Last updated: August 16, 2026

This Privacy Policy explains how Business Vital Signs / Biz Vital Signs (“BVS”) collects, uses, discloses, retains and protects personal information and business information when you use the BVS website, web application, mobile application, integrations, pilot or early-access services, support channels and related services (collectively, the “Service”).

For the current Canada-first development and commercialization stage, the Service is operated by Biz Vitals Signs &Technologies, Saskatchewan, Canada (“BVS Canada”). Biz Vitalsigns Ltd, Lagos, Nigeria (“BVS Nigeria”), is intended to support future Nigeria operations and may process information for Nigeria-based services if and when those services launch. Unless a local notice states otherwise, BVS Canada is the primary organization responsible for the current Canadian Service.

Privacy contact / BVS Privacy Officer: BVS Privacy Officer Email: helpdesk@bizvitalsigns.com Mailing address: 176 Tufts Way, Saskatoon, Saskatchewan S7V 1P4, Canada

BVS is currently in development and pre-commercialization. Some data practices, service providers, hosting locations and product features may evolve before full commercial launch. BVS will update this Policy when material practices change and will not represent a planned technical control as already implemented when it has not been verified.

1. Scope

This Policy applies to personal information and business information handled by BVS through the Service. It does not govern the independent practices of third parties such as Intuit, QuickBooks, your accountant, payment providers or websites that BVS does not control.

If you use BVS through an organization, some information may be controlled by that organization. The organization’s administrator may have rights to manage users, permissions and business-workspace information.

2. Privacy principles

BVS aims to handle personal information in a manner consistent with applicable privacy requirements, including the principles of accountability, identified purposes, consent, limited collection, limited use and retention, accuracy, safeguards, openness and individual access where those principles apply.

For future Nigeria operations, BVS will also consider applicable requirements under the Nigeria Data Protection Act 2023 and related guidance, including lawful and transparent processing, data minimization, security, data-subject rights and requirements relating to cross-border transfers.

The applicable law depends on the nature of the information, the organization handling it, the location of the individuals and the commercial activity involved.

3. Information BVS may collect

Depending on the feature you use, BVS may collect or process the following categories.

3.1 Account and identity information

• name;
• business email address;
• telephone number where provided;
• account identifier;
• authentication and security information;
• role and workspace permissions; and
• account preferences.

3.2 Business profile information

• business name and contact details;
• industry and business activity;
• location and jurisdiction;
• fiscal year and reporting periods;
• currency;
• business size, business stage and operating context; and
• other profile information you choose to provide.

3.3 Planning and financial information

• Forecast assumptions and projections;
• Budget assumptions and targets;
• revenue, direct-cost and operating-expense categories;
• cash timing, tax assumptions, debt, financing and asset assumptions;
• financial statements, balances and ratios;
• business-health metrics, alerts, comparisons and reports; and
• action notes or collaboration records when those features are enabled.

3.4 QuickBooks information

If you choose to connect QuickBooks Online, BVS may process information authorized through Intuit that is necessary for enabled BVS functionality, such as:

• QuickBooks company identity and company identifier;
• chart-of-accounts information and account classifications;
• balances and financial-report information;
• mapped and unmapped account decisions;
• reconciliation and synchronization metadata; and
• other accounting information required for the BVS features you have authorized.

The exact production QuickBooks API scopes and objects are to be limited to what is necessary for the enabled BVS functionality.

3.5 AI interaction information

Where AI-assisted functionality is enabled, BVS may process:

• your questions and prompts;
• the BVS screen or feature context relevant to the request;
• selected business information needed to answer the request;
• generated responses;
• feedback; and
• technical metadata required to operate and secure the feature.

BVS does not need your QuickBooks password, bank password, OAuth Client Secret or refresh token as AI prompt content, and such credentials should not be provided to AI features.

3.6 Usage and technical information

BVS may process information such as:

• device and browser type;
• IP address;
• operating system;
• session, diagnostic and security events;
• feature interactions;
• error and performance information; and
• cookie or similar identifiers where used.

3.7 Support and communications

If you contact BVS, we may process your contact information, correspondence, support history, attachments and other information you choose to provide.

3.8 Billing information

BVS is currently pre-commercial. When paid plans launch, BVS may collect subscription, transaction, invoicing and payment-status information. Payment-card details may be handled by a third-party payment processor under its own privacy and security practices. BVS will update this Policy and the checkout experience to reflect the production payment flow before paid commercialization.

4. Information you should not provide unless requested

Please do not provide BVS with information that is unnecessary for the Service, including:

• online-banking passwords;
• your Intuit password;
• full payment-card numbers through support or free-text fields;
• Social Insurance Numbers or equivalent government identifiers;
• personal health information;
• authentication secrets or private keys; or
• sensitive personal information about other individuals that BVS has not requested.

5. How BVS collects information

BVS may collect information:

• directly from you when you create an account, complete a Forecast or Budget, contact support or use a feature;
• from your organization or authorized workspace administrator;
• from a connected service such as QuickBooks when you authorize the connection;
• automatically from the Service for security, diagnostics and operation; and
• from service providers that help BVS operate the Service.

BVS does not obtain your Intuit sign-in password through the QuickBooks OAuth authorization flow.

6. Why BVS uses information

BVS may use information to:

• create and administer accounts and business workspaces;
• provide Forecast, Budget and planning functionality;
• connect, map, validate and synchronize authorized QuickBooks information;
• calculate deterministic metrics, comparisons and Business Health Scores;
• generate reports, alerts, insights and explanations;
• provide AI-assisted guidance where enabled;
• support user education and onboarding;
• support collaboration features where authorized;
• provide customer support;
• secure, troubleshoot and improve the Service;
• prevent fraud, abuse and unauthorized access;
• manage pilots, beta programs and product testing;
• manage future billing and subscriptions;
• comply with law and enforce agreements; and
• establish, exercise or defend legal rights.

BVS will seek additional consent or provide additional notice where required for a materially new purpose.

7. QuickBooks authorization and connected data

When you connect QuickBooks Online, Intuit presents the authentication and authorization experience. BVS receives the authorization information necessary to access the QuickBooks company you selected, subject to the scopes you approved.

BVS uses connected QuickBooks information to support the BVS functions described at the time of connection, such as company confirmation, chart-of-accounts import, account mapping, financial-data validation, actual-versus-plan comparison, Business Health analysis and related reporting.

BVS treats QuickBooks authorization, data import, mapping and validation as separate steps. A successful OAuth connection does not automatically mean imported accounting information is ready to be treated as trusted BVS actuals.

For the current intended launch design, BVS is intended to use QuickBooks as a read-only accounting-data source rather than to create, edit or delete QuickBooks accounting transactions. If this changes, BVS will update the relevant disclosures and obtain any additional authorization required.

If you disconnect QuickBooks, BVS will stop requesting new QuickBooks data after revocation is processed and will revoke or delete active authorization credentials in accordance with the implemented production process. Previously imported data may remain in BVS until you delete it or the applicable retention period expires.

8. AI-assisted processing

BVS may use one or more approved business AI service providers to deliver selected AI-assisted features. The final production AI provider, configuration and retention settings are still subject to technical confirmation before commercial launch.

BVS’s design principle is to send only the minimum authorized context reasonably necessary for the requested AI function. BVS does not intend to send passwords, OAuth Client Secrets, QuickBooks refresh tokens or similar credentials to an AI model.

BVS will document the production AI provider and material data-handling terms before commercial launch and will update this Policy if the provider or processing materially changes.

AI-generated content may be inaccurate. AI does not replace deterministic BVS calculations or professional review where required.

9. When BVS may disclose information

BVS may disclose information only as reasonably necessary to:

• service providers that host, secure, store, authenticate, communicate, analyze, process payments, provide AI, monitor errors or otherwise support the Service;
• Intuit or another connected provider when you direct or authorize the connection;
• authorized members of your BVS workspace;
• an accountant, bookkeeper, adviser or other person you choose to involve through an enabled sharing feature;
• professional advisers, insurers, auditors or financing sources subject to appropriate confidentiality obligations;
• law-enforcement agencies, regulators, courts or other parties when required or permitted by law; or
• a successor or relevant counterparty in a financing, restructuring, merger, acquisition, insolvency or sale, subject to appropriate protections.

BVS does not sell personal information or identifiable QuickBooks customer data. BVS does not permit one customer’s identifiable data to be used by another customer for unrelated advertising or benchmarking.

10. Service providers and cross-border processing

BVS is finalizing its production hosting, database region, backup location, AI configuration and complete subprocessor inventory. Service providers may be located in Canada, the United States, Nigeria or other jurisdictions, depending on the final production architecture and the feature used.

Where information is transferred to a service provider in another jurisdiction, it may be subject to lawful access by courts, law-enforcement agencies or regulators in that jurisdiction.

BVS intends to use contractual, organizational and technical measures appropriate to the sensitivity of information and the role of the provider. BVS will maintain an internal provider inventory and update public disclosures where required when the production provider set is finalized or materially changes.

For future Nigeria operations, cross-border transfers will be assessed against applicable Nigerian requirements before those operations are launched.

11. Cookies and similar technologies

BVS may use essential cookies, local storage and similar technologies for authentication, security, session continuity, preferences and core functionality.

If BVS deploys non-essential analytics or marketing technologies, BVS will provide notice and consent or preference controls where required before relying on those technologies.

You may control cookies through your browser and any available BVS preference tools, but disabling essential technologies may affect functionality.

12. Marketing communications

BVS may send service messages concerning your account, security, support, integration status, material product changes or future billing. These messages may be necessary to provide the Service.

BVS will send promotional electronic messages only in accordance with applicable consent and communication requirements and will provide an unsubscribe mechanism where required.

13. Security safeguards

Financial and account information can be sensitive. BVS therefore requires production environments that handle live customer information to use administrative, technical and organizational safeguards appropriate to the sensitivity and risks involved.

Before production use involving live QuickBooks customer information, BVS’s production-control requirements include secure HTTPS/TLS transmission for public and OAuth endpoints, server-side protection of secrets, restricted access, secure handling of authorization credentials, separation of development and production environments, security-relevant logging, and appropriate backup, recovery and incident-response procedures.

The exact implementation of production hosting, encryption-at-rest, token encryption, authentication technology, monitoring, backup and related controls is being confirmed as part of production-readiness work. BVS will not represent a control as implemented until it has been verified.

No system can be guaranteed completely secure. BVS will review safeguards as the Service, threats, providers and legal obligations evolve.

14. Retention

BVS will retain personal information and Customer Data only for as long as reasonably necessary for the purposes described in this Policy, legal requirements, security, dispute resolution and legitimate business records.

Because BVS is still pre-commercial, the final production retention schedule is being confirmed. Before commercial launch, BVS will document operational retention and deletion periods for active accounts, closed accounts, backups, security logs, support records, billing records, QuickBooks authorization credentials and AI history where applicable.

BVS will not retain information indefinitely merely because storage is available. Information that is no longer reasonably required will be deleted, securely destroyed or de-identified, subject to legal holds and records BVS must retain.

15. Account and data deletion

BVS’s approved product direction is to allow users to delete their BVS data. The production application is expected to provide account and/or workspace deletion controls or an authenticated deletion-request process before commercial go-live.

Until self-service deletion is verified in the production application, you may request deletion by emailing helpdesk@bizvitalsigns.com with the subject “Data Deletion Request.” BVS may need to verify your identity, authority and the affected workspace.

Deletion may be subject to legal, tax, accounting, fraud-prevention, security, dispute, backup-cycle or record-retention requirements. Where information cannot immediately be removed from a backup, it will remain protected and will not be restored for ordinary business use after a verified deletion except where required for security or disaster recovery.

16. Access, correction and privacy choices

Subject to applicable law and exceptions, you may request that BVS:

• confirm whether it holds personal information about you;
• provide access to personal information and information about its use and disclosure;
• correct inaccurate or incomplete personal information;
• withdraw consent for optional processing, subject to legal or contractual restrictions;
• delete information where applicable;
• provide an export of information you supplied where available or required;
• explain material service-provider and cross-border processing practices; or
• address a concern or complaint about BVS privacy practices.

To submit a request, email helpdesk@bizvitalsigns.com and include “Privacy Request” in the subject line. BVS may need to verify your identity and authority before responding.

Where PIPEDA applies, BVS intends to respond within the time required by that law, subject to permitted extensions and exceptions. For future Nigeria operations, applicable Nigerian data-subject rights and response obligations will be addressed as part of the Nigeria launch-readiness process.

17. Business workspaces and information about other people

A BVS customer may provide information about employees, contractors, customers, vendors or advisers. The customer is responsible for having the authority and providing the notices required to submit that information.

If an organization controls the relevant workspace information, BVS may direct an individual’s request to that organization while assisting as legally required.

18. Automated analysis and human review

BVS may use deterministic formulas, rules, mapping logic, comparisons and AI assistance to produce business information and recommendations. These outputs are intended to support business understanding and do not by themselves make legally binding or similarly significant decisions about individuals.

Customers should apply appropriate human review before using BVS information for lending, employment, insurance, investment, tax, legal or other high-impact decisions.

19. Security incidents

BVS will investigate suspected security incidents and take reasonable steps to contain, remediate and document confirmed incidents. Where applicable law requires notification of affected individuals, regulators or other parties, BVS will make the required notifications based on the circumstances and applicable legal threshold.

20. Children

The Service is intended for adult business users. Individuals under 18 should not create a BVS business account. BVS does not knowingly design the Service to collect children’s personal information for consumer use.

If you believe a child has provided personal information to BVS, contact helpdesk@bizvitalsigns.com.

21. Nigeria-specific future operations

BVS Nigeria is not being represented in this Policy as a currently launched commercial BVS service unless and until BVS provides a Nigeria launch notice.

Before Nigeria commercial operations begin, BVS will review the applicable Nigeria Data Protection Act requirements, including controller/processor obligations, data-subject rights, security, lawful processing and cross-border transfer requirements, and will update this Policy or issue a jurisdiction-specific supplement where appropriate.

22. Changes to this Policy

BVS may update this Policy as its Service, technology, commercial model, service providers and legal obligations evolve. BVS will post the revised Policy at https://bizvitalsigns.com/privacy-policy/ and change the “Last updated” date.

If a change is material, BVS will provide additional notice through the Service, email or another appropriate method and will seek consent where required by applicable law.

23. Contact BVS about privacy

BVS Privacy Officer Biz Vitals Signs &Technologies 176 Tufts Way, Saskatoon, Saskatchewan S7V 1P4, Canada Email: helpdesk@bizvitalsigns.com

Please use “Privacy Request” or “Data Deletion Request” in the email subject line as applicable.

Individuals may also have the right to contact the Office of the Privacy Commissioner of Canada or, for future Nigeria processing, the Nigeria Data Protection Commission, subject to applicable law and jurisdiction. BVS encourages you to contact us first so we can try to address the concern.© 2026 Biz Vital Signs. Contact: helpdesk@bizvitalsigns.com