Data protection, minimal retention, and compliance.
How The Skill Corner handles client operational data, conforms with Canadian privacy regulations (PIPEDA and PHIPA), and enforces transit-focused minimal-retention architectures.
At The Skill Corner, we engineer AI automations and systems that connect your existing business tools. Data privacy, confidentiality, and compliance with Canadian privacy legislation (including PIPEDA and PHIPA) are structural principles embedded into our software architecture.
1. Information We Collect
We collect only the technical and operational information strictly necessary to fulfill our client service engagements, deliver our diagnostic tools, and respond to direct inquiries:
Name, email address, phone number, and business name voluntarily submitted when requesting our diagnostic checklist, submitting a contact query, or booking an audit call.
Scoped API tokens, integration credentials, or webhook endpoints required to connect your active systems (e.g. Cal.com, CRM, phone trunks, or practice software).
2. How We Handle Data
We operate on a minimal-retention, done-in-place data architecture:
No Central Database of Customer Records
We do not store, compile, or broker database records of your patients, clients, or customers. Your customer database stays exclusively within your existing licensed software.
Transit-Focused Ephemeral Processing
Automations process information strictly in transit (such as evaluating a webhook payload from a booking system, formatting an SMS reminder, and handing it to Twilio). Serverless operational logs preserve only bounded event statuses, timestamps, and error codes without persisting message bodies.
Direct System Connectors
We configure AI models and automations to read and write directly to your existing compliant tools (such as EMRs, PMSs, or client intake databases) rather than centralizing records on proprietary secondary servers.
3. PIPEDA & PHIPA Compliance
For our professional practice clients across healthcare, dental, legal, and financial services:
We operate as an Electronic Service Provider under Ontario's Personal Health Information Protection Act. We do not access, process, or persist personal health information (PHI) except as strictly required to run your deterministically scoped automation pathways.
We conform to the ten fair information principles of the Personal Information Protection and Electronic Documents Act, ensuring accountability, limiting collection, and guaranteeing strict security safeguards.
We prioritize routing and persisting operational telemetry within Canadian data regions where supported by cloud vendors, and execute formal Data Protection Agreements prior to deployment.
4. Third-Party Service Providers
Our automations rely exclusively on vetted enterprise-tier APIs and infrastructure:
Anthropic & OpenAI API commercial endpoints. Under commercial API terms, data sent through models is never used to train public models and is retained strictly for ephemeral abuse monitoring.
Telephony and SMS communications are securely routed through Twilio and certified telecom carriers under enterprise data transit terms.
5. Website Telemetry, Analytics & Observability Implementation
To diagnose broken user journeys, verify form delivery, and monitor system latency, we run a strictly governed observability architecture. Telemetry providers are disabled by default and only activate in production when explicit environment keys and endpoints are configured:
When configured, high-level funnel milestones (page views, package selections, and form submissions) are recorded without cross-site tracking or user profiling. We do not collect persistent hardware fingerprints, payment credentials, or personal form text in analytics payloads.
Uncaught client-side runtime errors and API failures are captured with sanitized contextual metadata (release version, route path). Form inputs, authorization tokens, and PII keys are scrubbed via automated regex redaction filters prior to transmission.
If session replay is explicitly enabled on public marketing routes, strict privacy masking is enforced client-side: all input fields use Hidden Mode (inputMode: 2), obscuring text, numbers, and emails before DOM transmission. Network payload capture is disabled (capturePayload: false), meaning request and response bodies are never recorded, and authorization and cookie headers are excluded.
Our telemetry pipeline is architected to fail-open: if an analytics or telemetry endpoint is blocked by an ad-blocker or network failure, all marketing pages, booking calendars, and inquiry forms continue to function with zero disruption. The session recorder respects standard browser Do Not Track (DNT) headers.
6. Contact Representative & Compliance Officer
For privacy inquiries, audit records, or to request a Data Protection Agreement prior to a practice deployment, contact our compliance officer: