Privacy Policy

HeadStart Affordable™ (“HeadStart,” “we,” “us” or “our”) operates in association with MidRise5.

This policy explains how we collect, use, disclose and protect personal information through our website, licensing portal and related communications.

The website and portal support professional enquiries and applications to license building designs. They are not used to apply for residential housing or assess prospective tenants.

Depending on how you interact with us, we may collect:

• Contact information: your name, email address, telephone number, job title and organisation.
• Account information: registration details, account identifiers, verification status and account preferences.
• Organisation and project information: legal business name, billing address, proposed project location, site-control information, housing objectives, project stage and anticipated timeline.
• Signing and billing contacts: names, roles and contact details of people involved in a proposed licensing transaction.
• Applications and communications: saved drafts, submitted applications, revisions, questions, correspondence and information supplied during our review.
• Administrative records: application status, review notes, assigned contacts, follow-up activity and decisions.
• Technical information: IP address, browser and device information, timestamps and security or error logs generated when you use the service.
• Consent preferences: whether and when you opted into marketing communications or changed your preferences.

The application form saves information as you complete each step so you can return to a draft. Information may therefore be stored before you submit your application.

Please provide only information relevant to your enquiry or licensing application. Do not submit tenant records, health information, government identification numbers or other unnecessary sensitive information.

If you provide information about another person, ensure you have the authority or consent needed to share it and direct them to this policy.

We use personal information to:

• Respond to enquiries and explain HeadStart licensing.
• Create and administer accounts.
• Save, review and manage applications.
• Understand proposed projects and determine appropriate next steps.
• Communicate with applicants, authorised signers and billing contacts.
• Manage organisation and project access.
• Maintain application versions and activity records.
• Protect the service, investigate errors and prevent misuse.
• Meet applicable recordkeeping and legal obligations.
• Send marketing updates where we have the required consent or another lawful basis.

We limit collection and use to information reasonably needed for these purposes. If we propose a materially different use, we will explain it and obtain additional consent where required.

Submitting an application does not create a licence or grant permission to use HeadStart drawings.

Where consent is required, we seek it in a manner appropriate to the information and its intended use.

Marketing consent is separate from creating an account or submitting an application. You do not need to subscribe to marketing communications to enquire about a licence.

You can withdraw marketing consent using the unsubscribe option in a marketing email or by contacting us. We may still send necessary account, security or service communications.

You may also contact us to withdraw consent for other uses, subject to legal or contractual restrictions and reasonable notice. We will explain any consequences, such as being unable to continue processing your application.

Access is limited according to a person’s role and responsibilities.

Authorised HeadStart personnel and service providers may access information needed to operate the service and process enquiries or applications.

Within an organisation’s portal workspace, organisation owners may access its applications and authorised projects. Other members receive access according to their assigned permissions. Please consider this shared access when submitting information on behalf of an organisation.

Internal HeadStart review notes are restricted to authorised administrators.

We do not sell personal information or provide contact lists to third parties for their independent marketing.

We use service providers to support functions such as hosting, authentication, database storage, security and technical maintenance. The current portal uses Lovable Cloud.

Providers receive access only as needed to deliver their services, subject to applicable agreements and safeguards. We remain responsible for personal information handled on our behalf.

We may also disclose relevant information:

• To professional advisers where necessary and subject to appropriate confidentiality obligations.
• When required or permitted by law.
• To investigate misuse or protect legal rights, property and safety.
• In connection with a business transfer, subject to applicable privacy requirements.

We do not routinely share applications with external design or engineering partners. If their involvement requires disclosure of personal information, we will explain the purpose and obtain consent where required.

Our service providers may process or store information outside your province or outside Canada. Information processed in another country may be subject to that country’s laws and lawful access by its authorities.

You may contact us for information about the providers and processing locations relevant to your personal information.

The website and portal use cookies or similar browser storage where needed for sign-in, session management, security and essential functionality.

You can manage cookies through your browser settings. Blocking essential cookies may prevent some portal features from working.

If we introduce optional analytics, advertising trackers or third-party video embeds that collect personal information, we will update the relevant disclosures and provide consent choices where required.

Online agreement signing, payment processing and licensed drawing delivery are planned additions to the portal. They are not active features of the current Stage 1 release.

Before introducing these features, we will update this policy and any relevant notices to explain additional information collection, providers and uses.

Do not enter payment-card details, bank credentials or other payment secrets into application fields or general messages.

We retain personal information only as long as reasonably necessary for the purposes described in this policy, including application administration, business records, security, legal obligations and resolving disputes.

Retention depends on the type of record and whether an enquiry or licensing relationship remains active. Saved drafts and unsuccessful applications will not be retained indefinitely without a continuing purpose.

When information is no longer required, we delete it, securely dispose of it or anonymise it. Backup copies may remain until they expire through the applicable backup cycle.

Closing an account may not immediately remove records we must retain for legitimate legal or business purposes.

We use administrative and technical safeguards appropriate to the sensitivity of the information, including authentication, restricted access and backend permission checks.

No internet service or storage system can guarantee absolute security. Please protect your account credentials and notify us if you suspect unauthorised access.

If a privacy incident occurs, we will assess it and take the notification and reporting steps required by applicable law.

You may contact us to:

• Ask what personal information we hold about you.
• Request access to that information and an explanation of how it has been used or disclosed.
• Request correction of inaccurate or incomplete information.
• Ask about retention or request deletion or account closure.
• Withdraw consent or raise a privacy concern.

We may need to verify your identity or authority before responding. We will request only information reasonably needed for verification.

Requests are subject to applicable law and exceptions, including protection of other people’s information and required recordkeeping. If we cannot fulfil a request, we will explain why, where permitted, and describe available recourse.

We will respond within the time required by applicable law.

Our website may link to project partners, industry resources and other websites. Those organisations manage their own information practices. Review their privacy policies before providing information to them.

We may update this policy as our services and information practices change. The current version will show its effective date.

Where a change materially affects how we handle personal information, we will provide additional notice and obtain consent where required.

For privacy questions, requests or complaints, contact:

Please use the subject line “HeadStart Privacy Request.”

If your concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or another applicable privacy regulator.

General portal support remains available at Headstart@MidRise5.ca.