Solutions Biotonix Inc. – Master Terms of Use

Last Updated: May 19, 2026

Effective Date: August 1, 2023

IMPORTANT LEGAL NOTICE: BINDING CONSENT UPON ACCESS AND USE

BY CREATING AN ACCOUNT, DOWNLOADING, INSTALLING, ACCESSING, RUNNING, INTEGRATING, OR OTHERWISE USING ANY BIOTONIX SOFTWARE, APPLICATIONS, OR SERVICES, OR BY VISITING, BROWSING, OR TRANSACTING ON THE WEBSITES BIOTONIX.COM AND BIOTONIXPOSTURE.COM (COLLECTIVELY, THE “WEBSITES”), YOU EXPLICITLY, UNCONDITIONALLY, AND IRREVOCABLY AGREE TO BE BOUND BY THESE MASTER TERMS OF USE “AS IS” IN THEIR CURRENT STATE. IF YOU DO NOT AGREE TO ALL OF THESE TERMS, YOU ARE STRICTLY PROHIBITED FROM USING OR ACCESSING ANY BIOTONIX WEBSITES OR PRODUCTS, AND YOU MUST IMMEDIATELY TERMINATE ALL INTERACTIONS, CLOSE YOUR ACCOUNTS, AND DELETE ALL INSTALLED BIOTONIX APPLICATIONS FROM YOUR DEVICES.

1. Scope of the Platforms and Websites

These Master Terms of Use (“Terms”) govern your access to and use of all digital assets owned, operated, or licensed by Solutions Biotonix Inc. (“Biotonix”), including:

  1. Public Websites: biotonix.com and biotonixposture.com (including all subdomains, integrated client portals, and e-commerce checkouts).
  2. BIOTONIX Health Application (formerly BTX) – Our mobile-based self-assessment, physical capacity testing, cognitive profiling, and training platform.
  3. BIOTONIX Health Portal – Our administrator interface designed for employers and wellness coordinators to manage user licenses and view aggregated, anonymized group data.
  4. BIOTONIX Posture Pro (including the Biotonix Posture Assistant Pro mobile companion) – Our clinical-grade postural evaluation software designed for healthcare, physical therapy, chiropractic, and fitness practitioners.
  5. BIOTONIX Intelligence – Our developer-facing API endpoints, SDKs, and integrated biomechanical assessment engines.

2. Updates & Modifications to These Terms

To ensure compliance with digital health assessment criteria (such as AppGuide/TherAppX standards) and strict privacy regulations (including Québec’s Law 25, PIPEDA, and the GDPR), Biotonix distinguishes between administrative (non-material) and substantive (material) updates:

2.1 Non-Material Updates (Administrative Changes)

Biotonix reserves the right to make minor, non-material changes (such as correcting typos, formatting adjustments, re-organizing sections, or updating corporate contact addresses) unilaterally at any time. These updates become effective immediately upon being posted within our applications or on our websites. Your continued use of the platforms or websites following these minor changes constitutes acceptance of the updated terms.

2.2 Material Updates (Privacy, Consent, and Sensitive Data Processing)

For any substantive changes that modify how we collect, process, dissociate, store, or share your sensitive personal information (including biometric data, posture photographs, cognitive testing responses, and psychosocial risk survey results), the following strict compliance framework applies:

  • Proactive 30-Day Notice: Biotonix will notify you of any material changes at least thirty (30) days before they become effective. Notice will be delivered through a prominent banner or notification within the BIOTONIX Health Application, an email sent to your registered address, or a dedicated bulletin on the BIOTONIX Health Portal and respective websites.
  • Active Re-Consent Mandate: Upon the effective date of any material change, you will be prompted within our applications to review the updated terms and provide explicit, active consent (by checking an opt-in box or tapping “I Accept” on a dedicated modal screen).
  • Hard Block on Failure to Consent: Because passive or implied consent is legally invalid for sensitive health and psychosocial metrics under Québec’s Law 25 and GDPR, you will be locked from further accessing or using the platform’s evaluation and training features until you have actively accepted the material updates. If you refuse to accept the revised terms, your account will be suspended, and you may request the immediate deletion of your existing personal data in accordance with our Privacy Policy.

3. E-Commerce, Memberships, & Subscriptions (BIOTONIX Posture)

Subscribing to professional plans or ordering equipment via the public interfaces on biotonixposture.com is governed by the following strict commercial terms:

3.1 Membership Plans & Commitments

Practitioners and members can choose from four core subscription tiers, which include access to our AI-powered posture analysis tools, client database integration, custom corrective plans, progress tracking, and access to the exclusive online Posture Network Community:

  • 3-Month Membership: $129 per month. Commitment of three (3) months, billed monthly. Total structural commitment of $387.
  • Monthly Membership: $99 per month. Commitment of twelve (12) months, billed monthly. Total structural commitment of $1,188.
  • Annual Membership: $89 per month (yielding 10% savings). Billed in full annually at $1,068. Commitment of twelve (12) months.
  • 2-Year Membership: $79 per month (yielding 20% savings). Billed in full biennially at $1,896. Commitment of twenty-four (24) months.

3.2 Hardware and Equipment Requirements

To ensure the clinical accuracy of posture photograph processing, each member is responsible for acquiring the following designated accessories:

  • Portable Canva: A standardized physical reference grid, priced at $125.00 CAD plus applicable taxes and shipping fees.
  • Tripod: A high-quality, stable, and smartphone-compatible physical tripod to enforce uniform photo capture height and angles.

3.3 Refund Policy

  • Membership Refund: If you are unsatisfied with your digital subscription, you are entitled to a full refund within fourteen (14) days of your initial purchase. No refunds will be issued for subscription fees after this 14-day window has expired.
  • Equipment Refund: The Portable Canva may be returned within thirty (30) days of receipt. To be eligible for a refund, the equipment must be returned in its original, undamaged, and resalable condition. All returned equipment is subject to a 15% restocking fee, and the client assumes full responsibility for all return shipping costs.

3.4 Renewal, Cancellation, and Upgrades

  • Automatic Renewal: All memberships automatically renew at the end of their current commitment term (monthly, annually, or biennially). To prevent renewal, you must cancel your subscription prior to your renewal date by contacting us at info@biotonixposture.com. No refunds will be issued for cancellations requested after a billing cycle has run.
  • Upgrades: You may upgrade your plan at any time. Remaining balances on your current plan will be prorated and credited toward your new billing cycle.

4. Prohibited Uses of Websites & Platforms

When accessing our public websites (biotonix.com, biotonixposture.com) or cloud platforms, you explicitly agree not to:

  • Use any software robots, spiders, scrapers, crawlers, offline readers, or other automated devices, processes, or means to access, monitor, index, or copy any code, data, or content from our databases.
  • Attempt to bypass, compromise, or test the vulnerabilities of our security frameworks, firewalls, API rate-limiters, or administrative login consoles.
  • Transmit or propagate any automated scripts, malware, viruses, trojans, or ransomware designed to disrupt our core services.
  • Harvest or systematically extract biometric parameters, clinical indexes, or normative biomechanical tables to build secondary or competitive databases.

5. Important Medical and Clinical Disclaimers (No Clinical Care)

5.1 Informational, Fitness, and Educational Purposes Only

The assessments, tests, measurements, scores (including physiological ages, metabolic rate, fat percentage, and psychological risk indexes), 3D posture reconstructions, corrective BTX Training journeys, and mental wellness, cognitive, or stress-reduction recommendations generated by any Biotonix product are strictly for informational, educational, and general fitness purposes.

THEY DO NOT CONSTITUTE MEDICAL DIAGNOSES, CLINICAL PRESCRIPTIONS, OR MEDICAL ADVICE. Our technologies utilize advanced artificial intelligence (AI), machine learning models, and standardized biomechanical algorithms to analyze self-reported inputs and posture photographs to evaluate postural deviations, physical capacities, and psychosocial risk indicators. These outputs are designed to support, not replace, the relationship between you and your physician, physical therapist, or other qualified healthcare provider.

5.2 Healthcare Professional Consultation

If you have concerns about your mental or physical health, or if you require comprehensive medical follow-up, diagnosis, or rehabilitation, we strongly recommend consulting a qualified healthcare professional. Never disregard professional medical advice or delay seeking treatment because of information, metrics, or recommendations provided by a Biotonix product. In the event of a medical emergency, immediately contact your local emergency services (such as 911 or 811 in Canada).

5.3 Physical Activity Readiness & Critical Contraindications

Regular physical activity is safe and beneficial for most individuals. However, you must consult a licensed physician before beginning any physical tests, capturing postural photos, or starting the 8-week BTX Training journey if you experience any of the following conditions:

  • A diagnosed heart condition, coronary disease, or cardiovascular issue.
  • Chest pain during physical exertion or when at rest.
  • Frequent loss of balance due to dizziness, vertigo, or any history of unexplained loss of consciousness.
  • Bone, muscle, joint, or spinal problems (such as herniated discs or severe arthritis) that could be worsened by changes in physical activity.
  • Active prescriptions for blood pressure control, heart conditions, or beta-blockers.
  • Pregnancy (or suspected pregnancy).
  • Being over the age of 69 without a history of regular, ongoing participation in strenuous physical activity.

5.4 Mental Health & Psychosocial Risk Survey Disclaimers

Certain Biotonix products include self-reported questionnaires evaluating psychosocial risks, workplace stress, cognitive health, personality, and occupational environment factors (aligned with preventive workplace wellness and standards like Québec’s Law 27 / Act respecting occupational health and safety, referencing INSPQ and CNESST guidelines).

  • These questionnaires (including the Cognitive Health Test, Social Environment Test, Personality Test, and Psychosocial Risk Survey) are screening tools and do not constitute a psychological evaluation, clinical psychiatric diagnostic assessment, or a legal evaluation of workplace harassment, violence, or trauma.
  • No Crisis Intervention: Biotonix does not provide real-time monitoring, crisis intervention, or suicide prevention services. If you are experiencing acute psychological distress, please contact national helpline networks or specialized crisis centers immediately.

6. Safe Usage, Environment, and Equipment Requirements

6.1 Physical Workspace Safety

To perform physical evaluations (such as the guided Physical Capacity Test, flexibility assessments, step tests, push-ups, sit-ups, and squats) or the corrective BTX Training exercises, you are solely responsible for ensuring that your physical surroundings are safe. You must:

  • Train on a flat, non-slip, and stable surface.
  • Ensure the training area is completely clear of obstacles, cords, furniture, pets, or other tripping hazards.
  • Maintain adequate lighting so that mobile device cameras can accurately capture postural photographs without image-processing errors.
  • Wear appropriate athletic, supportive footwear and comfortable clothing.
  • Keep adequate hydration (water) nearby and take regular breaks.

6.2 Immediate Halting of Activity

If you experience acute pain, sharp joint discomfort, severe dizziness, lightheadedness, numbness, or shortness of breath at any point during a Biotonix physical test or corrective exercise, you must discontinue the activity immediately and consult a medical professional. Do not attempt to “push through” physical pain during corrective movement patterns.

7. Eligibility, Age Requirements, and Legal Consent

7.1 Age Thresholds

Biotonix is committed to protecting the privacy and safety of minors.

  • Québec Jurisdiction: In accordance with the Quebec Civil Code and Law 25, users must be at least 14 years of age to register an account, undergo physical/psychosocial assessments, and consent to the processing of their personal data.
  • Other Jurisdictions: For users residing outside of Quebec, the minimum age to access and use the platform autonomously is 16 years of age (unless local laws establish a different age of digital consent, up to a minimum of 13 under COPPA).
  • Parental Authorization: Any individual under the legal age of digital consent in their jurisdiction must not register for or use the platform. If Biotonix discovers that it has inadvertently collected personal data from a minor below the required threshold without documented parental consent, that data will be permanently and immediately purged from our servers.

8. Intellectual Property, Proprietary Rights, and International Copyright Protection

8.1 Exclusive Ownership

Solutions Biotonix Inc. retains exclusive ownership, title, and all intellectual property rights in and to:

  • The proprietary AI algorithms, computerized anatomical marker detection, and 3D postural reconstruction models.
  • The Biotonix biomechanical database, containing historical postural assessments and anonymous clinical datasets.
  • All source code, object code, design elements, graphics, user interfaces, workflows, documentation, and trademarked logos associated with our products and websites.
  • Customized reports, corrective training plans, calculations, and data structures.

8.2 International Copyright Protection and Treaties

The Biotonix ecosystem—including our websites, mobile and web applications, proprietary databases, clinical-decision algorithms, software code, and educational content—is protected by international copyright laws and treaties.

  • Global Treaty Frameworks: Our intellectual property is safeguarded under the Berne Convention for the Protection of Literary and Artistic Works, the World Intellectual Property Organization (WIPO) Copyright Treaty, and the Universal Copyright Convention (UCC).
  • Multi-Jurisdictional Enforcement: Copyright protection is strictly active and legally enforceable in multiple countries where Biotonix platforms are accessed, licensed, or distributed, including but not limited to Canada, the United States, member states of the European Union (EU), the United Kingdom (UK), and all other member territories of the international intellectual property conventions. Unauthorized reproduction, modification, translation, distribution, or reverse engineering of any portion of our software or websites constitutes a violation of international civil and criminal laws.

8.3 Trademarks and Patents

“BIOTONIX”, “BIOTONIX Santé”, “Posture Pro”, “BTX”, “CoachBTX”, and their associated branding configurations are registered or common-law trademarks of Solutions Biotonix Inc. globally. Certain systems, analysis methods, and equipment configurations utilized by Biotonix may also be protected by pending or granted utility and design patents filed with the Canadian Intellectual Property Office (CIPO), the United States Patent and Trademark Office (USPTO), the European Patent Office (EPO), and other international patent agencies.

9. Governing Law and Jurisdiction

These Terms of Use are governed by and construed in accordance with the laws of the Province of Québec and the federal laws of Canada applicable therein. Any legal action, suit, or proceeding arising out of or relating to these Terms must be instituted exclusively in the courts of the judicial district of Richelieu (or Montreal, as applicable), Québec, Canada.

10. Contact Information

For technical support, regulatory compliance inquiries, or questions regarding these Terms of Use, please contact us:

  • Email: support@biotonix.com
  • Mailing Address: Solutions Biotonix Inc., 25, rue du Roi, Sorel-Tracy (Québec) J3P 4M2, Canada
  • Support Hours: Monday to Friday, 9:00 AM to 5:00 PM EST.

Solutions Biotonix Inc. – Privacy Policy

Last Updated: May 19, 2026

Effective Date: August 1, 2023

Solutions Biotonix Inc. (“Biotonix,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of the personal information entrusted to us. This Privacy Policy outlines how we collect, use, process, encrypt, store, and delete personal data across our entire ecosystem, including our websites (biotonix.com, biotonixposture.com), the BIOTONIX Health Application, BIOTONIX Health Portal, BIOTONIX Posture Pro, and BIOTONIX Intelligence.

Under the leadership of our Vice President of Technologies, Sébastien Lacoste, ing., we implement Privacy by Design principles and strictly comply with the Act respecting the protection of personal information in the private sector (Québec’s Law 25), the Personal Information Protection and Electronic Documents Act (Canada’s PIPEDA), and the General Data Protection Regulation (EU’s GDPR).

1. Regulatory Frameworks & Compliance

We align our data governance practices with the highest legal standards across jurisdictions:

  • Québec Law 25: We enforce strict data lifecycle controls, execute comprehensive Privacy Impact Assessments (Évaluations des facteurs relatifs à la vie privée – ÉFVP) for all new systems, and have designated a Data Protection Officer (DPO).
  • Canada (PIPEDA): We adhere to the 10 Fair Information Principles, ensuring limited collection, explicit consent, transparency, and individual access.
  • Europe (GDPR): For users residing in the European Economic Area (EEA), we act as a “Data Processor” (or in some contexts, “Data Controller”). We process data on the legal bases of consent and contractual necessity, offering full rights to data portability, rectification, restriction, and erasure.
  • Why HIPAA (US) Does Not Apply: Biotonix is not a “covered entity” under the United States Health Insurance Portability and Accountability Act (HIPAA). Our tools do not process, store, or transmit Protected Health Information (PHI) linked to US clinical billing networks or national healthcare plans, nor do we issue formal medical diagnoses.

2. Exhaustive Disclosure of Collected Data

We collect several distinct categories of personal information depending on your interaction with our platforms and websites.

2.1 Sensitive Identification and Profile Data

To establish user profiles, process subscription orders, verify your identity, and enforce secure authentication, we collect:

  • First name, last name, email address, password hashes, phone number, physical billing address, professional license numbers (for Posture Pro practitioners), and age-eligibility declarations.

2.2 Biomechanical, Physical, and Postural Image Data

To generate automated postural analyses and customized physical recommendations, we collect:

  • Postural Imagery: Three (3) standard posture photographs showing physical alignment (taken via our simplified interface or uploaded). Note: we recommend a third-party captures these photos for accurate camera positioning.
  • Physical & Biometric Metrics: Height, weight, age, biological gender, waist circumference, weekly physical activity hours, resting heart rate (bpm calculated over 30s), active heart rate (bpm calculated over 30s post-step test), and reach/flexibility distance.
  • Strength & Muscular Output Records: The number of completed push-ups per minute, sit-ups per minute, and squats per minute.
  • Outputs Generated: Calculated morphological type, postural type, center of gravity, applied physical forces, postural angles, body mass index (BMI), waist-to-hip ratio, physiological ages (aerobic, body composition, muscular), body fat percentage, basal metabolism (BMR), daily energy needs, and progress comparisons over time.

2.3 Highly Sensitive Cognitive, Psychological, and Social Data

To assess holistic occupational health and safety, our applications collect sensitive psychological datasets:

  • Cognitive Health Assessment Data: Self-reported responses to fifty-two (52) subjective items measuring indicators of cognitive and emotional fragility. This includes scoring metrics for anxiety, irritability, depression, inattention, hyperactivity, and mental disorganization.
  • Personality Profiling Data: Responses to twenty (20) psychological self-assessment items based on the MBTI approach to identify professional advice, leadership style, and problem-solving approaches.
  • Workplace Social Environment Data: Responses to twelve to fifty (12–50) items tracking psychosocial risk factors (aligned with the INSPQ framework), measuring personal levels of work autonomy, work-life balance, organizational recognition, peer/management support, and job satisfaction.
  • Psychosocial Workplace Hazards (CNESST Framework): Responses to six to thirty (6–30) questions identifying high-risk social environments. This includes explicit user disclosures regarding experiences of workplace harassment, physical violence, sexual violence, cyberviolence, domestic/family violence, and exposure to occupational trauma.

2.4 Website Usage, Technical, and Analytics Data

When you visit or purchase items on biotonix.com or biotonixposture.com, we automatically capture system logs, localized browser metadata, and tracking parameters:

  • Technical Identifiers: IP addresses, operating system type and version, browser engine type, device model, screen resolution, connection timestamps, referring URLs, and language preferences.
  • Web Analytics: Page views, click-through rates, time-on-page, active navigation paths, shopping cart actions, and exit pages. This statistics collection is managed anonymously and cannot be linked back to your sensitive health file.

3. Cookie Disclosure and Usage Policy

Biotonix utilizes cookies, web beacons, and local storage configurations on biotonix.com and biotonixposture.com to deliver secure, responsive, and reliable web services. We do not use cross-site tracking cookies, behavioral profiling cookies, or third-party ad retargeting plugins. The cookies we deploy fall into three distinct functional categories:

3.1 Essential & Security Cookies (Strictly Necessary)

These cookies are mandatory to enable basic website functions and maintain system integrity:

  • Session & Authentication: Maintains your secure logged-in state as you browse through different administrative panels or checkouts.
  • Security & CSRF Protection: Protects against Cross-Site Request Forgery (CSRF) and prevents malicious credential-stuffing or identity spoofing attempts.

3.2 Functionality Cookies (Persistent Preferences)

These cookies remember your personalized settings to optimize your return visits:

  • Language Selection: Saves your interface choice between French (FR) and English (EN) so you do not have to select it manually upon each visit.
  • Display Configurations: Retains local configuration choices like text sizing, custom menus, or panel selections.

3.3 Performance & Analytics Cookies (Anonymous Telemetry)

We utilize Google Analytics to gather high-level, aggregate visitor data:

  • Scope of Telemetry: We monitor total traffic volumes, geographic distribution (at a high country/regional level), browser types, screen sizes, and navigation pathways.
  • IP Anonymization Enforced: We have enabled IP masking/anonymization at the tracking level. Google Analytics is blocked from storing your full IP address or linking website usage statistics with any personal identity or physical files stored in our active cloud databases.

4. Data Processing, Dissociation, and Anonymization

4.1 Data Dissociation Architecture

To maximize user safety, Biotonix implements a strict data isolation architecture. In our cloud databases, sensitive identifying data (names and emails used for login or billing) is completely dissociated and stored separately from physical logs, posture photos, and cognitive/psychosocial survey answers. These silos are connected only through randomized, encrypted reference keys, preventing any direct identification of health files in the event of an administrative lookup.

4.2 Purposes of Processing

Your data is processed strictly for:

  • Creating and authenticating user profiles and managing website subscription transactions.
  • Executing the core physical, cognitive, and psychosocial algorithms.
  • Generating personalized 8-week BTX Training journeys and CoachBTX weekly summaries.
  • Providing aggregated, anonymized wellness reports to corporate administrators (Health Portal).
  • Improving our biomechanical models and AI training algorithms (conducted strictly using anonymized, non-identifiable data structures).

4.3 Sharing with Third Parties

Biotonix does not sell, trade, or lease personal information. Fully anonymized, aggregated physical and psychological metrics may be used internally or shared with academic, clinical, or technological partners strictly for the purpose of scientific advancement and machine learning model validation. This data is rigorously anonymized, making it mathematically impossible to re-identify any individual user.

5. Specific Product Workflows and Custodianship

5.1 BIOTONIX Posture Pro (Clinical Patient Data)

For patient data entered into BIOTONIX Posture Pro:

  • No Direct Interaction: Patients do not have access credentials and do not log into the Biotonix platform.
  • Practitioner Role: The practitioner is the sole custodian of the clinical account. They capture the patient’s physical characteristics (height, weight, and posture photos) and upload them to compare the patient’s metrics against our proprietary biomechanical normative tables.
  • Consensual Processing: The practitioner is legally responsible for obtaining, documenting, and managing the end-user’s consent to share their biometric data with the Biotonix platform.
  • Biotonix Role: Biotonix acts strictly as a Data Processor. We secure, store, and run normative table comparisons on the uploaded metrics under the instruction of the practitioner. We do not use clinical Posture Pro patient records for marketing, direct communications, or any non-clinical purpose.

5.2 BIOTONIX Health Corporate (Employee Data)

For employee data processed under a corporate subscription:

  • Independent Accounts: Employees set up private, secure personal accounts on the BIOTONIX Health Application.
  • Employer Access Boundaries: Under no circumstances are individual profiles, photos, raw cognitive metrics, or psychosocial responses shared with or made visible to the employer.

6. Definition of Anonymized & Aggregated Corporate Data (Health Portal)

To protect employee privacy while providing organizations with actionable macro-level wellness insights, corporate administrators utilizing the BIOTONIX Health Portal are restricted to viewing only Aggregated and Anonymized Data. We apply the following strict technical filters to make individual re-identification mathematically impossible:

6.1 Definition of Terms

  • Aggregated Data: Individual database records (such as postural scores, cognitive fragility levels, and psychosocial risks) are stripped of all personal identifiers (including name, email, and IP address) and mathematically combined into group averages, percentages, and totals.
  • Anonymized Data: Information that has been permanently altered so that it can no longer be associated with an identified or identifiable natural person, directly or indirectly, through any technical means.

6.2 Strict Technical Filters and Suppression Rules (The -Anonymity Standard)

To eliminate any risk of deductive re-identification (e.g., identifying a specific employee’s survey answers by sorting or filtering administrative charts), our platform enforces a strict, unified mathematical security boundary hardcoded into the core SQL and database query pipelines:

  1. Systemic -Anonymity Filter ():
  • The portal will not display any group report, demographic average, or departmental statistics unless there are at least ten (10) active, completed employee profiles within that specific cohort, department, filter, or location.
  • If a selected group or department contains fewer than 10 active participants, the entire metrics dashboard for that group is locked, hidden, and suppressed from administrative view.
  1. Low-Frequency Cell and Sub-Metric Suppression ():
  • This -anonymity threshold applies systematically to all nested data slices, categories, and cross-tabulated cells.
  • If an eligible group ( 10) is broken down into sub-metrics (such as filtering a team dashboard by age categories, morphological posture types, or psychosocial stress risk scales) and any single sub-category (cell) contains fewer than ten (10) individuals, that specific sub-category metric is automatically fully suppressed and hidden.
  1. No Raw Logging or Exporting:
  • Administrative exports only contain high-level mathematical group curves and bar-chart percentages. Selected managers are strictly blocked from exporting or viewing raw CSV logs or database strings of any survey, physical capacity rep count, or cognitive screening answer.

7. Sub-Processors and Data Transfers

To deliver our SaaS services, we rely on trusted, certified third-party sub-processors:

7.1 Cloud Hosting Infrastructure (Microsoft Azure)

All database files, user profiles, postural photographs, web databases, and survey responses are securely stored on Azure servers located physically in the Canada East region (Quebec City, Quebec, Canada), with secondary, encrypted failover endpoints in the Canada Central region (Toronto, Ontario, Canada).

  • Physical Security & Certifications: Azure’s Canadian data centers utilize multi-layered security barriers, including biometric scanners, 24/7 CCTV, armed security patrol details, seismic bracing, dual-line fire suppression systems, and redundant backup generators. The infrastructure maintains active compliance with ISO/IEC 27001, 27017, 27018, SOC 1, SOC 2 Type II, and SOC 3 audits.
  • Encryption Standards: All stored database blocks and file attachments are encrypted at rest using Advanced Encryption Standard (AES-256) via Transparent Data Encryption (TDE), with cryptographic keys securely cycled in Azure Key Vault. All administrative connections, queries, and report downloads are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS) utilizing strong cipher suites (including ECDHE-RSA-AES256-GCM-SHA384) with Perfect Forward Secrecy (PFS).

7.2 Managed Security and Oversight Partnership (Solulan)

Biotonix partners with Solulan, an external certified SOC 2 IT security service provider, to manage and maintain our administrative and corporate IT infrastructure:

  • Tenant Security & DLP: Solulan administers our Office 365 and Microsoft 365 environments, deploying Microsoft Defender for Cloud and advanced automated Data Loss Prevention (DLP) rules to monitor, alert, and block unauthorized data exports or suspicious administrator behaviors.
  • Identity Management & SIEM: Administrative connections require mandatory Multi-Factor Authentication (MFA) verified through Solulan-monitored enterprise identity nodes. Security logs are analyzed continuously via Solulan’s security information and event management (SIEM) systems.
  • Rotational Backups: Solulan manages automated, encrypted system backups utilizing a 14-day rotational retention window. All backup files are stored in an off-site, air-gapped, immutable Azure Blob Storage container to ensure absolute disaster recovery and protection against ransomware.

8. Retention and Disposal of Personal Information

  • Active Users: Data is retained as long as your user account remains active.
  • Inactive Users: If your account remains completely inactive for a consecutive period of 24 months, all associated personal and sensitive data is automatically, securely, and permanently purged from our active production systems.
  • Transactional Records: Invoices, payment transactions, and core access logs are retained for a minimum of 7 years to satisfy corporate auditing, tax, and regulatory record-keeping laws.
  • Anonymized Datasets: Aggregated, anonymized data stripped of all unique identifiers may be kept indefinitely for technological modeling and R&D.

9. Your Legal Rights and Recourse

Depending on your jurisdiction, you have several legal rights regarding your personal information.

9.1 Overview of Rights

  • Access and Portability: The right to request a copy of the personal data we hold about you in a structured, commonly used format.
  • Rectification: The right to correct inaccurate or incomplete personal information.
  • Deletion (“Right to be Forgotten”): The right to demand that your personal data be permanently deleted. (You can immediately and permanently delete your account and associated history within the BIOTONIX Health Application under the Profile section).
  • Withdrawal of Consent: The right to withdraw consent to data processing at any time, which will result in the immediate closure of your account.

9.2 Regulatory Recourse

If you are unsatisfied with how Biotonix handles your personal data, you have the right to lodge a formal complaint with the appropriate regulatory authority:

  • Québec: Commission d’accès à l’information (CAI) – cai.gouv.qc.ca
  • Canada: Office of the Privacy Commissioner of Canada (OPC) – priv.gc.ca
  • European Union: Your local National Data Protection Authority (such as the CNIL in France, or the DPC in Ireland).

10. Data Protection Officer (DPO) Contact

To submit a formal request to access, correct, or delete your data, please contact our Data Protection Officer:

  • Attention: Sébastien Lacoste, Vice President of Technologies (DPO)
  • Email: support@biotonix.com
  • Postal Address: Solutions Biotonix Inc., 25, rue du Roi, Sorel-Tracy (Québec) J3P 4M2, Canada

Solutions Biotonix Inc. – Cybersecurity Policy

Last Updated: May 19, 2026

Effective Date: August 1, 2023

This Cybersecurity Policy describes the technical, administrative, and physical security measures implemented by Solutions Biotonix Inc. (“Biotonix”) to preserve the integrity, confidentiality, and availability of our information systems, developer APIs, websites (biotonix.com, biotonixposture.com), and client-facing databases.

This policy applies to all operations, employees, third-party contractors, and technological platforms managed by Biotonix, in full alignment with Québec’s Law 25 guidelines.

IMPORTANT: CYBERSECURITY TERMS BINDING STATEMENTS

BY CONNECTING TO, INTERACTING WITH, LICENSING, INTEGRATING, OR OTHERWISE ENGAGING WITH ANY BIOTONIX CORE SERVERS, DATABASES, APIS, WEBSITES, OR SERVICES, INDIVIDUALS AND PARTNER ENTITIES AGREE UNCONDITIONALLY TO BE BOUND BY THIS CYBERSECURITY COMPLIANCE POLICY “AS IS.” BIOTONIX RESERVES THE UNILATERAL RIGHT TO UPDATE, ALTER, AND ENFORCE COMPLIANCE RULES SYSTEMATICALLY AND WITHOUT PRIOR OR SEPARATE NOTICE.

1. Information Security Governance

1.1 Executive Oversight

Our cybersecurity framework is supervised by the Vice President of Technologies, Sébastien Lacoste, ing., a credentialed software engineer. Under his authority, the technology department:

  • Coordinates regular risk assessments and security audits of our software and web environments.
  • Manages our core IT partnerships and reviews all external processor certifications.
  • Conducts mandatory security awareness training for all Biotonix personnel.
  • Approves any exceptional data access authorizations or system integrations.

1.2 SOC 2 Certified Subcontractors

To ensure the highest standard of infrastructure resilience, Biotonix partners with Solulan, a certified SOC 2 IT security provider. Solulan manages and strengthens our corporate Office 365 infrastructure, implements advanced automated Data Loss Prevention (DLP) mechanisms, and conducts redundant, encrypted backups of administrative data.

2. Technical and Infrastructure Security

2.1 Cloud Hosting Environment

All physical, psychosocial, and assessment data from Biotonix products are hosted securely within Microsoft Azure on servers physically located in Canada (Québec region). This setup leverages Azure’s global physical security controls, intrusion detection systems, and hardware-level isolation.

2.2 Access Control and Identity Management

We enforce a strict defensive posture concerning platform access:

  • Principle of Least Privilege: Employees are granted system permissions strictly necessary for their specific organizational tasks.
  • Multi-Factor Authentication (MFA): Mandatory MFA is enabled across all Office 365, Microsoft Azure administrative consoles, and remote developer environments.
  • Forced Workstation Logouts: All staff members must terminate active sessions and log out of all secure terminals at the end of their shifts.
  • Employee NDAs: All Biotonix employees are bound by legally enforceable, strict non-disclosure agreements. Any unauthorized attempts to access, extract, or share data will result in immediate termination of employment and potential legal action.

2.3 Network and Platform Security

  • Data Transmission: Transport Layer Security (TLS/HTTPS) is enforced across all endpoints to prevent packet interception or man-in-the-middle attacks.
  • Vulnerability Scanning: Continuous software monitoring, API endpoint protection, and routine patching of known vulnerabilities are conducted systematically.

3. Threat Landscape & Key Risks

Biotonix actively monitors and designs mitigations for our two primary cybersecurity risk vectors:

  1. Loss of User Data: Addressed through secure database replication, automatic off-site backups (managed in partnership with Solulan), and high-availability database mirroring.
  2. Exfiltration / Data Leakage: Mitigated via advanced DLP software, employee session rules, segregated data storage partitions (dissociating personal identities from health logs), and restricted USB/removable media configurations on corporate terminals.

4. Incident Response Plan (IRP)

In compliance with Law 25 and industrial cybersecurity standards, Biotonix maintains a structured process for answering, containing, and recovering from potential security incidents (such as unauthorized access, data leaks, ransomware, phishing, or system exposure).

[Detect & Log] ──> [Contain & Isolate] ──> [Analyze & Patch] ──> [Notify (CAI & Users)] ──> [Review & Prevent]

 

4.1 Step 1: Detection and Logging

We employ automated logging, firewalls, threat monitoring software, and system audits to detect anomalous activity. An internal alert channel (via a dedicated security communications channel managed by our IT team) is monitored 24/7 to prioritize alerts by severity (Minor, Moderate, or Critical).

4.2 Step 2: Containment and Isolation

If a threat or unauthorized access is detected, our technology team immediately:

  • Deactivates compromised user accounts, rotates administrative API keys, and blocks suspect IP ranges.
  • Isolates affected virtual machine environments or segments the database network to halt lateral movement.
  • Applies temporary protective firewalls and collaborates directly with Solulan to defend our internal infrastructure.

4.3 Step 4: Communication and Legal Notifications

Under Québec’s Law 25, if an incident presents a “risk of serious injury” (risque de préjudice sérieux) to affected individuals:

  • Commission d’Accès à l’Information (CAI): Biotonix will submit a voluntary notification to the CAI outlining the nature of the breach, the measures taken to mitigate it, and the data affected.
  • Affected Users: Biotonix will notify impacted users via email without delay, providing security recommendations (such as password resets or credential monitoring instructions).
  • Corporate Clients & Subcontractors: Affected corporate partners utilizing the Biotonix Health Portal or API endpoints will be alerted immediately.

4.4 Step 5: Post-Incident Prevention

Following resolution, a comprehensive Incident Report is drafted to document the breach, the exact timeline of response actions, and lessons learned. This data is used to continuously refine security policies, update training exercises, and optimize the defensive boundaries of all Biotonix platforms.

End-User License Agreement (EULA) – BIOTONIX Health Application

Last Updated: May 19, 2026

Effective Date: August 1, 2023

This End-User License Agreement (“Agreement” or “EULA”) is a legally binding contract between you (the “End-User” or “Participant”) and Solutions Biotonix Inc. (“Biotonix”). This Agreement governs your downloading, installation, and use of the BIOTONIX Health Application (formerly BTX, including CoachBTX features).

IMPORTANT LEGAL NOTICE: BINDING AGREEMENT

BY CREATING AN ACCOUNT, DOWNLOADING, INSTALLING, OR OTHERWISE INTERACTING WITH THE BIOTONIX HEALTH APPLICATION, YOU EXPLICITLY AND IRREVOCABLY AGREE TO BE BOUND BY THIS EULA AND THE BIOTONIX MASTER TERMS OF USE AND PRIVACY POLICY. IF YOU DO NOT AGREE TO THESE TERMS, YOU MUST NOT DOWNLOAD, INSTALL, OR ACCESS THIS APPLICATION, AND YOU MUST IMMEDIATELY DELETE ANY INSTALLED COPIES FROM YOUR DEVICES.

1. Scope of the Application Features

The BIOTONIX Health Application is a personalized wellness, posture-tracking, and health-coaching tool. It includes:

  • Posture Evaluation (Without grid): Collaborative capture of three (3) standard alignment photos to track postural deviations, calculate waist-to-hip ratio, and identify morphological configurations. Note: We recommend a third-party captures these photos for accurate camera positioning.
  • Physical Capacity Test: A guided 20-minute physical fitness routine measuring height, weight, waist circumference, weekly physical activity hours, resting heart rate (bpm over 30s), active heart rate (bpm over 30s post-step test), flexibility distance, and counts for push-ups, sit-ups, and squats per minute.
  • BTX Training: An individualized, adaptive 8-week physical training journey focusing on correcting postural deviations and improving aerobic, body composition, and muscular physiological ages.
  • Psychosocial and Cognitive Screeners: Standardized, self-reported questionnaires including the Cognitive Health Test (52 items), Social Environment Test (12–50 items), Personality Test (20 items based on MBTI), and the Psychosocial Risk Survey (6–30 items tracking CNESST hazard thresholds).
  • CoachBTX: An automated weekly coaching engine providing wellness summaries and concrete weekly physical/social habits based on your personal results.

2. Platform-Specific Terms of Use Summary

2.1 Essential Medical Disclaimer

The BIOTONIX Health Application does NOT provide clinical care, medical diagnoses, physical therapy, psychiatric evaluations, or treatment prescriptions.

  • All output metrics (including physiological ages, metabolic rate, fat percentage, and psychological risk scales) are strictly for informational and general fitness purposes.
  • You must obtain medical clearance before executing the Physical Capacity Test or the 8-week BTX Training journey if you are over 69 years of age, pregnant, taking blood pressure medication, or have a history of cardiovascular or joint issues.
  • No Crisis Intervention: The psychosocial risk and cognitive fragility tools are screening surveys. They are not real-time suicide prevention or mental health emergency services. If you are experiencing acute psychological distress, you must seek national emergency help or contact 911 / 811.

2.2 Physical Workspace Safety

You are solely responsible for ensuring your testing and training space is safe, flat, stable, well-lit, and clear of hazards. Discontinue physical activity immediately and consult a doctor if you feel sharp pain, severe dizziness, lightheadedness, or shortness of breath.

2.3 Legal Age of Consent

You must be at least 14 years of age if you reside in the Province of Québec, or 16 years of age in all other jurisdictions, to autonomously register an account and consent to the physical and psychosocial processing in this application.

2.4 Unilateral Policy Updates

Administrative changes take effect immediately. Substantive changes to data processing, training metrics, or consent limits require a 30-day proactive notice via in-app banners or email. To continue using the application after a material update, you must actively opt in (by clicking “I Accept” on an update modal). Failure to accept the modified terms will result in your account being locked to prevent non-consensual data processing.

3. Platform-Specific Privacy Policy Summary

We enforce a strict Privacy by Design database layout to protect your sensitive personal details:

  • Identity Dissociation: Your name, email, and password hashes are stored in a secure credential database completely separate from your postural photos, physical capacity stats, cognitive test answers, and psychosocial survey logs. These distinct database blocks are linked only through randomized, encrypted reference keys.
  • Zero Commercial Retargeting: We do not track you for commercial advertising, collect third-party cookies, or sell your personal details to brokers or marketers.
  • Anonymized Research Sharing: Fully anonymized, aggregated physical and psychological logs (making individual re-identification mathematically impossible) may be shared with scientific, academic, or AI-research partners.
  • Account and Data Deletion: You retain complete ownership of your data. You can permanently, instantly, and irrevocably delete your entire profile and all associated logs directly in the app (under the “Profile” section).
  • Canadian Data Residency: All raw data, images, and surveys are stored securely within Microsoft Azure datacenters located in the Canada East region (Québec City, Québec).

4. Platform-Specific Cybersecurity Summary

Your data is secured through strict technical, administrative, and physical barriers:

  • Transport Encryption: All communications between your mobile device and our cloud servers are encrypted using Secure Transport Layer Security (TLS 1.3 / HTTPS).
  • System Safeguards: Core database servers are protected by Microsoft Azure’s advanced firewalling, continuous vulnerability patching, and automatic backups managed in partnership with Solulan (our SOC 2 certified IT security provider).
  • Incident Response: In the unlikely event of a security incident that poses a risk of serious injury, Biotonix will notify you via your registered email address without delay, alongside official filings with the Commission d’accès à l’information du Québec (CAI) and the Office of the Privacy Commissioner of Canada (OPC).

5. Contact Information

For assistance with your account, data extraction requests, or technical support:

  • Email: support@biotonix.com
  • Mailing Address: Solutions Biotonix Inc., 25, rue du Roi, Sorel-Tracy (Québec) J3P 4M2, Canada

End-User License Agreement (EULA) – BIOTONIX Posture Pro

Last Updated: May 19, 2026

Effective Date: August 1, 2023

This End-User License Agreement (“Agreement” or “EULA”) is a legally binding contract between your professional entity/practice (the “Licensee,” “Practitioner,” or “you”) and Solutions Biotonix Inc. (“Biotonix”). This Agreement governs your access to and professional use of the BIOTONIX Posture Pro desktop and mobile software (including the Posture Assistant Pro companion).

IMPORTANT LEGAL NOTICE: BINDING PROFESSIONAL AGREEMENT

BY LOGGING INTO, INSTALLING, RUNNING, OR OPERATING THE BIOTONIX POSTURE PRO PLATFORM, YOU AGREE TO BE BOUND BY THIS EULA AND THE ASSOCIATED TERMS OF USE, PRIVACY POLICY, AND CYBERSECURITY POLICY. IF YOU DO NOT HAVE THE AUTHORITY TO BIND YOUR PRACTICE, CLINIC, OR ORGANIZATION, OR IF YOU DO NOT AGREE TO THESE TERMS, YOU MUST IMMEDIATELY TERMINATE ALL PLATFORM INTERACTIONS AND REMOVE THE SOFTWARE FROM YOUR TERMINALS.

1. Scope of the Professional Tool

BIOTONIX Posture Pro is a clinical-grade biomechanical evaluation software designed strictly for healthcare professionals, physical therapists, chiropractors, and fitness practitioners.

  • Core Functions: The practitioner inputs patient characteristics (such as height and weight) and uploads three (3) high-precision photos taken against a standard physical grid.
  • Algorithmic Outputs: The software analyzes postural deviations (measuring exact distances and angles), calculates center of gravity, estimates applied physical forces, and generates morphological/postural reports. These assessments are evaluated against proprietary Biotonix biomechanical normative tables.
  • User Interaction Boundary: The end-user (your patient) never interacts directly with, logs into, or views this platform independently. You operate the software on their behalf.

2. Platform-Specific Terms of Use Summary

2.1 Practitioner as Data Custodian (Controller)

As the practitioner, you are the primary custodian of your patients’ sensitive files. You explicitly covenant and agree that:

  • You must obtain explicit, documented, and legally compliant informed consent from each patient prior to capturing their posture photographs or entering their biometric details into the software.
  • You will inform patients that their data is processed on Biotonix servers strictly to compare their metrics against standardized biomechanical normative tables.
  • You assume full legal liability for failure to acquire, track, and record patient consent in accordance with local health privacy regulations.

2.2 Clinical Decision-Support Only

The software acts strictly as a clinical decision-support tool.

  • The generated reports, scores, and calculated forces are designed to aid clinical evaluations but do not constitute a direct clinical diagnosis.
  • You retain primary, non-delegable clinical responsibility for the care, interpretation, physical diagnosis, modification, and direct oversight of any exercise routines or physical regimens recommended to your patients.

2.3 Intellectual Property & Anti-Scraping Restrictions

The underlying algorithms, normative reference databases, and visual diagnostic tools are protected by international treaties (including the Berne Convention, WIPO Copyright Treaty, and UCC).

  • You are granted a limited, non-transferable, revocable license to access the platform.
  • You are strictly prohibited from caching, scraping, harvesting, or systematically extracting biometric parameters or normative tables to build secondary databases.

3. Platform-Specific Privacy Policy Summary

Because Posture Pro processes sensitive patient biometric profiles, Biotonix implements strict data processing rules:

  • Biotonix as Data Processor: In the context of Posture Pro, Solutions Biotonix Inc. acts strictly as a Data Processor under the direction of the Practitioner (who acts as the Data Custodian or Controller).
  • Strict Purpose Limitation: Patient profiles, photographs, and biomechanical outputs entered under your clinical account are used solely to run your analyses and deliver clinical reports. Biotonix will never target your patients, use their records for marketing, or share their files with third parties.
  • Anonymization for Global Standards: Aggregated, anonymized physical statistics may be analyzed internally by Biotonix to improve normative biomechanical reference tables. Individual identifiers are fully removed during this process.
  • Canadian Data Sovereignty: Patient photographs, biomechanical indices, and database files are securely hosted in Microsoft Azure’s Canada East cloud region (located in Québec City, Québec).

4. Platform-Specific Cybersecurity Summary

  • Role-Based Access Control: Clinical accounts are secured via the principle of least privilege. Practitioners are responsible for managing access credentials for their local staff and enforcing routine session logouts at the end of shifts.
  • Mandatory Multi-Factor Authentication (MFA): Access to the cloud-linked database requires active Multi-Factor Authentication (MFA) to prevent unauthorized credential-stuffing breaches.
  • Secure Data Transmission: All photo transfers, calculation requests, and PDF report downloads are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS).
  • Backup Resilience: Redundant backups are managed continuously in partnership with our SOC 2 certified security provider, Solulan, preventing physical data loss.

5. Contact Information

For clinical licensing, administrative support, or regulatory inquiries:

  • Email: support@biotonix.com
  • Mailing Address: Solutions Biotonix Inc., 25, rue du Roi, Sorel-Tracy (Québec) J3P 4M2, Canada

End-User License Agreement (EULA) – BIOTONIX Health Portal

Last Updated: May 19, 2026

Effective Date: August 1, 2023

This End-User License Agreement (“Agreement” or “EULA”) is a legally binding contract between your corporate entity (the “Client,” “Company,” or “Employer”) and Solutions Biotonix Inc. (“Biotonix”). This Agreement governs your access to and use of the administrative interface known as the BIOTONIX Health Portal.

IMPORTANT LEGAL NOTICE: BINDING CORPORATE AGREEMENT

BY CREATING AN ADMINISTRATIVE ACCOUNT, ASSIGNING LICENSE CREDENTIALS, LOGGING INTO, OR OPERATING THE BIOTONIX HEALTH PORTAL, YOUR ORGANIZATION EXPLICITLY AND UNCONDITIONALLY AGREES TO BE BOUND BY THIS EULA, THE MASTER TERMS OF SERVICE, AND THE PRIVACY POLICY. IF YOU DO NOT HAVE THE LEGAL AUTHORITY TO BIND YOUR CORPORATE ENTITY, OR IF YOUR ORGANIZATION DISAGREES WITH THESE TERMS, YOU ARE STRICTLY PROHIBITED FROM ACCESSING THE PORTAL.

1. Scope of the Health Portal

The BIOTONIX Health Portal is an administrative management tool designed for employers, Human Resource (HR) divisions, corporate wellness coordinators, and occupational health managers. It provides:

  • License Management: Distribution, activation, and suspension of BIOTONIX Health Application licenses to eligible employees (Participants).
  • Aggregated Group Analytics: Macro-level monitoring of group metrics, health trend charts, physical capacity scores, cognitive risk profiles, and workplace environmental stress curves.

2. Platform-Specific Terms of Use Summary

2.1 The Non-Re-identification Pledge

You contractually acknowledge and agree that your organization, wellness coordinators, and selected managers are strictly and absolutely prohibited from attempting to de-anonymize, reverse-engineer, cross-reference, or otherwise re-identify individual employee participants using the aggregated charts, statistics, or external employee datasets.

2.2 Access Security Responsibility

The Client is solely responsible for:

  • Managing administrative credentials and assigning secure, unique access pathways.
  • Ensuring that only authorized corporate wellness managers or selected HR staff can access the portal dashboard.
  • Immediate Deactivation: Instantly deleting administrative account credentials for any coordinator, coordinator assistant, or HR manager who is terminated, reassigned, or whose access is no longer required.

2.3 Limitation of Liability

Biotonix’s total aggregate liability for any operational loss, security incident, or contract dispute is strictly limited to the actual fees paid by the Client to Biotonix during the twelve (12) months preceding the event. Biotonix is not liable for business interruptions, administrative worker losses, or decisions made by HR based on group portal insights.

3. Platform-Specific Privacy Policy Summary (Anonymization Controls)

To ensure strict compliance with Québec’s Law 25, Canadian PIPEDA, and global workplace privacy standards, the BIOTONIX Health Portal implements hardcoded physical and mathematical anonymization boundaries:

3.1 Strict Data Separation (The HR Wall)

The employer (Client) never has access to individual employee records, personal health files, posture photographs, raw strength/aerobic scores, or individual psychological/psychosocial survey responses. All data entered by employees inside the BIOTONIX Health Application is stored in a separate, secure user database block completely isolated from the corporate administrator dashboard.

3.2 Automated Group Anonymization Filters (The -Anonymity Standard)

To prevent deductive re-identification (identifying a specific employee’s survey answers by sorting or filtering administrative charts), our portal enforces a strict, unified mathematical security boundary hardcoded into the core SQL and database query pipelines:

  1. Systemic -Anonymity Filter ():
  • The portal will not display any group report, demographic average, or departmental statistics unless there are at least ten (10) active, completed employee profiles within that specific cohort, department, filter, or location.
  • If a selected group or department contains fewer than 10 active participants, the entire metrics dashboard for that group is locked, hidden, and suppressed from administrative view.
  1. Low-Frequency Cell and Sub-Metric Suppression ():
  • This -anonymity threshold applies systematically to all nested data slices, categories, and cross-tabulated cells.
  • If an eligible group ( 10) is broken down into sub-metrics (such as filtering a team dashboard by age categories, morphological posture types, or psychosocial stress risk scales) and any single sub-category (cell) contains fewer than ten (10) individuals, that specific sub-category metric is automatically fully suppressed and hidden.
  1. Export Protection:
  • Administrative exports are restricted to high-level group trends. Managers cannot export raw CSV logs, database strings, or individual response charts of any physical capacity test or psychosocial survey.

4. Platform-Specific Cybersecurity Summary

Biotonix operates on a robust security architecture backed by verified, industry-certified enterprise partners.

4.1 Cloud Hosting Infrastructure (Microsoft Azure)

All corporate dataset aggregates, administrative accounts, and underlying database partitions are hosted securely within Microsoft Azure on servers physically located in the Canada East region (Quebec City, Quebec, Canada), with secondary, encrypted failover endpoints in the Canada Central region (Toronto, Ontario, Canada).

  • Physical Security & Certifications: Azure’s Canadian data centers utilize multi-layered security barriers, including biometric scanners, 24/7 CCTV, armed security patrol details, seismic bracing, dual-line fire suppression systems, and redundant backup generators. The infrastructure maintains active compliance with ISO/IEC 27001, 27017, 27018, SOC 1, SOC 2 Type II, and SOC 3 audits.
  • Encryption Standards: All stored database blocks and file attachments are encrypted at rest using Advanced Encryption Standard (AES-256) via Transparent Data Encryption (TDE), with cryptographic keys securely cycled in Azure Key Vault. All administrative connections, queries, and report downloads are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS) utilizing strong cipher suites (including ECDHE-RSA-AES256-GCM-SHA384) with Perfect Forward Secrecy (PFS).

4.2 Managed Security and Oversight Partnership (Solulan)

Biotonix partners with Solulan, an external certified SOC 2 IT security service provider, to manage and maintain our administrative and corporate IT infrastructure:

  • Tenant Security & DLP: Solulan administers our Office 365 environments, deploying Microsoft Defender for Cloud and advanced automated Data Loss Prevention (DLP) rules to monitor, alert, and block unauthorized data exports or suspicious administrator behaviors.
  • Identity Management & SIEM: Administrative connections to the BIOTONIX Health Portal require mandatory Multi-Factor Authentication (MFA) verified through Solulan-monitored enterprise identity nodes. Security logs are analyzed continuously via Solulan’s security information and event management (SIEM) systems.
  • Rotational Backups: Solulan manages automated, encrypted system backups utilizing a 14-day rotational retention window. All backup files are stored in an off-site, air-gapped, immutable Azure Blob Storage container to ensure absolute disaster recovery and protection against ransomware.
  • Incident Response SLAs: Security incidents are classified and escalated by Solulan according to strict contractual Service Level Agreements (SLAs) based on severity:
  • Sévérité 1 (P1 – Plateforme inaccessible): Direct response and containment actions initiated within one (1) hour (24/7).
  • Sévérité 2 (P2 – Incidents majeurs): Response within four (4) hours (Monday to Friday, 9h00 to 17h00 HNE).
  • Sévérité 3 (P3 – Incidents normaux / Soutien): Response within eight (8) hours (Monday to Friday, 9h00 to 17h00 HNE).

5. Contact Information

For corporate billing, key integration, or administrative account management:

  • Email: support@biotonix.com
  • Mailing Address: Solutions Biotonix Inc., 25, rue du Roi, Sorel-Tracy (Québec) J3P 4M2, Canada