Business Terms

Last Updated: 2026-11-02

1. Application

These Business Terms apply to you if you use Hivi-x (the "Service") as a business user—for example, as a realtor, lawyer, healthcare provider, financial advisor, or any other professional or organization that collects documents, forms, or personal information from your clients or end-users through the Service.

These Business Terms are in addition to our general Terms of Service and Privacy Policy. By using the Service as a business, you agree to these Business Terms, the Terms of Service, the Privacy Policy, and the Data Processing Agreement (DPA) where applicable.

2. Your Role as Data Controller

2.1 When you use the Service to collect personal data (including names, contact details, identification documents, health information, or other personal information) from your clients or end-users, you are the data controller for that data. Hivi (Hivi-x) processes that data on your behalf as a data processor.

2.2 As the data controller, you are responsible for:

Having a lawful basis for collecting and using your clients' or end-users' personal data (e.g., consent, contract, legal obligation, or another applicable basis under PIPEDA, GDPR, or other applicable law).
Providing a clear privacy notice to your clients or end-users before or at the time you collect their personal data through the Service. Your notice should explain what data you collect, why, how long you keep it, and how they can exercise their rights.
Complying with all applicable privacy and data protection laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), the Personal Health Information Protection Act (PHIPA) where applicable, the Health Insurance Portability and Accountability Act (HIPAA) where applicable, and the General Data Protection Regulation (GDPR) where applicable.
Not using the Service to collect personal data in a way that violates applicable law or the rights of data subjects.

3. Identification Documents and Sensitive Data

3.1 If you collect government-issued identification (e.g., passport, driver's licence) or photos of ID from your clients through the Service, you must:

Clearly state why you are collecting this information and use it only for that purpose.
Collect only the minimum necessary information.
Ensure you have a lawful basis and, where required, explicit consent from the individual.
Apply appropriate safeguards (the Service provides technical safeguards; you are responsible for your own policies and handling).

3.2 If you collect health information or protected health information (PHI):

You must comply with PHIPA (Ontario), HIPAA (U.S.), or other applicable health privacy laws.
If you are a HIPAA-covered entity (U.S.) or a health information custodian under PHIPA (Ontario), you may need to enter into a separate Business Associate Agreement (BAA) or PHIPA-compliant terms with Hivi (Hivi-x) before using the Service for PHI. Contact us at support@hivi-x.ca to request such terms.

4. Data Processing Agreement (DPA)

4.1 Our Data Processing Agreement (DPA) describes how we process personal data on your behalf as a processor. By using the Service as a business to collect data from your clients or end-users, you agree to the DPA. You must ensure that your use of the Service and your instructions to us are consistent with the DPA and applicable law.

4A. Calendar Features and Google Calendar Sync

4A.1 If you use calendar features in the Service, you are responsible (as controller) for ensuring you have a lawful basis to process calendar event data (including reminders and recurrence details) for your clients or end-users.

4A.2 If you enable Google Calendar synchronization, you instruct us to process calendar data to synchronize events between the Service and Google Calendar. You are responsible for disclosing this synchronization in your own privacy notice where required by applicable law.

5. Notice for Your Clients and End-Users

5.1 We recommend that you direct your clients or end-users to our short notice "For clients of businesses using Hivi-x", which explains that you are the data controller and we process data on your behalf. You should also provide your own privacy notice or policy that explains your specific practices.

5A. Branded Client Portals and Custom Domains

5A.1 If you enable client portal branding, you authorize us to display the business name, logo, colour, support address and privacy-policy link you provide on client pages and related transactional emails. You confirm that you may use these names, images, addresses and links and that they do not impersonate another organization.

5A.2 If you connect a custom domain, you must control the subdomain and keep the required DNS records in place. We verify ownership, routing and HTTPS before using it for client links. We may stop using the custom address for new links, or make it unavailable, if those checks fail. New invitations then use the platform address; previously sent links may require replacement. You are responsible for keeping your clients informed about the address you ask them to use.

5A.3 A branded address does not change who operates the Service. We continue to process client data on your behalf. You remain responsible for your own client privacy notice, including the content and availability of any privacy-policy URL you provide. Transactional email uses our approved sending domain; your business name may appear as the display name and replies may go to the support address you provide. Enabling branding does not authorize mail to be sent from your domain.

5A.4 Branding covers client-facing pages and related messages. Staff dashboards, operator legal notices and signature provenance may retain the platform identity. Published logos and icons are public.

5A.5 You authorize us to request and renew HTTPS certificates for your connected subdomain. Domain names appear in public certificate logs that may remain available after removal. Do not use client names or confidential information in the subdomain. DNS and certificate services are described in the Privacy Policy.

5A.6 Availability depends on account eligibility and the limits displayed in settings. When you remove a domain or lose access to the feature, new invitations use the platform address. We attempt to send replacement links for outstanding requests and normally preserve old links during a seven-day grace period. Delivery failures can delay cleanup. Keep DNS records in place until removal is confirmed; a DNS change or security problem can interrupt old links sooner. Mail-server acceptance does not guarantee inbox delivery. Domain removal does not delete client data.

5A.7 Our app addresses my-id.ca and hivi-x.ca use Canada's .ca domain. A business's custom domain does not have to use .ca and may be registered or managed through providers outside Canada. Connected custom portals still use our Canadian document storage; a domain ending alone does not establish data residency.

5B. Team Accounts

5B.1 For a team workspace, the account owner is our customer. The owner decides who is invited, each person's role and when access ends; admins appointed by the owner may invite, remove and change members on the owner's behalf. You are responsible for what the people you invite do in your workspace, and for removing access when someone should no longer have it.

5B.2 Seats are billed monthly in Canadian dollars at the plan's price per seat, on one invoice to the owner. Added seats are charged immediately, prorated for the rest of the billing period, and can be used once that payment succeeds. Removed seats are not refunded; the next invoice reflects the new count. A pending invitation holds a seat. During a trial, a workspace may include up to the number of people shown in the Service.

5B.3 Data in a shared workspace (clients, checklists, uploads, templates, files and signature requests) belongs to the business and stays in the owner's account. A removed or departing member keeps their own account and its personal data, such as their own notes, calendar, chat and sign-in details, and loses access to the workspace. The owner cannot delete the account or transfer the workspace while other members remain.

5B.4 The owner and admins can see the workspace's activity log, which includes members' actions in the workspace and their sign-in times and IP addresses. Tell the people you invite that this record exists.

5C. Webhooks and Connected Systems

5C.1 If you add a webhook endpoint, you instruct us to send the events you select, with the client, checklist and signature data described in our documentation, to that address. File contents are not sent.

5C.2 You choose the endpoint and any service behind it (for example Zapier, Make or your own system). That recipient acts for you, not for us, and is not our sub-processor. You are responsible for its security, location, terms and use of the data, and for telling your clients where their information goes.

5C.3 We send webhooks only over HTTPS to public addresses, sign each request, retry failed deliveries for a limited time, and may switch off an endpoint that keeps failing or that we reasonably believe is unsafe. Delivery records, including the content sent, are kept for 30 days. We are not responsible for data after it has been delivered to your endpoint.

5C.4 Connected apps. You or a member of your workspace may connect an app such as Zapier to the Service. Each connection acts with the access of the person who connected it, within the permissions shown on the consent screen: it can read the workspace data that person may see, add or change clients, send checklists to clients and receive events, as described in our documentation. You instruct us to provide that data to the app and act on its requests; the app and the account behind it act for you, not for us, and are not our sub-processors. As with an endpoint (5C.2), you are responsible for the app's security, location, terms and use of the data, and for telling your clients where their information goes. Zapier processes data in the United States: client data leaves Canada this way only if you or a member of your workspace connect Zapier. We do not send file contents, government identification numbers or bank and card numbers to connected apps. We email the account (and you, for a member's connection) when an app is connected. You can review and disconnect your workspace's apps in Account → Connected apps, and removing a member, a password reset or the suspension of an account also disconnects that person's apps; we may disconnect an app that we reasonably believe is unsafe or misused. Your plan's limits apply to what an app does.

6. Limitation of Liability

6.1 To the extent permitted by law, Hivi (Hivi-x) shall not be liable for any claims, losses, or damages arising from your failure to comply with your obligations as a data controller (including providing notice, obtaining consent, or complying with PHIPA, HIPAA, or other laws). You agree to indemnify and hold Hivi (Hivi-x) harmless from such claims to the extent they arise from your conduct or instructions.

7. Changes

7.1 We may update these Business Terms from time to time. We will notify you of material changes by posting the updated terms and updating the "Last Updated" date. Your continued use of the Service as a business after the effective date of changes constitutes acceptance of the updated Business Terms.

8. Contact

For questions about these Business Terms, the DPA, or to request a BAA or PHIPA-compliant terms, contact us at support@hivi-x.ca.

Effective Date: 2026-11-02
Last Updated: 2026-11-02