Privacy Policy

InsureFlow provides the software a broker or managing general agent uses to quote, issue and administer insurance. Where a broker uses InsureFlow to arrange your policy, that broker decides what information is collected and why; we process it on their instructions. This policy describes what we do with it either way.

From applicants and policyholders: name, contact details, the address and characteristics of the property or business being insured, the answers given during an application, claims and loss history, prior insurance, payment status, documents uploaded in support of an application or a claim, and the electronic signature record for a proposal (the typed name, the time, the IP address and a hash of the exact document signed).

From brokers and other users: name, work email, role, licence number, issuing regulator, licence and errors & omissions expiry dates, sign-in times, IP address and device information.

We do not sell personal information, and we do not use it for advertising.

To assess a risk and produce a quote, to issue and administer a policy, to take payment, to handle claims, to produce the regulatory and bordereau reporting an insurer or regulator requires, to detect fraud and error, and to keep the platform secure. We use it for those purposes and not for unrelated ones.

Some parts of quoting are automated. When an application is submitted, software applies the underwriting rules and the rating factors of the insurer whose product is being quoted, and produces one of three outcomes: a quote, a referral to a human underwriter, or a decline. The premium is calculated the same way.

We also use artificial intelligence in two places. Where a submission is imported from a document or an email, AI reads it and pre-fills the application, which a person then reviews. Where a submission is referred, AI may produce a written recommendation for the underwriter. That recommendation is advice only — a referral, a decline and any change to a quote are decided by a person, and the underwriter's own reasoning is recorded on the file.

You may ask what information was used to reach a decision about you, ask us to correct it, and ask for a decision to be reviewed by a person. Contact your broker, or us at the address below.

We keep personal information for these periods:

• Bound policies, and the claims made under them — seven years from the end of the policy term, or from the closure of the last claim under it, whichever is later.
• Quotes that were never bound — twenty-four months from the date the quote was produced.
• Incomplete drafts — twelve months from the last time they were touched.
• Sign-in and security records — twenty-four months.
• User accounts — for as long as the account is active, and twelve months after it is closed.

After those periods the information is deleted or anonymised. Where a longer period is required by insurance legislation, by a regulator, or by an ongoing legal proceeding, we keep it for that longer period and no further.

If personal information we hold is lost or accessed without authorisation and it creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada, and to the Commission d'accès à l'information du Québec where Quebec residents are affected, as soon as feasible after we conclude that the breach has occurred.

We will notify affected individuals directly, and the broker or agency responsible for them, as soon as feasible and without undue delay — telling you what happened, what information was involved, what we are doing about it and what you can do. We keep a record of every breach, whether or not it is reportable, for twenty-four months.

Access is restricted by role, and enforced on the server rather than in the interface. Every action taken on a quote or a policy is recorded on an append-only audit trail with the person who took it. Data is encrypted in transit. Two-factor authentication is available on every account, and passwords are stored only as salted hashes.

With the insurer or managing general agent underwriting the risk; with the broker or agency handling your file; with our payment processor, to take payment; with our email provider, to send you documents; and with a regulator or a court where the law requires it. Each supplier is bound to use it only for that purpose.

You may ask for a copy of the personal information we hold about you, ask us to correct anything inaccurate, withdraw a consent you previously gave, ask for information to be deleted where we are not required to keep it, and complain about how we have handled it. We respond within thirty days.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator in your province.

We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and with the provincial legislation that applies in place of it or alongside it:

• Quebec — the Act respecting the protection of personal information in the private sector, as amended by Law 25.
• British Columbia — the Personal Information Protection Act.
• Alberta — the Personal Information Protection Act.
• Ontario, and every other province and territory — PIPEDA, together with the privacy and market-conduct requirements of the insurance legislation and the insurance regulator of that province.

Provincial insurance legislation and the rules of the relevant insurance council or regulator also govern how a licensed broker handles your information, in addition to this policy.

Our Privacy Officer can be reached at privacy@insureflow.com. If your policy was arranged by a broker, you may also contact them directly.