Hosted in Québec, and public-body obligations
The personal information your public body entrusts to Agreely is hosted in Québec: the application, the database and its encrypted backups are at OVH, in Beauharnois. Entrusting Agreely with keeping or using that information on your behalf is a release to a mandatary under section 67.2 of the Access Act (CQLR, c. A-2.1): your public body must entrust the mandate in writing, specify in it the provisions of the Act that apply and the confidentiality measures required by s. 67.2 para. 2, obtain the confidentiality agreements that paragraph requires, and record the release in its register (s. 67.3 para. 1). The emails Agreely sends for your public body (consent requests, request confirmations, notices) do, however, go through the Zoho Mail relay, located in the United States, which receives the recipient's name and email address and the content of the message. These emails fall under s. 70.1: before the first one is sent, your public body must carry out a privacy impact assessment, conclude that the information would receive adequate protection and enter into a written agreement that takes it into account (s. 70.1 paras. 1 and 2), then state in its register that it is a release referred to in s. 70.1 (s. 67.3 para. 3 (3)). Cookie categorization for your banners also relies on Anthropic, in the United States, using metadata designed to contain no personal information and no cookie value. Finally, wherever the information is hosted, s. 63.5 requires a privacy impact assessment for any project to acquire an information system involving personal information.
Agreely acts as a mandatary within the meaning of s. 67.2. Agreely documents and records; it does not carry out these assessments for you and does not certify the adequacy of the protection.
Attestation required for the public-body regime
The Access Act does not apply to health and social services information within the meaning of R-22.1 held by a health and social services body (s. 2 (5)). Agreely does not cover that separate regime.
For example the Ministère de la Santé et des Services sociaux, Santé Québec, a health and social services institution, the RAMQ or the INSPQ, and, for those activities, a body that provides health or social services under an agreement on behalf of Santé Québec, an institution or a body listed in the schedules to that Act. Agreely does not cover that regime.
Attest only to what you have verified yourself. An inaccurate attestation communicated to the Commission may constitute an offence.
Once recorded, this attestation is final. Its fingerprint will be written into a permanent public anchor: it can never be erased, only stop covering the register or be superseded, and that withdrawal will itself be recorded and anchored.
The precise application to each institution must be confirmed case by case.