacy practices, content, or security of such third-party sites. This Policy applies solely to personal information collected by Sorig Inc. through the channels described in Section 2. We encourage you to review the privacy policy of any third-party site before providing personal information to it.

Why We Collect Your Personal Information (Identifying Purposes)

Consistent with PIPEDA’s Identifying Purposes principle, we only collect personal information for purposes that are identified to you at or before the time of collection, including to:

• Respond to your inquiries, quote requests, or support requests;
• Evaluate your qualifications, verify credentials, and match you with suitable travel nursing placement opportunities;
• Share relevant credentialing and qualification information with prospective hospital/employer clients, strictly as necessary to facilitate a specific placement, and with your knowledge;
• Provide, operate, and improve our recruitment and placement services;
• Communicate with you, including service updates, confirmations, and (where you have consented) marketing or newsletter content;
• Process transactions and maintain business records;
• Maintain the security and integrity of the Website and our systems;
• Comply with legal, regulatory, or contractual obligations (including provincial nursing licensures and healthcare compliance requirements); and
• Any other purpose disclosed to you at the time of collection, with your consent.

We will not use personal information for a new purpose not previously identified without first obtaining your consent, except where required or permitted by law.

Consent

We collect, use, and disclose personal information only with the knowledge and consent of the individual, except where consent is not required by law (e.g., for legal, security, or investigative
purposes as permitted under PIPEDA).

• Express consent is obtained for sensitive uses, such as enrolling you in marketing communications or collecting health-related compliance documentation.
• Implied consent may apply for routine purposes that are evident from the context — for example, responding to an inquiry you submitted.

You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting our Privacy Officer or using the unsubscribe mechanism in our email communications. Withdrawing consent may limit our ability to provide certain services to you.

Canada’s Anti-Spam Law (CASL)

Where we send you commercial electronic messages (“CEMs”), such as recruitment opportunity emails or marketing newsletters, we do so in accordance with CASL. Each CEM will:

• Identify Sorig Inc. as the sender and provide our contact information;
• Be sent only where we have your express or implied consent (for example, because you have an existing business or non-business relationship with us, or you have opted in); and
• Include a functional unsubscribe mechanism that we honour within 10 business days of your request.

You may withdraw consent to receive CEMs at any time using the unsubscribe link or by contacting our Privacy Officer. Note that transactional or service-related messages necessary to a placement you are actively pursuing (e.g., confirming a submitted credential) are not marketing messages and may continue even after you unsubscribe from newsletters.

Limiting Collection

We limit the collection of personal information to what is reasonably necessary for the purposes identified in Section 7. We do not collect personal information indiscriminately, and form fields on the Website are designed to request only the information required to fulfill your request.

Use, Disclosure, and Retention

Use & Disclosure

• We do not sell, rent, or trade personal information. We may disclose personal information only:
• To employees, contractors, or service providers (such as Zoho) who require it to perform services on our behalf, under contractual confidentiality and security obligations (including the DPA
  described in Section 5);
• To prospective or confirmed hospital, clinic, or other healthcare employer clients, but only the credentialing, qualification, and contact information reasonably necessary to evaluate or confirm a
  specific placement, and only once you have indicated interest in that opportunity;
• Where required by law, regulation, court order, or healthcare regulatory body (e.g., provincial nursing colleges), or to respond to lawful government requests;
• To protect the rights, property, or safety of the Company, our candidates, clients, or the public;
• Publicly, in the case of an approved Housing Partner Application: property details and the contact information you designate are published on our Housing page so that placed nurses can view and reach out about your listing, consistent with the purpose for which you submitted the application; or
• With your consent

Retention

We retain personal information only as long as necessary to fulfill the purposes identified in this Policy,  or as required by law or legitimate business/legal record-keeping obligations. Because different categories of information are subject to different legal minimums in Canada, we apply the following retention schedule:

• General inquiry information (e.g., “Join Us” form submissions that do not lead to an active candidate relationship): retained for up to 2 years of inactivity following your last contact with us,
  and then securely deleted if no further engagement occurs.
• Candidate credentialing, licensing, and placement records: retained for the duration of the candidate relationship, and for 6 years following the end of the last tax year to which any
  associated financial or payroll record relates, consistent with Canada Revenue Agency (CRA) requirements for records supporting income, expenses, and payroll. Where no financial/payroll
  record is created (e.g., a candidate profile that never results in a placement), credentialing information is retained for up to 2 years of inactivity and then securely deleted or anonymized.
• Payroll, invoicing, and financial records: retained for 6 years from the end of the last tax year they relate to, in accordance with CRA record-keeping requirements. This is the longest applicable
  minimum and takes precedence over shorter retention periods that might otherwise apply.
• Workplace injury or WCB-related records (where applicable to a placement): retained for 6 years, consistent with standard Canadian workers’ compensation record-keeping practice.
• Marketing/newsletter contact information: retained until you unsubscribe or withdraw consent, and for a limited period thereafter (up to 60 days) to honour suppression requests and prevent inadvertent re-contact.
• Housing Partner Application and listing information: retained for as long as your property listing remains active, and for up to 2 years following removal of the listing or your last contact with us, after which it is securely deleted or anonymized.

Where a candidate resides in or is placed within Ontario and health-related information is involved, retention and disposal of that health information may also be subject to Ontario’s Personal Health Information Protection Act (PHIPA), which we account for in addition to PIPEDA and the schedule above. After the applicable retention period has passed and no audit, legal proceeding, or regulatory inquiry is outstanding, personal information is securely deleted or anonymized. A full retention schedule, broken down by record type, is available on request from our Privacy Officer.

Accuracy

We strive to keep personal information as accurate, complete, and up to date as necessary for the purposes for which it is used. You may request a correction to your personal information at any time (see Section 14).

Safeguards

We protect personal information using physical, organizational, and technological safeguards appropriate to the sensitivity of the information, including:

• Encryption of data in transit (e.g., HTTPS/TLS on the Website);
• Reliance on Zoho’s Canadian data center infrastructure with contractually mandated security controls under our DPA;
• Restricted, role-based access to personal information within our organization, limited to staff who need it to perform their duties;
• Regular review of access permissions and security practices; and
• Confidentiality obligations imposed on employees and contractors.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; however, we are committed to using safeguards that meet or exceed industry standards and PIPEDA’s requirements.

Breach Notification

In the event of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm to an individual, we will:

• Notify the affected individual(s) as soon as reasonably possible, describing the nature of the breach and the steps being taken to mitigate harm;
• Report the breach to the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA; and
• Keep records of all breaches of security safeguards, regardless of whether notification was required, in accordance with PIPEDA’s record-keeping requirements.

Where a breach occurs at a service provider (such as Zoho), our DPA requires that provider to notify us promptly so that we can meet these obligations.

Individual Access and Correction

Subject to limited exceptions permitted under PIPEDA (e.g., legal privilege, security, or third-party privacy concerns), you have the right to:

• Request access to the personal information we hold about you;
• Request correction of any inaccurate or incomplete personal information;
• Request information about how your personal information has been used or disclosed; and
• Withdraw consent to certain uses, as described in Section 8.

To make a request, contact our Privacy Officer using the details below. We will respond within the timeframe required under PIPEDA (generally 30 days), and we may request identity verification before fulfilling your request.

Cookies and Tracking Technologies

The Website uses cookies and similar technologies (such as pixels or tags) to enable core functionality and to understand how visitors use the Website. We use the following categories:

• Strictly Necessary Cookies — required for core Website functions, such as form submission and security. These cannot be disabled without affecting basic functionality.
• Analytics Cookies — help us understand how visitors navigate the Website (e.g., pages visited, time on page) so we can improve it.
• Functionality Cookies — remember your preferences (e.g., language, previously entered form details) to improve your experience.
• Third-Party Cookies — placed by analytics or service providers (e.g., Google Analytics), used only for the purposes described in this section and not to sell your information.

You can control or disable cookies through your browser settings at any time; instructions are available for most major browsers (Chrome, Firefox, Safari, Edge). Disabling cookies may affect certain Website functionality. We do not currently respond to browser “Do Not Track” signals, as no common industry standard for interpreting them has been adopted.

Openness — Contact Us

In keeping with PIPEDA’s Openness principle, we make our privacy practices readily available. Questions, concerns, access/correction requests, or consent withdrawals should be directed to our
Privacy Officer:

• Privacy Officer: Kayla Gardiman-Smith
• Email: [email protected]

Challenging Compliance / Complaints

If you have a concern about how we have handled your personal information, please first contact our Privacy Officer (Section 17). We take all complaints seriously and will investigate and respond
promptly.
If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC):

• Website: www.priv.gc.ca
• Toll-free: 1-800-282-1376

If you reside in a province with its own privacy oversight body with jurisdiction over our activities, you may also have the right to complain to that provincial authority.

International / Cross-Border Considerations

While our Website’s front-end is hosted in the United States, as explained in Section 5.1, the personal information you provide through our forms, email, or CRM is processed and stored within Zoho’s Canadian data residency infrastructure under a binding Data Processing Addendum. As described in Section 5.2, this Canadian-residency commitment does not extend to messages sent via WhatsApp, which may be transmitted or stored outside Canada under Meta’s infrastructure.

Where any cross-border processing does occur, we take reasonable steps to ensure a comparable level of protection is maintained, consistent with PIPEDA’s accountability principle, which holds us responsible for personal information even when it is processed by third parties on our behalf.

Eligibility

Our services are intended for licensed or prospective healthcare professionals seeking employment opportunities and are not directed at children. We do not knowingly collect personal information from individuals under the age of majority in their province of residence through the Website. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or service providers. The “Last Updated” date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically. Material changes will be communicated through a notice on the Website or by email where appropriate.

Accountability

Sorig Inc. is responsible for personal information under its control and has designated a Privacy Officer accountable for our compliance with this Policy and PIPEDA. We have implemented policies and practices to give effect to the principles in this document, including staff training, contractual safeguards with service providers (including our DPA with Zoho), and procedures to respond to privacy inquiries and complaints.