Effective 1 September 2026 · Last reviewed September 2026
This policy explains what personal information EXO Insights Corp. collects through exoinsights.com and in the course of its business, why we collect it, who else handles it, and what you can do about it. We have kept it short and specific.
Your use of this website is also governed by our Site Terms of Use.
EXO Insights Corp. is a Canadian company headquartered in Waterloo, Ontario. We develop BioTwin®, a human-performance measurement and training system used by defence, law-enforcement, emergency-services and industrial organisations.
EXO Insights Corp.
295 Hagey Blvd, 1st Floor West Entrance
Waterloo, Ontario N2L 6R5
Canada
info@exoinsights.com
EXO Insights Corp. is the organisation accountable for the personal information described in this policy.
The most important thing to understand about privacy at EXO Insights is that our website and our product are separate.
Website and business data — covered by this policy. When you visit exoinsights.com, complete a form, subscribe to our newsletter, email us, or meet us at a conference, EXO Insights collects and controls that information. Sections 3 to 12 describe it.
BioTwin training data — not covered by this policy, and not held by us. Gaze, physiological, positional and performance data captured during a BioTwin session is recorded, processed and stored on the customer’s own hardware, inside the customer’s own environment. BioTwin can be deployed fully air-gapped, and in defence and law-enforcement deployments normally is. That data is not transmitted to EXO Insights. We do not hold it, access it, or use it. The customer organisation is accountable for that data and its own policies govern it. Where a customer engages us for support, analysis or research, any access is set out in the contract with that customer and is subject to that customer’s authorisation.
Information you give us. Name, work email address, telephone number, organisation, job title, country, and whatever you choose to write in a message — through our contact forms, newsletter sign-up, demonstration or meeting requests, and direct email.
Information collected automatically. IP address, the approximate location derived from it, browser and device type, referring page, pages viewed and time spent on them. This is collected by our website host and analytics tools.
Information from events and public sources. Contact details you give us at a conference or trade show, and publicly available professional information — a LinkedIn profile, for example — used to confirm a role or an organisation.
We do not collect sensitive categories of personal data through this website. Please do not send sensitive, classified, or operational information through our web forms or by unencrypted email.
Under PIPEDA we rely on your consent, either express or implied by the circumstances in which you gave us the information. If you are in the United Kingdom or the European Union, our lawful bases are consent (newsletter and non-essential cookies), legitimate interests (responding to business enquiries, site security and improvement, and business development directed at organisations), performance of a contract, and legal obligation.
We do not sell personal information, and we do not use it to train machine-learning models.
We keep this list short. As at the effective date of this policy, the third parties that process personal information on our behalf are:
Each is bound by its own contractual and data-protection commitments and may process the information only for the purposes we set. We may also disclose information to our professional advisers — legal, accounting, insurance — where necessary, and to a public authority where the law requires it.
Cross-border transfer. EXO Insights is a Canadian company, but the providers above hold data in Canada, the United States, and the European Union. Information held outside Canada is subject to the laws of the country where it is held, including lawful access by the courts and public authorities of that country. We use providers that offer contractual protections for these transfers, including the European Commission’s standard contractual clauses where they apply.
This website uses a cookie banner. Essential cookies keep the site working and remember the choice you made on the banner; these cannot be switched off. Analytics and marketing cookies are set only if you accept them. You can change your choice at any time by clearing this site’s cookies in your browser and choosing again. Declining non-essential cookies does not restrict your access to any part of the site.
We delete or anonymise personal information once these periods have passed.
Access to personal information is limited to the EXO Insights staff who need it to do their jobs. Company systems require multi-factor authentication, data is encrypted in transit and at rest by our providers, and access is reviewed when roles change.
We do not hold an ISO 27001 or SOC 2 certification and we do not claim one. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the individuals affected and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
Under PIPEDA you may ask what personal information we hold about you and receive a copy of it; ask us to correct it if it is wrong or incomplete; withdraw your consent to our use of it, subject to legal and contractual limits; and complain to us and, if you are not satisfied with our answer, to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are in the United Kingdom or the European Union, the GDPR gives you further rights: erasure, restriction of processing, data portability, objection to processing based on legitimate interests or to direct marketing, and the right to complain to your national supervisory authority or to the UK Information Commissioner’s Office.
To exercise any of these, write to privacy@exoinsights.com. We respond within 30 days. We may ask you to confirm your identity before we act on a request. There is no charge.
Our website and our products are for professional and organisational use. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to privacy@exoinsights.com and we will delete it.
Privacy Officer
EXO Insights Corp.
295 Hagey Blvd, 1st Floor West Entrance
Waterloo, Ontario N2L 6R5
Canada
privacy@exoinsights.com
Use this address for access requests, corrections, complaints, or any question about this policy. Our Privacy Officer is accountable for EXO Insights’ compliance with PIPEDA.
We will post any change on this page and update the effective date at the top. Where a change is material, we will flag it on the site for at least 30 days before it takes effect.
This policy covers exoinsights.com and EXO Insights’ business dealings. Your use of this website is also governed by our Site Terms of Use.
© 2020–2026 EXO Insights Corp. All rights reserved. BioTwin® is a registered trademark of EXO Insights Corp.
Sign up for our blog posts and resources!
