Legal

Privacy Policy

Last updated: August 31, 2026

Boreal Lab Inc. ("Boreal Lab," "we," "us," or "our") operates Northern Scribe and FleetOS (the "Services"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data. We are a Canadian company and design our data practices to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information We Collect

We collect the following categories of information:

  • Account and carrier information — name, email address, company/carrier name, business address, tax number, team membership, and login credentials.
  • Operational data — load numbers, customer names, rates, appointment times, pickup/delivery locations, pallet counts, and stop-level in/out timestamps you or your team enter into FleetOS.
  • Driver and equipment information — driver name, phone number, licence number, class, province, expiry date and licence image, plus equipment identifiers such as unit number, plate, and VIN.
  • Shipment documents and communications — proof-of-delivery images, invoices, rate confirmations, tender emails, SMS messages, detention notices, ETA notices, and dispute correspondence.
  • Email content (Gmail integration) — load confirmation emails and PDF attachments, processed as described in Section 2 below.
  • Integration and billing information — connected Gmail address and authorization tokens, TMS connection status, subscription plan and status, Stripe customer/subscription identifiers, and billing or factoring contacts. We do not store full payment-card numbers.
  • Clinical session data (Northern Scribe) — audio recordings and transcriptions of physiotherapy sessions, and the SOAP notes generated from them. This data is subject to the Personal Health Information Protection Act (PHIPA).
  • Usage data — service logs and first-party conversion analytics collected when you use our Services or visit FleetOS marketing pages.

On public FleetOS pages, our first-party conversion measurement stores a random browser identifier in local storage and records the page path, referring domain, and campaign labels such as UTM source, medium, and campaign. These analytics events do not contain form answers, email addresses, names, full referring URLs, or raw IP addresses, and we do not send them to a third-party advertising or analytics platform. If you submit a pilot application, its first-touch campaign labels are stored with that application so we can measure whether the channel produced a qualified call, pilot, or paid customer.

We use this information to provide and improve the Services, generate detention notices and dispute documentation, automate load creation, and communicate with you about your account.

2. Gmail Integration — Limited Use Disclosure

FleetOS offers an optional Gmail integration that lets your dispatch team automatically create loads from load confirmation emails. If you choose to connect your Gmail account, here is exactly what happens:

  • We request gmail.readonly, gmail.modify, gmail.send, and gmail.settings.basic. These permissions let FleetOS find load-confirmation messages, retrieve attachments, mark successfully processed tenders as read, send operational messages from the connected account when your workflow calls for it, and read basic send-as settings such as the account signature.
  • We download PDF attachments from matching emails and send them to Anthropic's Claude API to extract load information (load number, customer name, pickup/delivery locations, appointment times, pallet count, and rate).
  • Extracted data is used solely to create or update load records in your FleetOS account.
  • FleetOS can use the connected account to send dispatcher-initiated or dispatcher-confirmed detention and dispute messages. FleetOS does not use a carrier's mailbox to send Boreal Lab marketing.
  • We do not read, store, or use the content of your emails for advertising, and we do not transfer Gmail data to third parties except as necessary to provide the feature—for example, sending a tender attachment to Anthropic for parsing or delivering a message through Google.
  • We do not use Gmail data to train AI/ML models, general or otherwise.
  • Successfully processed email content and attachments are not retained after extraction; the resulting structured load record and a Gmail message/thread reference are stored. If a tender cannot be processed, its subject, sender, raw content, and best-effort parse may remain in the carrier's unresolved-tender review queue until it is resolved, removed, or the account is deleted.
  • You can disconnect Gmail access at any time from Settings, which immediately stops further access and you can separately revoke Boreal Lab's access at myaccount.google.com/permissions.

Boreal Lab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Share Information

We do not sell your personal information. We share data only with the following service providers ("subprocessors"), each of whom processes data on our behalf and under contractual confidentiality obligations:

  • Supabase — database hosting, authentication, and file storage.
  • Resend — transactional email delivery (e.g., detention notices, account notifications).
  • Vercel — application hosting and serverless functions.
  • Anthropic — AI processing for parsing load confirmation PDFs (FleetOS) and generating clinical documentation (Northern Scribe).
  • Google — Gmail authorization, tender retrieval, and sending from a connected Gmail account.
  • Twilio — SMS delivery and inbound proof-of-delivery messages from drivers.
  • Stripe — subscription checkout, payment processing, and billing management. Stripe receives payment details directly; FleetOS stores identifiers and subscription status rather than full card data.

We may also disclose information if required by law, regulation, or legal process, or to protect the rights, property, or safety of Boreal Lab, our users, or others.

4. Data Retention

FleetOS retains account records, operational records, driver information, licence images, and POD documents while the account is active so the carrier can operate and maintain its business records. An owner may request account deletion in Settings. FleetOS provides a 14-day cancellation period, then creates a private export and purges carrier-scoped database records, integration credentials, PODs, licence images, and the owner's login when it is not used by another carrier account. The export link expires after seven days and the underlying export object is removed by the following daily cleanup cycle. Limited records may be kept where law, fraud prevention, dispute resolution, or financial reporting requires it.

Clinical session data handled by Northern Scribe is retained in accordance with applicable health information regulations and your clinic's record-keeping obligations under PHIPA. Service providers may keep their own billing, security, or delivery records under their agreements and legal obligations.

5. Data Security

We use safeguards including encryption in transit, tenant access controls, row-level security on our database, private storage for licence and POD documents, short-lived signed document links, and restricted server-side integration credentials. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

Under PIPEDA and applicable Canadian privacy law, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Withdraw consent for our collection, use, or disclosure of your information, subject to legal or contractual restrictions.
  • Request deletion of your personal information, subject to our retention obligations.
  • Disconnect third-party integrations (such as Gmail) at any time.

To exercise any of these rights, contact us using the information below.

7. International Data Transfers

FleetOS's primary operational records stored with Supabase are configured in the Canada (Central) region. This does not mean every FleetOS processing activity occurs in Canada. Other service providers—including application hosting, transactional email, Gmail, and AI providers—may process or store data outside Canada, including in the United States. By using the Services, you consent to the transfer of your information to these jurisdictions, which may have data protection laws different from those in Canada.

8. Children's Privacy

Our Services are intended for business use by adults and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at [email protected].

← Back to Boreal Lab