Privacy Policy

1. Information We Collect

The information collected depends on the user’s role and the features used.

Account information

We may collect, among other things:

• first and last name;
• email address;
• authentication information required to log in;
• the user's role on Kadha, such as student, parent, or tutor;
• certain preferences and account-related information.

When password authentication is used, Kadha does not store passwords in plain text.

Information about students

To provide Kadha’s educational features, we may collect, among other things:

• grade level;
• subjects studied;
• diagnostic and assessment results;
• progress by subject or competency;
• completed exercises and challenges;
• planned homework and assignments;
• tutoring session history;
• pedagogical observations related to sessions;
• learning objectives;
• interactions with certain Kadha educational features.

This information is used to personalize academic support and let the student, their authorized parents, and their assigned tutors track their progress.

Information about parents

We may collect, among other things:

• name;
• email address;
• phone number, when provided;
• the link to the student(s) associated with the account;
• information necessary to manage sessions, communications, and payments.

Information about tutors

We may collect, among other things:

• name;
• email address;
• subjects taught;
• grade levels taught;
• availability;
• information necessary to manage sessions;
• certain professional information necessary to use Kadha;
• information necessary for Google Calendar integration when that feature is enabled.

Technical data

When Kadha is used, certain technical information may be collected automatically, including:

• IP address;
• browser and device type;
• certain technical connection information;
• pages or features used;
• technical logs necessary for security, error diagnosis, and platform operation.

We aim to limit this collection to information reasonably necessary for the operation, security, and improvement of Kadha.

2. How We Use Information

Kadha uses personal information primarily to:

• create and manage user accounts;
• provide tutoring and learning services;
• organize and manage sessions;
• enable tracking of academic progress;
• generate or recommend exercises and educational content;
• let authorized parents track their child's progress;
• let assigned tutors support their students;
• send confirmations, reminders, and session-related communications;
• provide scheduling and calendar features;
• ensure the platform's security and integrity;
• detect and resolve technical issues;
• respond to support requests;
• comply with our legal obligations;
• improve Kadha based on usage data where permitted.

Kadha does not sell users' personal information.

We do not use students' personal information for external behavioral advertising purposes.

3. Minors and Parental Consent

Kadha is, among other things, intended for minor students. We therefore pay special attention to protecting their personal information.

Where a parent's or legal guardian's consent is required by law, Kadha requires this consent before collecting or using a child's personal information for the relevant features.

Accounts for students under 14 must be created or authorized by a parent or legal guardian.

We aim to collect only the information reasonably necessary to provide Kadha's educational services.

Depending on the features available, a parent linked to a student may, among other things:

• view certain information about their child;
• track their progress;
• view their sessions;
• receive certain reports or communications;
• request correction of inaccurate information;
• request deletion of their child's information, subject to our legal obligations.

Information about a student is not accessible to all tutors using Kadha. It is accessible only to authorized individuals and to the tutors the student is assigned to, according to the permissions necessary to provide the service.

4. Google Calendar and Google Meet

Kadha allows certain users, particularly tutors, to voluntarily connect their Google account to facilitate scheduling and managing sessions.

When this feature is enabled, Kadha may request permission to access certain Google Calendar features.

This access may be used, among other things, to:

• create an event corresponding to a tutoring session;
• update events associated with sessions when their schedule changes;
• delete or cancel the relevant events when necessary;
• add information necessary for organizing the session to events;
• add relevant participants when necessary;
• request the creation of a Google Meet conference associated with a session;
• retrieve the generated Google Meet link to display it to authorized participants in Kadha.

Kadha seeks to request only the Google permissions necessary for these features to function.

Access to a Google account is optional and must be explicitly authorized by the user through Google’s OAuth authorization mechanism.

Information obtained through Google APIs is used solely to provide or secure the features requested by the user.

Kadha does not sell data obtained from Google APIs, does not use it for advertising, and does not share it with third parties for advertising purposes.

Kadha’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Raw or derived data obtained from Google Workspace APIs is not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

5. Disconnecting from Google

A user can withdraw the authorization granted to Kadha to access their Google account.

When the Google connection is withdrawn or access is no longer needed, Kadha stops using the relevant permissions and deletes or invalidates the stored authorization credentials once they are no longer needed.

The user can also revoke the access granted to Kadha from their Google account's security settings.

Disconnecting the Google account from Kadha does not necessarily result in the automatic deletion of events already created in Google Calendar. The user can manage or delete these events directly from their Google account.

6. Artificial Intelligence

Kadha uses artificial intelligence technologies to provide certain educational and assistance features.

Depending on the features used, these technologies may help, among other things, to:

• generate exercises;
• prepare or adapt educational content;
• analyze academic progress;
• produce session summaries;
• suggest areas to work on;
• assist tutors in preparing and following up on sessions;
• help students with certain learning activities.

When necessary for these features to function, certain educational information may be processed by the systems Kadha uses.

Kadha seeks to limit the information transmitted to what is necessary for the relevant feature.

Features using artificial intelligence are designed as assistance tools. Generated content may contain errors and does not replace the professional judgment of a tutor, teacher, or other qualified professional when required.

Data obtained from Google Workspace APIs is not used to train or improve generalized or non-personalized artificial intelligence models.

7. Information Sharing and Service Providers

Kadha does not sell users' personal information.

We may, however, use service providers when necessary for the platform to function.

These providers may, among other things, provide:

• hosting of the application and its infrastructure;
• data storage and processing;
• sending emails and notifications;
• calendar and videoconferencing services;
• artificial intelligence services;
• payment services;
• security, technical monitoring, and diagnostic tools.

These providers receive only the information reasonably necessary to provide the relevant services and are subject to the data protection obligations applicable to their relationship with Kadha.

We may also disclose certain information when required by law, including in response to a court order, regulatory requirement, or other applicable legal obligation.

8. Access to Information by Role

Kadha applies access controls to limit access to personal information.

Depending on the features available and the relationships established on the platform:

• a student can access information and features associated with their account;
• an authorized parent can access information about the students linked to their account;
• a tutor can access the educational information necessary about the students assigned to them;
• authorized administrators can access certain information when necessary for Kadha's operation, support, security, or administration.

Access to personal information is limited according to the user's role and service-related needs.

9. Security of Information

Kadha implements reasonable technical and organizational measures to protect personal information against loss, theft, unauthorized access, disclosure, alteration, misuse, or destruction.

Depending on the systems and features involved, these measures may include:

• the use of secure HTTPS/TLS connections for communications between users and Kadha;
• secure password hashing when password authentication is used;
• enhanced protection of sensitive credentials and authorization tokens;
• encryption at rest of sensitive information where appropriate;
• role- and permission-based access controls;
• limiting access to personal information to the people and systems that need it to provide or administer the service;
• authentication and authorization mechanisms;
• measures intended to prevent unauthorized access to systems;
• monitoring and remediation of security vulnerabilities when identified;
• logging of certain technical activities when necessary for security and diagnostics.

OAuth tokens and other sensitive credentials that grant access to external services are not publicly displayed or shared with other Kadha users.

No method of electronic transmission or storage can, however, guarantee absolute security.

In the event of a privacy incident, Kadha will take reasonable measures necessary to limit the incident's consequences and will comply with applicable obligations regarding assessment, documentation, and notification.

10. Retention of Information

Kadha retains personal information only for as long as reasonably necessary to:

• provide its services;
• maintain the user's account;
• comply with its legal, tax, or accounting obligations;
• ensure the platform's security;
• prevent abuse or fraud;
• resolve disputes.

When an account is closed or a deletion request is accepted, Kadha deletes or anonymizes information that is no longer needed, subject to information that must be temporarily retained to meet a legal obligation or legitimate security need.

Information may also be temporarily present in technical backups before deletion, according to normal backup retention cycles.

11. Deleting an Account and Information

A user can request the closure of their account and the deletion of the personal information associated with it.

A parent or legal guardian may also request, where permitted by law, the deletion of information about a child in their care.

Certain information may need to be retained for a limited period where required by law or reasonably necessary for tax, accounting, legal, fraud-prevention, or security reasons.

Once no longer required, this information is deleted or anonymized.

12. Payments

When online payments are available on Kadha, they may be processed by a specialized payment processing provider.

Kadha does not retain full payment card numbers when they are collected and processed directly by the payment provider.

The payment provider may process certain information in accordance with its own privacy policy and the obligations applicable to payment services.

Kadha may, however, retain certain information necessary to manage transactions, such as the amount, date, payment status, transaction identifier, or information necessary for billing and accounting.

13. Communications

Kadha may send communications necessary for the service to function, including:

• account confirmations;
• session confirmations or changes;
• session reminders;
• important account-related information;
• security-related communications;
• information necessary to provide the service.

Kadha may also offer certain optional communications about platform features, educational tips, or other relevant information.

Where required by law, users may unsubscribe from optional communications.

Unsubscribing from optional communications does not prevent Kadha from sending communications necessary for the operation, security, or administration of an active account.

14. Cookies and Similar Technologies

Kadha may use cookies, local storage, or similar technologies necessary for the platform to function.

These technologies may be used, among other things, to:

• keep a session open;
• ensure authentication;
• remember certain preferences;
• protect the platform against certain abuse;
• understand and improve Kadha's technical operation.

Where non-essential technologies require consent under applicable law, Kadha will seek to obtain that consent before using them.

15. Hosting and Transfer of Information

Kadha uses technology providers to operate its platform.

Depending on the providers and services used, certain information may be processed or stored on infrastructure located in Canada or in other jurisdictions.

When a provider processes information outside Quebec or Canada, that information may be subject to the laws of the relevant jurisdiction.

Kadha takes reasonable measures to assess and oversee the providers entrusted with personal information, in accordance with applicable legal obligations.

16. Your Rights

Subject to the limits and exceptions provided by applicable law, you may, among other things, ask to:

• know what personal information Kadha holds about you;
• access your personal information;
• have inaccurate or incomplete information corrected;
• withdraw your consent where processing is based on your consent;
• request the deletion of certain personal information;
• close your account;
• ask questions about how your information is processed.

Where a user is a minor, some of these rights may be exercised by their parent or legal guardian in accordance with applicable law.

Kadha may request certain information to verify the identity of the person making a request before disclosing, modifying, or deleting personal information.

17. Withdrawal of Consent

Where processing is based on consent, that consent may be withdrawn, subject to applicable legal or contractual restrictions.

Withdrawing certain authorizations may prevent Kadha from providing certain features.

For example, revoking access to Google Calendar will prevent Kadha from automatically creating or managing Google Calendar events and Google Meet links associated with the relevant account.

18. Changes to This Policy

Kadha may update this Privacy Policy to reflect the evolution of its services, practices, or legal obligations.

The date of the last update is indicated at the top of the policy.

When a significant change materially affects how personal information is processed, Kadha may notify users through the platform, by email, or by any other appropriate means.

19. Privacy Officer and Contact

For any questions about this Privacy Policy, Kadha’s personal information protection practices, or to exercise a right related to your personal information, you can contact us through the About page or the contact form available on Kadha.

Requests related to personal information protection will be forwarded to Kadha's privacy officer.

Kadha — Website: kadha.ca — Contact: via Kadha’s About page or contact form.