GDPR & CPPA Compliance Statement

At Rejuvena Care, we are fully committed to upholding the privacy rights and freedoms of individuals under the General Data Protection Regulation (GDPR) and the Canadian Consumer Privacy Protection Act (CPPA). This statement outlines our legal responsibilities and your rights.

1. Lawful Basis for Processing

All personal data we collect is processed lawfully, fairly, and transparently. Our lawful bases include:

Consent: Voluntary agreement, with the ability to withdraw at any time
Contract: Data required to fulfill service agreements
Legal obligation: When required by health, tax, or safety regulations
Legitimate interest: When processing benefits both Rejuvena Care and the user without infringing rights

2. Transparency and Control

We clearly explain how data is collected, stored, and used. You are provided with accessible privacy notices, opt-in/opt-out options, and simple tools to update your preferences or withdraw consent.

3. Rights of the Individual

You have the following rights under GDPR and CPPA:

✔ Right to access the personal data we hold about you
✔ Right to rectify inaccurate or incomplete data
✔ Right to erasure (“right to be forgotten”) where applicable
✔ Right to restrict or object to processing under certain conditions
✔ Right to data portability (to receive your data in structured digital format)
✔ Right to lodge a complaint with a supervisory authority

4. Data Security

We implement strong technical and organizational measures to safeguard your personal data, including:

✔ End-to-end encryption of sensitive data
✔ Role-based access control and audit logging
✔ Regular backups and server monitoring

5. International Data Transfers

If data is transferred outside Canada or the EU (e.g., via cloud service providers), we ensure that it is protected by appropriate legal mechanisms such as Standard Contractual Clauses (SCCs), adequacy decisions, or Binding Corporate Rules (BCRs).

6. Breach Notification Protocol

In the unlikely event of a data breach affecting your rights or freedoms, we will notify you and the appropriate supervisory authority (e.g., Office of the Privacy Commissioner of Canada or an EU DPA) within the legally required timelines (typically 72 hours).