Room 217 Foundation Privacy Policy

Applies to the MUSIC CARE by Room 217 website, store, portal, mobile application, and AI-assisted delivery portal

Last Updated: October 30, 2026

 

This Privacy Policy explains how the Room 217 Foundation® (“Room 217”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information relating to you when you use our online and mobile properties, including our website (musiccare.org), our online store (shop.musiccare.org), our subscriber portal (portal.musiccare.org), our “MUSIC CARE CONNECT” mobile application (the “App”), and our AI-assisted music care delivery portal and any successor or renamed service offering the AI Features described below (collectively, the “Services”).

This Privacy Policy applies to the actions of Room 217 and does not apply to any third party who is not employed by Room 217 or engaged to provide services to us. At Room 217, we are committed to protecting and respecting your privacy.

1. Introduction and General Terms

Room 217 is incorporated in Canada and is a registered Canadian charity (charity number 857285092RR0001) with its registered office at 970 Scugog Line 8, Port Perry, ON, L9L 1B2. Where we decide the purpose and means for the processing of personal information relating to you, we are the “controller” (or, under applicable Canadian privacy law, the organization accountable for that personal information). We comply with applicable data protection laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial privacy legislation, and with applicable laws in the United Kingdom and the United States to the extent they apply to our Services.

Privacy Officer. Room 217 has a Privacy Officer who is accountable for our overall compliance with this Privacy Policy and who is the primary contact on privacy and security matters. The Privacy Officer can be reached at: Tanya Albis, 905.852.2499, talbis@room217.ca. General questions may also be sent to info@musiccare.org.

This Privacy Policy should be read together with our Terms and Conditions and any other notices or agreements that may be relevant. It explains what information we may collect, how and why we use it, whether we disclose it to anyone else, and your choices and rights.

2. Information We May Collect About You

We collect and process the following categories of information, which may include your personal information:

• Contact and account information: your first and last name, email and/or postal address, phone number(s), country and place of residence, date of birth, username (typically your email address), and password.
• Profile and preference information: information about your preferences, interests, role (for example, professional or family caregiver), and organization, any context you choose to share about your situation, and the operating system and device you use (automatically collected).
• Subscription and purchase information: your subscription tier and history and records of purchases. Payments made through the Store or for subscriptions are processed by third-party payment providers; we do not store full payment-card numbers.
• AI interaction information: the prompts, questions, descriptions, and program details you enter into the AI Features, and the resulting AI-generated output. Please follow the guidance in our Terms and Conditions and Section 6 below and avoid entering directly identifying or health information about individuals in your care.
• Usage and technical information: information about how you interact with the Services, collected through cookies and similar technologies, such as the dates, times, and frequency of access.
• Information from social media and third-party platforms: where you interact with our content on platforms such as Facebook, Instagram, or YouTube.

3. How and Why We Use Your Information (Purposes and Consent)

We only collect, use, and disclose personal information with your knowledge and consent, which may be express or implied. We use personal information for the following purposes: to provide you with information about our products and services, including news about Room 217 that may interest you; to set up and administer your account (and, for organizations, to administer the accounts of authorized users); to enter into and perform our contract for the sale of our products and services; to provide, operate, secure, and improve the Services, including the AI Features; to respond to your enquiries and resolve issues; and to comply with our legal obligations.

We will not collect, use, or disclose more personal information than is reasonably necessary to meet these purposes, and we collect personal information only by fair and lawful means. If we want to use or disclose your personal information for a new purpose, we will advise you in writing and obtain your consent. You have the right at any time to withdraw or cancel your consent by contacting the Privacy Officer at talbis@room217.ca; withdrawal takes effect from the date of cancellation and is not retroactive. We will let you know if withdrawing consent could have consequences, such as our being unable to provide you with goods or services.

4. AI Features and AI Service Providers

Some of our Services include artificial-intelligence features — the Music Care AI Agent and the AI Program Builder (the “AI Features”). When you use the AI Features, the information you enter is processed to generate AI output for you. To deliver the AI Features, we (through our software and hosting partner, Innovasium Inc.) use trusted third-party AI service providers who process your inputs on our behalf.

Current AI service providers. The AI Features are currently delivered using Anthropic (Claude) large-language-model services accessed through Amazon Web Services (AWS) Bedrock, with primary processing and storage in the AWS Canada (Central) region. Amazon Web Services, Inc. and Anthropic, PBC act as our service providers (sub-processors) for the AI Features, alongside Innovasium Inc., which builds and operates the Services on our behalf. We may update this list of providers from time to time; we will update this Privacy Policy to reflect material changes.

No training of third-party models on your data. Our AI service providers process your inputs and the resulting output only to provide the AI Features to you. Under our arrangements with them, your inputs and outputs are not used by those providers to train or improve their own general AI models.

Improving the AI Features. We and our service providers may use de-identified or aggregated information derived from interactions with the AI Features to evaluate, maintain, and improve the AI Features and related services. This use does not identify you or any individual.

Voice input (dictation). Some parts of the Services offer an optional microphone button that lets you speak instead of type. If you use it, your web browser, not Room 217, sends your speech to the speech recognition service operated by the maker of that browser. For example, Chrome uses Google's service, Safari uses Apple's, and Edge uses Microsoft's. That service converts your speech to text and returns the text to the page. This processing is governed by the privacy policy of the browser you are using and may take place outside Canada.

We do not receive, listen to, record, or store your audio, and neither do our AI service providers. We receive only the resulting text, and only if you choose to send it, at which point we handle it in the same way as text you typed. Voice input is always optional. Your browser will ask your permission before the microphone is used, and you can decline or withdraw that permission at any time in your browser settings.

5. Who We Share Information With

We keep your information confidential and we do not sell your personal information. We may disclose your information to our personnel and to third-party suppliers, service providers, or subcontractors who help us operate the Services — including our software, hosting, and AI service providers (see Section 4), and third-party payment providers who process payments made through the Store or for subscriptions. We require these providers, by contract, to use your personal information only for the specific purposes for which we engage them, in accordance with our instructions and applicable law, and not for their own purposes.

The provider of your web browser's speech recognition service is not one of our service providers or subcontractors. We do not transmit your information to them, and we have no contractual relationship with them in respect of your use of voice input. See Section 4.

We may also disclose your information: to the extent required by law (including to government bodies and law enforcement); in connection with any legal proceedings or prospective legal proceedings, and to establish, exercise, or defend our legal rights; and in connection with a merger, acquisition, or sale of all or a portion of our assets, in which case you will be notified via email, account message, and/or a prominent notice on the Website. Some data sharing may involve the transfer of information outside your country — see Section 8 (International Data Transfers).

6. Personal and Health Information in the AI Features

The AI Features are designed to help you plan and deliver music care. To protect the privacy of the people in your care, please do not enter directly identifying information about any individual (such as full name, contact details, or health-record identifiers) into the AI Features, and describe people in your care in general, non-identifying terms.

United States users should not input “Protected Health Information” as defined under HIPAA. The AI Features are not a HIPAA-compliant service and we do not act as a HIPAA “business associate.” Where the Services process personal health information about identifiable individuals in Ontario, Room 217 (or the health information custodian using the Services) is responsible under Ontario's Personal Health Information Protection Act, 2004 (PHIPA), and our software and AI providers act as agents/service providers on that party's behalf. Please avoid entering special categories of sensitive information, biometric identifiers, or information about children into the AI Features.

7. How Long We Keep Your Information (Retention)

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, to provide the Services, and to meet our legal, accounting, and reporting obligations. Some information may be retained longer where required by the Canada Revenue Agency, by our insurers, or by other applicable law. The following schedule describes our general retention approach:

If you have made a request to access your personal information, we will keep that information for as long as necessary to allow you to exhaust any recourse you may have under applicable law. If you would like us to stop using your personal information, please email the Privacy Officer at talbis@room217.ca.

8. International Data Transfers

Some of the personal information we collect may be transferred to, stored by, or processed by third-party service providers located outside your country, including in the course of delivering the Services. Our primary processing for the AI Features and related data takes place in Canada (the AWS Canada (Central) region). In limited circumstances, and to deliver specific features, transient processing may occur in other regions within our providers' authorized networks, including regions in the United States. Music Content is licensed for streaming to authorized users in Canada, the United Kingdom, and the United States. Where you use the optional voice input feature described in Section 4, speech recognition is carried out by the maker of your web browser and may take place outside Canada. That transfer is made by your browser rather than by us.

Where personal information is processed in the United States or other jurisdictions, it may be subject to access requests from governments, courts, or law enforcement in those jurisdictions under their laws. We use contractual and technical measures — including our providers' data-processing terms — to provide a comparable level of protection wherever your personal information is processed. If you are located in the European Union, please note that our Services are not directed to you and you should not use them or provide personal information; we do not knowingly process the personal information of individuals located in the EU.

9. Your Rights and Choices

We offer the following rights and choices to all users, regardless of where you live, as our single standard:

• Access: you can ask us whether we hold personal information about you and request access to it.
• Correction: you can challenge the accuracy and completeness of your personal information and ask us to correct it.
• Deletion: you can ask us to delete personal information we hold about you, subject to legal and legitimate business retention needs.
• Withdraw consent / opt out of marketing: you can withdraw consent or unsubscribe from marketing communications at any time.
• Opt out of sale or “sharing”: we do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are used under U.S. state privacy laws. If this ever changes, we will provide a clear opt-out mechanism and update this Policy first.
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact the Privacy Officer at talbis@room217.ca. We will respond within the time periods required by applicable law and may need to verify your identity before acting on your request. If you are not satisfied with our response, you may contact the applicable privacy regulator (for example, the Office of the Privacy Commissioner of Canada).

10. Marketing, Cookies, and CASL

Our Services may contain third-party advertising and links to other websites, which have their own privacy policies for which they are solely responsible. We are not responsible for the privacy practices of third parties, and your use of their sites is at your own risk. We may collect personal information when you interact with our content on third-party platforms such as Facebook, Instagram, or YouTube, and we may use this to better understand our community and create relevant content.

We use cookies and similar technologies to understand how users interact with the Services and to improve them. This information is not used to develop a personal profile of you. You can disable cookies by changing your browser settings, although some features may then be unavailable.

Where we provide you with information about our products, services, or offers by email, we comply with Canada's Anti-Spam Legislation (“CASL”). We do not send commercial electronic messages unless we have express or implied consent, the message identifies the sender and includes contact information, and the message has an unsubscribe mechanism. Complaints and unsubscribe requests should be directed to the Privacy Officer, talbis@room217.ca.

11. Data Relating to Children

The Services are intended for users who are 18 years of age or older and are not directed to children. We do not knowingly collect personal information from children. If a parent or guardian becomes aware that a child has provided us with personal information, or is otherwise interacting with us without consent, please bring it to our immediate attention at info@musiccare.org, and we will make it a priority to delete information relating to that child as soon as practicable. Please also do not enter any information about children into the AI Features.

12. Security of Data

We protect personal information using security safeguards appropriate to the sensitivity of the information, including physical measures (such as restricted access to offices), organizational measures (such as limiting access on a need-to-know basis), and technological measures (such as passwords, access controls, and encryption in transit and at rest). More sensitive information is safeguarded by a higher level of protection. Access to your account is controlled by a password and username unique to you. While we devote considerable resources to security, no system can prevent all breaches, and we cannot ensure or warrant the security of information you provide. You can reduce risk by using strong passwords, keeping them confidential, and following other security best practices. If we become aware of a breach affecting your personal information, we will notify you and the applicable regulator where required by law.

13. Changes to This Policy

This Privacy Policy may be updated from time to time. We will notify you of changes by posting the new version on our Website and updating the “Last Updated” date. Where changes are material, we will provide more prominent notice. You are advised to review this Privacy Policy regularly.

14. Contact Us

Questions, comments, and requests in relation to this Privacy Policy are welcome and should be addressed to the Privacy Officer, Tanya Albis, at talbis@room217.ca, or to info@musiccare.org.