melyn ("we", "us") is an Alberta company that provides the melynBrain platform to First Nations and Indigenous organizations. This policy explains what personal information we collect through melynBrain and its mobile apps, why, how we protect it, and the choices you have. It applies to the platform at melyn.ai, to the melynBrain staff and citizen mobile apps, and to our communications with platform users. Our public website at melyn.ca has its own privacy policy.
1. Nation data and our role
Most of the information inside melynBrain belongs to the Nation or organization that uses it: member records, program files, financial records, governance documents, and the outputs the platform produces from them. melyn holds that information on the Nation's behalf as its service provider and processes it only on the Nation's instructions, under a Data Processing Agreement aligned with the OCAP principles of Ownership, Control, Access, and Possession. The Nation decides what is collected, who can see it, and when it is deleted.
If you are a member of a Nation and want to access or correct information held about you in melynBrain, contact your Nation's administration. We will support them in responding.
This policy covers the smaller set of personal information that melyn collects and controls in order to run the platform, described below.
2. What we collect and why
Staff and administrator accounts. When a Nation gives you access to melynBrain, on the web or through the staff app, we hold your name, work email, role, organization, sign-in records, device and app version information, and the settings you choose. We use this to operate your account, secure the platform, provide support, and send you service notices. Your Nation controls your role and access.
Citizen accounts. If your Nation offers the citizen portal or citizen app, your account is created with your Nation and linked to your record in its member registry. We hold your sign-in details, the contact details you provide, and the requests and messages you submit through the portal. Your Nation controls what services are available to you and who in its administration can see your requests.
Notifications. If you turn on push notifications, we hold the device token needed to deliver them. You can turn notifications off at any time in the app or your device settings.
Platform logs. The platform records technical logs of requests (such as the account, action, time, and result) to keep it secure and to diagnose problems. Logs do not record the content of records or messages.
Support requests. The content of support tickets and emails you send us, so we can resolve them and improve the platform.
Our services are directed at Nations and organizations and the people who work with them. We do not knowingly collect personal information from children outside of records a Nation holds about its members.
3. No tracking or advertising
melynBrain does not use analytics, advertising, or tracking services. The platform sets only the cookies and local storage needed to keep you signed in and remember your settings. We do not build profiles of users, we do not sell personal information, and we do not use Nation data or personal information to train artificial intelligence models.
4. How we use information
- To provide, secure, support, and improve the melynBrain platform and apps.
- To communicate with you about the platform, including service notices and security alerts.
- To respond to support requests.
- To meet legal, accounting, and regulatory obligations.
5. Koda and AI features
melynBrain includes AI-assisted features, including the Koda assistant. The AI features in melynBrain run in Canadian data centres, and the content processed by them is not shared with the companies that develop the underlying models. We do not use Nation data or personal information to train artificial intelligence models.
6. Who we share information with
We share personal information only with service providers that help us run the platform, and only for the purposes above:
- Amazon Web Services (Canadian regions): hosting, storage, backups, monitoring, AI processing, and notification email.
- Apple and Google: delivery of push notifications to your browser or device if you turn them on. Only the device token and the alert text pass through their services, and this may route outside Canada.
- Microsoft (Canadian data centres): our business email, used for support correspondence, and sign-in where an organization uses Microsoft accounts.
- Professional advisors, insurers, and authorities where the law requires or permits it.
Each provider is bound by contract to protect the information and to use it only to provide its service to us.
7. Where information is stored
Nation data and the personal information held in melynBrain are stored and processed in Canada. The one routine exception is push notifications, which pass through Apple and Google services if you turn them on. If we ever introduce a platform feature that would move Nation data outside Canada, we will tell the affected organizations first and let them decline it.
8. How we protect information
All traffic is encrypted in transit, and databases and file storage are encrypted at rest. Each Nation's data is kept in its own separate database and storage, apart from every other Nation's. Access to our infrastructure is limited to people who need it for their work and is logged, and we are extending activity logging inside the platform. We keep daily backups for 14 days with deletion protection on the production database, monitor for security events, and have a process for responding to and notifying affected organizations about any incident. No system is perfectly secure, so please contact us immediately if you believe your account has been compromised.
9. How long we keep information
- Account and platform information: for as long as your organization uses melynBrain, then returned or deleted on the organization's instructions, with backups purged within 90 days.
- Platform logs: 90 days.
- Support correspondence: for the life of the relationship and as long afterward as legal and accounting rules require.
10. Your rights and choices
You may ask to see the personal information we hold about you, ask us to correct it, or withdraw consent for uses that depend on consent. Write to privacy@melyn.ca. We respond within 30 days, or tell you if we need longer and why, as the law allows. Requests about information held inside melynBrain on behalf of a Nation are handled with that Nation, and we will direct you to the right contact.
If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
11. Changes to this policy
We update this page when our practices change and show the date at the top. Material changes are also announced to melynBrain organizations by email.