Privacy policy

Ophelios values the protection of your personal information. This privacy policy explains, in plain and clear terms, how we collect, use and protect it (s. 8.2). It is generated from our personal information register and reviewed before publication.

Information collected and purposes

We collect the following categories of personal information: Business contracts and agreements: name, contact details, company, terms and signatures, Name and email address of Agreely early-access participants, Visits to ophelios.com measured by our audience tool (pages, referrer, device, approximate location), Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language, corvee.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location), La Corvée contact form messages: name, email address, message content and our replies, Platform administration log (Ophelios operators' acts), Cookie consent logs for client websites (identifier, choices, language; optional truncated IP and user agent) (mandate), Requests and correspondence: name, email address, company, message content and our replies, agreely.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location), Client invoices and accounting records (Memento), Activity log held for client enterprises (mandate), Records of organizations subscribed to La Corvée: people served, volunteers, members, donors (mandate), La Corvée activity log and technical logs (identifiers, timestamps, actions taken), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments), La Corvée user accounts (name, email, hashed password, sign-in factors, sessions), Client registry of client enterprises (encrypted name and email), Rights-request register held for client enterprises, Consent records held for client enterprises (mandate), Rights-exercise proofs (self-signed withdrawal and erasure), Citizen consent index (per-DID snapshots), Pseudonymous citizen identity (DID identifier, public part of your passkeys and of your recovery key), Billing information (Stripe identifiers, invoices), Security and anti-abuse logs (IP, user agent, timestamps), Authentication credentials (password hash, 2FA, passkeys, session cookies), Workspace account (name, email, role, language). They are used only for these specific purposes: Conclude, perform and evidence our contracts and agreements with clients, partners and investors, Invite you to try new Agreely features before launch and gather your feedback, Measure aggregate traffic to the ophelios.com site (opt-out: the Do Not Track signal, if your browser sends it, or the umami.disabled value in the site's local storage), Schedule, confirm and hold a meeting with Ophelios (demo, consultation or business meeting), Measure aggregate traffic to the corvee.ca site (opt-out: the Do Not Track signal, if your browser sends it, or an umami.disabled value in the site's local storage), Answer the people who write to La Corvée and keep a record of it, Account for the acts Ophelios operators perform on the platform, on accounts and on client workspaces, and keep proof of them, Carry out the mandate (record and prove the choices of visitors to client websites), Respond to your requests (support, sales, business relations, exercise of rights), maintain our relations with clients, prospects, partners and investors, and keep a record of them, Measure, in aggregate, how the agreely.ca site is visited (opt-out: agreely.ca/en/mesure-audience), Billing, accounting and tax obligations, Carry out the client enterprise's mandate: record who did what, and when, in its workspace, for its accountability and the security of its records, Carry out the organization's mandate: host and process its records according to its instructions (meals, transport, calls, volunteers, membership, budget), Ensure the security and traceability of the service and investigate incidents, Bill subscriptions and keep accounting and tax records, Operate the service: sign-in, account security and the necessary emails (invitations, account recovery, notices), Keep, for the client enterprise, its client list and prefill individual consent-request sends, Record, on the client's behalf, its persons' access, rectification and withdrawal requests and track the response deadline, Carry out the client enterprise's mandate: collect, record, verify and log the consents of its persons concerned, Verifiably prove that withdrawal or erasure was exercised and when, Show the citizen the consents they granted and let them withdraw or erase them, Create your signing identity, keep your consent wallet and let anyone verify your signatures, Bill the subscription, collect payment and keep accounting and tax records, Secure the service, prevent and detect abuse and diagnose incidents, Verify the user's identity and protect the account against unauthorized access, Create and administer the account, authenticate the user and communicate about the service.

Some information may be collected from third parties. You may request the source of information collected from another enterprise (s. 7).

For the following purposes we rely on your consent, which you may withdraw at any time (s. 8): Invite you to try new Agreely features before launch and gather your feedback, Measure aggregate traffic to the ophelios.com site (opt-out: the Do Not Track signal, if your browser sends it, or the umami.disabled value in the site's local storage), Measure aggregate traffic to the corvee.ca site (opt-out: the Do Not Track signal, if your browser sends it, or an umami.disabled value in the site's local storage), Measure, in aggregate, how the agreely.ca site is visited (opt-out: agreely.ca/en/mesure-audience).

The category "Business contracts and agreements: name, contact details, company, terms and signatures" (purpose: Conclude, perform and evidence our contracts and agreements with clients, partners and investors) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Without this information we can neither conclude the contract, nor perform it, nor evidence it.

The category "Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language" (purpose: Schedule, confirm and hold a meeting with Ophelios (demo, consultation or business meeting)) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither schedule the meeting nor hold it.

The category "La Corvée contact form messages: name, email address, message content and our replies" (purpose: Answer the people who write to La Corvée and keep a record of it) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither answer their request nor keep a record of it.

The category "Platform administration log (Ophelios operators' acts)" (purpose: Account for the acts Ophelios operators perform on the platform, on accounts and on client workspaces, and keep proof of them) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Use necessary for the purpose of preventing and detecting fraud and of assessing and improving protection and security measures (s. 12 para. 2 (3)).

The category "Cookie consent logs for client websites (identifier, choices, language; optional truncated IP and user agent) (mandate)" (purpose: Carry out the mandate (record and prove the choices of visitors to client websites)) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the client's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the client's person in charge and verification right (s. 18.3 para. 2). The client remains responsible (s. 3.1). "Contract" is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "Requests and correspondence: name, email address, company, message content and our replies" (purpose: Respond to your requests (support, sales, business relations, exercise of rights), maintain our relations with clients, prospects, partners and investors, and keep a record of them) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without this information, we can neither answer their request nor keep a record of it.

The category "Client invoices and accounting records (Memento)" (purpose: Billing, accounting and tax obligations) is held on a declared statutory basis (a legal retention obligation, s. 23), not on your consent: Tax laws (Revenu Québec, CRA) require keeping accounting records and supporting documents for about six years after the last relevant tax year. The law expressly reserves such a retention period provided by another law (P-39.1 s. 23).

The category "Activity log held for client enterprises (mandate)" (purpose: Carry out the client enterprise's mandate: record who did what, and when, in its workspace, for its accountability and the security of its records) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the client's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the client's person in charge and verification right (s. 18.3 para. 2). The client remains responsible (s. 3.1). "Contract" is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "Records of organizations subscribed to La Corvée: people served, volunteers, members, donors (mandate)" (purpose: Carry out the organization's mandate: host and process its records according to its instructions (meals, transport, calls, volunteers, membership, budget)) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the organization's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the organization's person in charge and verification right of the organization's person in charge (s. 18.3 para. 2). The organization remains responsible (s. 3.1). « Contract » is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "La Corvée activity log and technical logs (identifiers, timestamps, actions taken)" (purpose: Ensure the security and traceability of the service and investigate incidents) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Use necessary for the prevention and detection of fraud or the assessment and improvement of protection and security measures (s. 12 para. 2 (3)).

The category "Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments)" (purpose: Bill subscriptions and keep accounting and tax records) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Collection and holding necessary for the conclusion and performance of the subscription contract (s. 9 para. 1 (1)). Invoices are kept 6 years for tax purposes (terms of use, section 10).

The category "La Corvée user accounts (name, email, hashed password, sign-in factors, sessions)" (purpose: Operate the service: sign-in, account security and the necessary emails (invitations, account recovery, notices)) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Use necessary to provide the service requested by the person concerned (s. 12 para. 2 (4)): without a named account, La Corvée can neither authenticate the person nor give them access to their organization's records.

The category "Client registry of client enterprises (encrypted name and email)" (purpose: Keep, for the client enterprise, its client list and prefill individual consent-request sends) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the client's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the client's person in charge and verification right (s. 18.3 para. 2). The client remains responsible (s. 3.1). "Contract" is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "Rights-request register held for client enterprises" (purpose: Record, on the client's behalf, its persons' access, rectification and withdrawal requests and track the response deadline) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the client's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the client's person in charge and verification right (s. 18.3 para. 2). The client remains responsible (s. 3.1). "Contract" is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "Consent records held for client enterprises (mandate)" (purpose: Carry out the client enterprise's mandate: collect, record, verify and log the consents of its persons concerned) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Held as mandatary or performer of a service contract (s. 18.3 para. 1): the client's communication is necessary for carrying out the mandate; written mandate, use limited to the mandate, no keeping after expiry, incident notice to the client's person in charge and verification right (s. 18.3 para. 2). The client remains responsible (s. 3.1). "Contract" is the closest value in the current vocabulary; the operative provision is s. 18.3.

The category "Rights-exercise proofs (self-signed withdrawal and erasure)" (purpose: Verifiably prove that withdrawal or erasure was exercised and when) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Held as necessary for the requested service (s. 12 para. 2 (4)): verifiable withdrawal is the wallet's very function, and the proof is its object. Retention bounded by the 5-year penal limitation (s. 92.2).

The category "Citizen consent index (per-DID snapshots)" (purpose: Show the citizen the consents they granted and let them withdraw or erase them) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Held as necessary to provide the requested service (s. 12 para. 2 (4)): without the index, the "who holds what" dashboard and the withdrawal actions (s. 8 para. 1 (4)) are impossible.

The category "Pseudonymous citizen identity (DID identifier, public part of your passkeys and of your recovery key)" (purpose: Create your signing identity, keep your consent wallet and let anyone verify your signatures) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Held as necessary for the purpose of providing the service requested by the person concerned (s. 12 para. 2 (4)): the wallet cannot authenticate its holder or sign their consents without this key material. Pseudonymity is the minimization measure (s. 5). Your identifier and the public part of your keys are communicated to the enterprises and public bodies you answer, and published so that anyone can verify your signatures, including outside Québec. Your identifier is the same with every enterprise.

The category "Billing information (Stripe identifiers, invoices)" (purpose: Bill the subscription, collect payment and keep accounting and tax records) is held on a declared statutory basis (necessary to a contract, s. 9 para. 1 (1)), not on your consent: Collection and holding necessary for the conclusion or performance of the service contract (s. 9 para. 1 (1)). Retention after the relationship rests on the preservation periods provided for by tax statutes (s. 23 in fine).

The category "Security and anti-abuse logs (IP, user agent, timestamps)" (purpose: Secure the service, prevent and detect abuse and diagnose incidents) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Use necessary for the purpose of preventing and detecting fraud and of assessing and improving protection and security measures (s. 12 para. 2 (3)).

The category "Authentication credentials (password hash, 2FA, passkeys, session cookies)" (purpose: Verify the user's identity and protect the account against unauthorized access) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Use necessary for the purpose of preventing and detecting fraud and of assessing and improving protection and security measures (s. 12 para. 2 (3)). These credentials serve no purpose other than access control.

The category "Workspace account (name, email, role, language)" (purpose: Create and administer the account, authenticate the user and communicate about the service) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Held and used as necessary for the purpose of providing a service requested by the person concerned (s. 12 para. 2 (4)): without a named account, the workspace can be neither provided nor secured, and action accountability (s. 3.1) is impossible.

Some of this information is sensitive; where consent is required to use it for another purpose or to communicate it, that consent must be given expressly (ss. 12 para. 1 and 13 para. 2): Contains sensitive information: health (allergies, medical reasons for a ride), financial situation (contributions) and home access. Access is limited by role, the database refuses reads to roles without the right, and every consultation is logged. May contain sensitive personal information when the client enterprise declares a sensitive cell: where that cell rests on consent, express consent is then collected through the client's ceremony (s. 12 para. 1 in fine, s. 13 para. 2). Proportionate protection (s. 10): per-tenant encryption, strict isolation. Contextual sensitivity (s. 12 para. 4 (2)): some rows reveal that a consent covering a sensitive category (e.g. health information) was granted to a named enterprise. The sensitive content itself is not held here; protection is proportionate (s. 10).

Means of collection

We collect the information described above from you by the following means (s. 8):

online forms (website or application): Name and email address of Agreely early-access participants (through the Agreely consent form), Meetings booked on rdv.ophelios.com: name, email address, optional notes, time slot, time zone and language (on rdv.ophelios.com, when you book a meeting), La Corvée contact form messages: name, email address, message content and our replies, Cookie consent logs for client websites (identifier, choices, language; optional truncated IP and user agent) (mandate), Client invoices and accounting records (Memento), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments), La Corvée user accounts (name, email, hashed password, sign-in factors, sessions), Rights-exercise proofs (self-signed withdrawal and erasure), Pseudonymous citizen identity (DID identifier, public part of your passkeys and of your recovery key), Billing information (Stripe identifiers, invoices), Authentication credentials (password hash, 2FA, passkeys, session cookies), Workspace account (name, email, role, language);

automatically, when you use our online services (technical logs): Visits to ophelios.com measured by our audience tool (pages, referrer, device, approximate location) (by our audience-measurement tool, without cookies, when you visit ophelios.com), corvee.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location) (through our audience measurement tool, without cookies, when you visit corvee.ca), Cookie consent logs for client websites (identifier, choices, language; optional truncated IP and user agent) (mandate), agreely.ca browsing data, collected by our audience measurement tool (pages, referrer, device, approximate location) (through our audience measurement tool, without cookies, when you visit agreely.ca), Activity log held for client enterprises (mandate), La Corvée activity log and technical logs (identifiers, timestamps, actions taken), Citizen consent index (per-DID snapshots), Security and anti-abuse logs (IP, user agent, timestamps);

email: Business contracts and agreements: name, contact details, company, terms and signatures, Requests and correspondence: name, email address, company, message content and our replies, Client invoices and accounting records (Memento), Organizations subscribed to La Corvée (contact person, contact details, team size, subscription, invoices and payments);

telephone: Requests and correspondence: name, email address, company, message content and our replies;

in person: Requests and correspondence: name, email address, company, message content and our replies;

paper documents, including by mail: Business contracts and agreements: name, contact details, company, terms and signatures.

Professional contact information

Certain information concerns the exercise of a professional function within an enterprise (Client representatives' contact details (name, position, work email and phone), Professional invitation contact details (work email, role)). Under section 1 of the Act respecting the protection of personal information in the private sector (as amended by Law 25), the consent rules do not apply to it; it is not subject to consent or withdrawal. Your right of access and rectification and our incident obligations still apply.

Retention and destruction

Retention must be limited to the period necessary for the purposes of collection, followed by destruction or anonymization (s. 23). The periods below are declared rules, not proof of completed destruction. Platform administration log: kept for 36 months after the decision, then destroyed. As this information is used to make a decision, it is kept for at least one year after that decision (s. 11, para. 2). Correspondence and requests: kept for 24 months after the last exchange, then destroyed. Client representatives' contact details (Memento): kept for 24 months after the last activity, then destroyed. Umami audience measurement: raw events: kept for 13 months from collection, then destroyed. La Corvée contact form messages: kept for 24 months after the last exchange, then destroyed. Activity log held for client enterprises: kept for 24 months from collection, then destroyed. La Corvée organization accounts and records: kept for 24 months after the end of the organization's subscription, then destroyed. La Corvée activity log: kept for 24 months from collection, then destroyed. Transient data (tokens, codes, sessions): kept for 1 month from collection, then destroyed. Cookie consent logs (Témoins): kept for 36 months from collection, then destroyed. Proofs of exercised rights (citizen): kept for 60 months after the purposes are achieved, then destroyed. Mandate records (client companies): kept for 6 months after the purposes are achieved, then destroyed. Citizen wallet (identity and index), except the fingerprints recorded on the blockchain, which are permanent: kept for 12 months after the purposes are achieved, then destroyed. Billing and tax records: kept for 72 months after the purposes are achieved, then destroyed. Security and anti-abuse logs: kept for 12 months from collection, then destroyed. Workspace accounts: kept for 36 months after the purposes are achieved, then destroyed.

Protection of your personal information

We take reasonable security measures to protect your personal information, considering in particular its sensitivity, the purposes for which it is used, its quantity, its distribution and its medium (s. 10). When your information is destroyed, it is destroyed securely. They include, in particular: training and confidentiality undertakings, incident response, secure destruction, minimization and de-identification, logging and monitoring, access control, encryption, backups and recovery.

Recipients

Your personal information is accessible only to the persons in our organization whose duties require it. It may also be communicated to the following recipients. In Québec: Hébergement OVH inc. (hosting of our servers). Outside Québec: Alchemy (access to the Base blockchain), Anthropic (automated cookie categorization), Apple (iCloud) (calendar for demo meetings), Cloudflare (delivery of La Corvée's website and name servers), DigitalOcean (hosting of the public websites), Fly.io (hosting of website audience measurement), Stripe (payments and billing), Zoho Mail (relay of transactional emails).

Hébergement OVH inc.: Hosting of the virtual private servers that run Agreely (database, application, encrypted backups; since 2026-10-19), La Corvée (application, database and backups) and Ophelios's booking tool (rdv.ophelios.com: Cal.com, its database and its daily backups; since 2026-10-27); information communicated: All personal information held by Agreely, by La Corvée and by Ophelios's booking tool, including the records held on behalf of clients (stored on the servers and in their backups).

Alchemy: Programmatic access to the Base network: relaying the anchoring transactions signed by Agreely, including citizen passkey fingerprints, and reading the chain for Agreely's servers; information communicated: Fingerprints of citizen identities and passkeys, with their dates.

Anthropic: Automated categorization of the cookies detected on the websites of clients of Agreely's Témoins product; information communicated: Names and attributes of the detected cookies and their domains, in a payload designed to carry no personal information; the one possible residue is the scanned page's title, truncated to 300 characters, which could exceptionally contain a person's name.

Apple (iCloud): Ophelios's iCloud calendar: entry of the meetings booked on rdv.ophelios.com, and reading of busy times so that only free slots are offered; information communicated: Name and email address of the person booking, date, time and link of the meeting and any notes entered.

Cloudflare: Content delivery network and proxy for the corvee.ca site, and name servers (DNS) for the corvee.ca domain, through Ophelios's Cloudflare account; information communicated: visitors' IP address, user agent and requests.

DigitalOcean: Hosting of the public agreely.ca and ophelios.com sites on DigitalOcean's app platform, which delivers them through the Cloudflare network; information communicated: Visitors' requests to the sites (IP address, user agent, pages requested, headers) and the bot-management cookie set by the delivery network.

Fly.io: Hosting of the Umami instance (analytics.ophelios.com) that measures the audience of the agreely.ca, corvee.ca and ophelios.com sites; information communicated: Page viewed and its title, referring page, screen size, language, browser, system and device type, approximate location, pseudonymous visit identifier, plus the IP address and user agent in transit.

Stripe: Payment processing and billing of Agreely subscriptions; information communicated: Name and email address of the account holder, internal identifier of the client enterprise, Stripe identifiers and amounts. The card, the address and the tax number are collected directly by Stripe.

Zoho Mail: Relay of the transactional emails sent by Agreely (verifications, notices, alerts), by La Corvée (invitations, notices, reminders, invoices) and by Ophelios's booking tool (request, confirmation or refusal of a meeting), and hosting of the mailboxes that receive messages addressed to Agreely (including the mailbox of the person in charge of the protection of personal information), to Ophelios and to La Corvée; information communicated: Name and email address of senders and recipients and content of the messages, which may contain names and contact details.

Your personal information is not communicated to any other third party without your consent, except in the cases provided for by law (ss. 13, 18 and 18.3).

Communication outside Québec

Some of your personal information may be communicated outside Québec, to the following recipients: Alchemy (United States), Anthropic (United States), Apple (iCloud) (Ontario, Canada, Apple Canada Inc., Toronto; server location not stated), Cloudflare (United States, Cloudflare, Inc.; global network, logs processed in the United States and Europe), DigitalOcean (United States, DigitalOcean, LLC, Colorado), Fly.io (Outside Québec, Fly.io, Inc., a US company; instance in the Toronto, Ontario region), Stripe (United States), Zoho Mail (United States). Some of these recipients act on our behalf. A privacy impact assessment has been carried out for each of these communications and concluded that the information would receive adequate protection (s. 17). Some of your personal information is also published openly: anyone can read it, including outside Québec. The assessment mentioned above does not cover this publication. No agreement binds the people who read it. Details are in the "Information published openly" section.

Information published openly

Your identifier (DID) and the public part of your keys are published online: anyone can read them, anywhere in the world, to verify your signatures. A fingerprint of your identity and a fingerprint of each of your passkeys are recorded on a public blockchain, with the date each key becomes valid, then the date it is replaced or your identity deleted. This record is permanent: it cannot be changed or erased, even if your identity is deleted.

Your rights

You have a right of access and rectification (ss. 27 and 28). You also have the right to obtain a computerized copy of personal information you provided to us in a structured, commonly used technological format, unless doing so raises serious practical difficulties (s. 27, para. 3). In the cases provided for by law, you may require that the dissemination of your information cease or that it be de-indexed (s. 28.1). You may withdraw your consent to the communication or use of the information collected (s. 8). These rights are exercised in writing with the person in charge identified below (ss. 29 and 30). As of the publication date of this policy, they may also be exercised online at the following address: https://app.agreely.ca/p/ophelios/rights.

Person in charge of personal information protection

To exercise your rights or for any question, contact: David Tucker, President and Chief Executive Officer - david.tucker@ophelios.com.