Privacy Policy

Resilience Software is committed to protecting the privacy, confidentiality, and security of all individuals who use our services. This Privacy Policy explains in detail how we collect, use, store, share, and safeguard personal data, in compliance with international data protection frameworks.

In this policy, Clients are the institutions or organizations paying for the service; Users are the individual learners, instructors, and administrators entering data into the system.

By using T-Res, you acknowledge that you have read and understood this policy.

We collect and process only the personal data necessary to operate our services. Categories include:

a) Identification Data

• Full name, Client affiliation, professional role
• Contact details (email address, phone number if provided)
• Security answers from questions of your choice

b) Professional and Training Data

• Logbook entries (e.g., cases, procedures, training activities, personal reflections)
• Assessments, feedback, evaluations, and milestones
• Program performance reports and progress tracking
• Personal Health Data of patients entered by users on the platform

c) Technical Data

• IP address, device identifiers, operating system, and browser type
• Access logs and usage analytics

d) Communication Data

• Emails for support inquiries
• Customer survey responses
• Interaction records with our support or training staff

e) Client Data

• Client administrator notes, faculty evaluations
• Metadata on training program structure

We do not collect any other special categories of data (e.g., ethnic origin, gender, race, etc.) unless explicitly required for a Client.

2A. Resilience Software as Processor

Resilience processes trainee or patient personal data on behalf of a Client (hospital, university, company, association, or training program). The Client is the Data Controller, and Resilience acts as a Data Processor.

2B. Resilience Software as Controller

Resilience is a separate Controller for account administration, system analytics, cookie data, and product improvement; it remains a Processor for all logs, activities, evaluations and training data uploaded by the Client and its authorized users.

2C. Client as Data Controller

Clients decide why and how learner data is processed and stored in T-Res. Clients retain ownership rights to their data, including all inputs, outputs, and metadata.

2D. End Users

Learners and Instructors, as our end users, are the Data Subjects whose personal data is being collected and processed.

Processing is carried out under the following lawful bases:

• Contractual Necessity: To provide our product and services to trainees, instructors, and administrative staff as well as their respective institutions, companies, medical programs, and/or accrediting bodies.
• Legitimate Interests: To improve service quality, maintain security, and ensure proper functionality.
• Legal Obligations: To comply with educational, accreditation, or data protection requirements on behalf of our clients.
• Consent: For optional features, beta testing participation, or similar cases where explicit consent is provided.

3A. Special-category health data

Our products are used by medical professionals to record patient interactions and thus may sometimes include patient-identifiable information such as medical record numbers, names, case descriptions, and other special-category health data. We process such data on the legal basis of Art. 9(2)(h) GDPR / §7(I)(h) LGPD / 'health-care operations' under HIPAA / section 5(3) PIPEDA, always under the responsibility of the relevant health-care institution. Where local law requires explicit consent, the institution must obtain it before adding that data to the software.

We use collected data to:

• Deliver and maintain the software.
• Support training, assessment, and accreditation processes.
• Provide customer support and respond to inquiries.
• Improve the user experience.
• Generate anonymized benchmarking and research reports (with opt-out options).
• Detect and prevent fraud, abuse, or misuse of the platform.

We never use personal data for targeted advertising or unrelated marketing purposes.

a) Internal Data Access

Authorized staff of Resilience Software have role-based access to personal data.

b) External Sharing

• Service Providers: Resilience Software chooses service providers that are bound by strict confidentiality and meet specific security requirements, including data governance and access controls. Where health data is concerned, Resilience uses HIPAA compliant providers that permanently delete data after processing.
• Clients: Resilience Clients may grant their staff access to user data. Client administrators are responsible for adding and removing administrative staff. Single-Sign-On is supported, if needed.
• Legal and Regulatory Authorities: Only where required by law.
• Research Partners: Only anonymized or aggregated data is shared, with consent.

c) International Transfers

All Resilience Software data is stored in Canada. All clients assume responsibility for data exported to their local machines, wherever they may be. On rare occasions where personal data is transferred outside Canada for processing, data is encrypted in transit.

We retain personal data under the following circumstances:

• Training Records: personal training data is anonymized 1 year after a client’s contract with Resilience Software ends, or after the governing body’s (e.g. ACGME) minimum retention requirements are reached, whichever is later.
• Analytics Data: retained in anonymized form indefinitely.
• Backups: backups are retained for 7 days and destroyed after expiry.

Users have the following rights:

• Access: Obtain a copy of personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”): Request deletion (subject to client/institutional/legal requirements, where the Data Controller is not the Data Subject).
• Restriction: Limit processing in certain situations.
• Portability: Request transfer of data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: At any time, without affecting prior lawful processing.
• Lodge a Complaint: With your local data protection authority.

We respond to all valid requests within 30 days, extendable where permitted by law.

We apply multiple layers of protection:

a) Technical Safeguards

• Encryption of data in transit (TLS/SSL) and at rest.
• Firewalls, intrusion detection, and anti-malware defenses.

b) Organizational Measures

• Role-based access controls.
• Staff data security training.

c) Operational Practices

• Daily backups, stored securely.
• Business continuity and disaster recovery plans.
• Vendor risk management and contractual safeguards.

Resilience Software uses cookies to collect information to better understand how users interact with our Software, and how we can improve it. Cookies also help Resilience remember information about users, such as language preference or login information.

Data stored by cookies may include:

• IP address and information about the device you use to access the Services
• Traffic and Activity data
• Media Access Control (MAC) address
• Operating system name and version
• Device manufacturer and model
• Your language preferences
• Type and version of your Internet browser
• Name and version of the App you use
• App and Site traffic data
• Landing and exit page details
• Details of your session between pages of the Site to provide a continuity of experience
• Details of your session after launching the app to provide a continuity of experience
• Details of when you install and uninstall the App

Cookies are used to enhance the user experience. Web browsers may place cookies on a user’s computer to track users' settings and configurations while logged in to the software. Users may delete cookies via their browser, in which case some parts of the software may not function optimally.

In case of a breach of personal data:

• Clients are notified via email within 72 hours of a data breach containing their or their users' personal information.
• Relevant supervisory authorities are notified within 72 hours, where legally required.
• If the breach poses a high risk, affected individuals are informed without undue delay.

Internal incident response procedures ensure rapid detection, containment, and remediation.

Resilience Software occasionally partners on research projects that aggregate the data we collect.

• Users and clients must opt-in for their data to be included in research.
• Research data is anonymized before use.
• Users may opt out, withdraw, and object of research participation any time in their account preferences.
• No identifiable personal data is shared with research partners without explicit consent.

We have appointed a Data Protection Officer (DPO) to oversee compliance.

Contact Information:

• Email: dpo@resiliencesoftware.com
• Mail: Resilience Software DPO, P.O. Box 20022 Vancouver RPO Fairview, V5Z 0C1, Canada
• Phone: +1 (866) 694-2323

For complaints you may also contact: dpo@resiliencesoftware.com

We use trusted third-party vendors to support our services, including cloud hosting, email delivery, and customer support. These vendors are contractually bound to handle personal data securely and in compliance with international standards.

This Privacy Policy may be updated periodically to reflect legal, technical, or operational changes. Updated versions will be posted on the Resilience Software website and within Resilience software applications, with prominent notice for material changes.

This version is effective as of 2026-02-06.

T-Res remains fully committed to safeguarding personal data, complying with global standards, and fostering trust among institutions, trainees, and regulators.