Privacy notice

Last updated: November 2, 2026

KeepCount is a record-keeping service for licensed child care in Ontario. It is operated by KeepCount Inc. ("KeepCount", "we", "us"), Suite 200, 51 Village Centre Place, Mississauga, Ontario L4Z 1V9. This notice explains what information KeepCount holds, about whom, why, where it is kept, who can see it, how long it is kept, and how to ask about it.

Two roles

Records an organization keeps in KeepCount. A licensed child care centre or home child care agency (the "organization") uses KeepCount to keep the records that the Child Care and Early Years Act, 2014 and O. Reg. 137/15 require, and others it chooses to keep. The organization decides what is recorded and why, and remains responsible for those records. KeepCount stores and processes them only on the organization's behalf and on its instructions, under the data processing terms in section 14 of the terms of use and their schedules, and does not use them for any purpose of its own. If you work for, volunteer with, or have a child in the care of an organization that uses KeepCount, questions about your records go to that organization first; we help it answer.

Information KeepCount collects for its own business. KeepCount Inc. is responsible for the information it collects to run its own business: the accounts and billing details of the organizations that subscribe, demo requests, trial links and trial requests, messages sent to hello@keepcount.ca, the KeepCount updates list, and security records.

Who is accountable

Huphy S. Ghayur, Privacy Officer, KeepCount Inc., Suite 200, 51 Village Centre Place, Mississauga, Ontario L4Z 1V9, hello@keepcount.ca (put "privacy" in the subject), is responsible for how KeepCount handles personal information.

What organizations record in KeepCount

What is recorded depends on the features the organization uses. Which records are encrypted is listed under "How information is protected", who sees them under "Who can see the information", and how long they are kept under "How long information is kept".

Staff, home child care providers, volunteers and students. Identity, contact and work details (including home address, date of birth and College of Early Childhood Educators registration number), screening and qualification dates with the documents where the organization uploads them, a first-aid arrangement while training is pending (its reason and start), whether a student is also an employee, rehire and leave dates, director's approvals, policy, quiz and training records, an administrator's compliance notes, work schedules, the times staff clock in and out (hours recorded in KeepCount: whether each stretch was in a room with children or other time such as administration, preparation or a break, the room, the shift it matched, the person's position and College of Early Childhood Educators registration status at the time, and a supervisor's correction with its reason), account activity (sign-ins, alerts and how they were answered, passkey and sign-in email changes, two-step verification resets and who made them) and, for a person who switches alerts on, each device's push address or notification token. For the health assessment, the statement given at 18 about youth-court findings and a director's first-aid exemption, KeepCount records only the date; the document stays in the organization's own files. When an owner or administrator signs the inspection binder in KeepCount: the name and role they typed, any drawn signature and a copy of the binder as signed.

Children. Name, date of birth, room, enrolment dates and attendance days, whether an individualized plan is on file (yes or no only), pick-up notes, whether the child attends school, up to two emergency contacts, the pick-up list (the people the family named, with their phone number, relationship, the day their photo ID was checked and a note, and anyone the organization marks as not to pick the child up, for example under a court order: KeepCount refuses a sign-out made at the time to that name, or to one close to it, and shows staff that the child is not to be released to them; a departure entered later, or sent from a tablet that was offline, is recorded and shown to the office in "Needs a look"), and the file checklist: which documents are on file, not the documents themselves.

Daily records and attendance. Arrivals and departures, with who received and released the child and the person the child was released to, and how a parent approved someone not on the pick-up list; a parent's word at drop-off of who picks the child up that day, noted by staff with who said so (the name and the note encrypted); sleep checks with what staff saw; head counts and outdoor times (the numbers and times by room, why a room stayed in, and any note staff add; a note is required when a count does not match the register or is above capacity, and when a room stays in for a reason other than the weather); absences and safe-arrival follow-ups; the site's daily checks; notes of play materials (the form asks staff not to name a child); supplies a child is running low on; and late entries, corrections and missed checks, with the reason and the staff involved.

Health information. Allergies and food restrictions, with the epinephrine details; medication and sunscreen authorizations and doses, with any observation; whether a child has an individualized plan (not the plan itself); absence reasons; the reason for a menu substitution noted for one child (which child and why), seen by the owners, administrators, the site's supervisors and the staff of the site, and in the organization's export, never by office staff, volunteers or families; it is kept with the site's menu records, not deleted with the child's records, so staff write the child's first name only; and observations made during sleep checks. Plans, immunization records and medical documents stay in the organization's own files. Allergies, medication, doses, emergency contacts and absence reasons are shown only to the organization's owners, administrators and supervisors (a supervisor: children of their sites) and to employees who work at the child's site (in an organization with one site, every employee); in home child care, to the provider of the home the child is placed in, never to another home's provider or to an agency's employees who are not administrators. Volunteers and students see no child's records in KeepCount; they work beside a staff member who does. Sleep-check observations are part of the room's daily records, which the organization's staff can read. The activity log records which child's record was changed and which fields, never the health information itself.

Incidents and serious occurrences. What happened, the action taken, witnesses, follow-up and who wrote each note, files such as a signed accident report or a photo of a hazard (KeepCount asks that no photo showing a child be added), when and how the parent's copy of an accident report was given, and the report to the Ministry. These records can describe injuries, illnesses, allergic reactions and allegations. Where the organization shares the copy of an accident report with a family member in KeepCount, the copy as it was shared and when they recorded reading it.

Home child care. Each home's address, provider and agreement; the people who live in the home or are regularly there (name, relationship, date of birth and the dates of their screening, of which only the dates are recorded, never the documents or what they say; and, while a vulnerable sector check is applied for, a note of the additional measures the agency put in place, with the day they began, who recorded it and when, and any later note that corrects it); each child's placement, with the child's home address and the notes made before placing the child, which can describe the special or medical needs of the children in the group; the provider's day, recorded on the same screens as a centre, and the monthly home-ready check the provider ticks (the first-aid kit, the emergency numbers, a telephone, the evacuation procedure, medication storage and each child's supplies), with their note, who ticked it and when; and inspections and home visits, including the Ministry's home visit checklist where a home visitor completes it in KeepCount (its answers, who was there, the medications on site, and who signed it).

Provider pay. Where a home child care agency uses provider pay, KeepCount works out what the agency owes each of its providers from the agency's own rules and records: the days and hours worked at the provider's home, the rates of the provider's agreement, each statement's lines and totals, and the payments the agency records as made. The agency's owners and the administrators an owner allows see these records, and a provider sees their own approved statements; KeepCount support sees them only in a support session; other staff and families never do. The agency approves what is worked out, pays the provider itself and records the payment, and decides whether a provider is an employee or self-employed. KeepCount collects no social insurance numbers for it, files no tax slip and sends no money for provider pay.

Family billing. Where an organization uses Billing, it records what it charges families and what they pay: a family account (the children it pays for, and its payers' names and email addresses, kept encrypted), each child's recurring fees, invoices and credit notes with their lines (which can name the child and the fees), payments received and what each payment paid, refunds, a last month's deposit and the invoice it was applied to, the organization's bank deposits of families' payments, which year-end receipts were printed and their totals, the books' entries by family account and, for a child whose fees a funder subsidizes, the funder, the child's approval (case number and the family's share), the funder's share of each line and the funder's payments. A correction is a new entry that refers to the one it corrects, and a month the organization closed is not changed. The organization's owners and the administrators an owner allows see and make these records, and so does anyone an owner names for an office; KeepCount support reads them only in a support session. A family member who signs in sees their own family account's invoices, payments and receipts; other families, other staff and volunteers do not. KeepCount emails an invoice to the family's payer with a link that works for 14 days: the email never names a child or shows a line or a note, the page the link opens shows no child's name, and each time the link is opened the organization's activity log records it. The CWELCC funding estimate works out an estimate of the organization's allocation from the records it already keeps in KeepCount and the figures it types from its region's letter. It holds no new information about children, families or staff, and KeepCount sends nothing to the region. KeepCount holds no card number for family billing; payments through Zūm Rails are described under Service providers.

Inspections and other records. Where the regulation requires it, the records name people outside the organization, such as resource consultants, inspectors, fire-safety contractors and the emergency shelter's contact. Where an owner or administrator keeps the licensee's police record checks in KeepCount, each line names the licensee or a director, officer or person with a controlling interest, with the check's dates; the check itself and its result are never recorded. Drinking-water, public health, pest control, food temperature and Fire Code records name who did each task; the drinking-water copy the centre makes available to the public names the people who flushed, sampled and maintained the filters, and no child. An inspection's record can include an enforcement action against the licensee and when it was reported. Where animals are on the premises, each animal's vaccination certificate is kept. Illness counts are numbers by room and symptom, never names, and KeepCount keeps no copy of the immunization list it prints for a health unit.

The calendar. Events an owner, administrator or supervisor adds; the form asks that no child be named. A person can make a private link that adds their calendar to a calendar app (Google Calendar, Apple Calendar, Outlook or another), and an owner, administrator or supervisor can make one for the families of a site or home. KeepCount stores a fingerprint of each link, not the link itself; a link read too often stops answering for the rest of that hour, and making or turning off a link is written to the activity log. Like any web address, a link can appear for a short time in the request logs of the service that runs KeepCount. Anyone who has a link can read what it carries without signing in, until its owner turns it off or makes a new one: a person's link carries what that person sees as staff, never the records only administrators see, and a families' link carries closures, menus and the events marked for families. Neither names a child. The calendar app fetches the link from its own servers, which may be outside Canada, and keeps the events under its own terms with the person who added the link; KeepCount sends nothing to it and has no agreement with it.

Messages to staff. Messages the office (an owner, administrator, supervisor or office staff member) sends to staff, volunteers, students and providers, and their replies, with who wrote and who has read each, the time by which the office asks for a message to be read and, where the office told a person another way (phoned, told in person, or not needed), a mark saying so with who made it and when. A member of staff, a volunteer, a student or a provider can also write to the office: the owners and administrators of the whole organization can read and answer it, and so can the supervisors, office staff and administrators limited to some sites whose sites include the writer's main site or, for a provider without one, their home's office; with neither, only the owners and administrators of the whole organization read it. The form asks that no child's health details be written in a message. A reply goes to the office only, never to the others the message went to. The office reads the whole conversation: the owners and administrators and, for a message to a site, office, room or home, its supervisors and office staff; a supervisor's or office staff member's message to named people is read by its author and the owners and administrators. Someone who leaves one of those roles, or moves to another site, no longer reads the conversations of the site they left. The office also sees, for each message, how many of the people it went to were alerted on a device, how many have no device with alerts on, how many alerts were not delivered and how many are still being sent or are no longer active, and beside each person their latest alert for it (sent to a device, being sent, not delivered, no device with alerts on, or no longer active); it never sees the devices themselves. A person a message went to reads the office's messages to them, their own replies and the office's answers. KeepCount support can read messages, these and messages with families, in a support session, but never writes them. The author can delete a message on the day it was sent. The activity log records who started each conversation, the group and deletions, never a subject, a text or the names of the people it went to.

Resources. Collections the owners and administrators share in Resources & forms; the form asks that no personal information be put in one. KeepCount records who opened each collection and when, so the owners and administrators can see how many have opened it.

Families: parents and guardians who sign in. Where an organization uses Families, an owner, administrator or supervisor of the child's site adds a family member to a child's file and invites them. When a staff member adds a family member whose email address already belongs to one of the organization's family members (or a former one), KeepCount shows that person's name and how many other children they have there, and links them only once the staff member confirms; a move from another child care app links a family member it finds under the same address. KeepCount keeps their name, the email address they sign in with (or, for one given a code by phone, the last ten digits of that number), the children they are linked to and, for each, whether they may pick the child up and receive messages and photos, who added and removed them and when, and a setting for a later part of Families (billing) that does nothing in this version. The organization decides who is linked to a child, for example under a custody order.

Families do not sign in with a password. The organization gives a family member a 12-character code by email, in a message that names the organization, never a child, or by phone or in person, in which case the person giving it could also use it until it is used or replaced. KeepCount sends no text messages. A code works once and for 7 days, stops working after five wrong tries, is replaced when the organization makes a new one, and is refused once the family member has no child they may still see or the account is closed. KeepCount keeps a fingerprint of the latest code, never the code itself, cleared once it is used or has had five wrong tries; its record of emails sent keeps the invitation's subject, the address it went to, the kind of email and whether it was delivered. Later, family members sign in with a passkey or a new code.

Family members see their own children only: the arrival and departure times, when the child fell asleep and woke, and when the child's room went outdoors while the child was there, for the day and the past month; the child's allergies and food restrictions; the names and relationships of the emergency contacts and of the pick-up list, with the day photo ID was checked, without phone numbers or notes (and never anyone the organization marked as not to pick the child up); the child's other family members who have access, and whether each has signed in; the calendar items shared with the families of the child's site and room; for each day the child attended, the site's menu with its substitutions (never one noted for one child, nor one withdrawn), that an incident report was made for the child that day (never what it says; shown only once the organization has recorded telling the family, and never for an allegation of abuse) and, only where the organization shows them, the times medication was given (never the medication or the dose); the photos described under "Photos shared with families"; the absences recorded for today and coming days (with the reason where a family member reported it), and when another family member changed or cancelled one; and whether another family member withdrew the child's photo consent (never who). They see no other child's record, no staff record, no incident record other than an accident report copy the organization shares with them, and nothing else of the organization.

Where the organization asks them, a family member can sign a medication or cream authorization in KeepCount (the name they type, the statement they agreed to and when; nothing is given under it until they sign), read the copy of an accident report the organization shares with them and record that they read it, and give, refuse or withdraw the written consents the organization asks for. They can ask the organization to change the child's allergies, emergency contacts or pick-up list: KeepCount keeps their words and any name, relationship and phone number they give, with the organization's answer; nothing in the child's file changes until the organization changes it with its own forms. They can report their child's absence for today or a coming day the child is expected (with a reason and a short note, kept encrypted), and change or cancel their report for a day still to come; a family member who may not pick the child up phones the centre or home instead. Besides these, their messages, alerts and passkeys, the only thing they change is their child's photo consent; they ask the organization to correct any other record. Their device's alert for something to read or sign names the organization, never a child, and no email is sent. The activity log records each invitation and new code (who made it, and how) and each sign-in with a code. KeepCount support, in a support session, can see a child's family members and pick-up list but never adds, changes or removes them (except by undoing, on its day, a move from another child care app that brought them in), and never invites a family member or makes a sign-in code. Removing a family member ends their access at once, and a family's access to a child ends 30 days after the child's last day.

Signing a child in at the door. Where a centre chooses it, a family member can sign a child in at the door, and ask to take the child home, with a personal code on a room tablet. Staff still sign children in and out. KeepCount keeps the code only as a one-way hash and shows it once, to whoever makes it. A departure is always confirmed by a staff member and checked against the child's pick-up list; a code never releases a child. Each entry says whether a family member or a staff member made it. The requests are kept with the day's records for the retention period; a wrong code entered at a tablet is kept for seven days (the site, the tablet's session and the time, never the code).

A child's record also holds the written consents the organization's enrolment form asks for and it chooses to record in KeepCount (for example emergency care, outings, photos for its website or social media, the parent handbook): each answer (given, refused or withdrawn), the day, the name of the parent or guardian who gave it, whether it was given on the signed form or in KeepCount, and a note. An answer is never changed: a new answer is a new record, and the latest counts. KeepCount support never records one.

Messages with families. Where Families is on, the organization and a child's family members who receive messages write to each other in KeepCount about one child, or the organization writes to the families of a room, a site or a home (a note to every site goes to each site separately, so each family's reply goes to its own site). A family member's message about their child can be marked as a pick-up note for a day (not by a family member who may not pick the child up), and taken back until the end of that day: the staff who read the child's messages see it when they sign the child out, anyone else only that there is a note and whom to ask, and it shows only while its writer still has access to the child and receives messages. Each family member sees the organization's messages meant for them and their own, never another family member's. A family member whose messages about a child are switched off no longer sees or receives the messages about that child or the notes to its room or site, earlier ones included (unless another of their children who receives messages is there), and a room's or site's notes are seen only while the child is still there. On the organization's side, they are read by the owners and administrators, the site's supervisors and the staff the schedule assigns to the child's room (in home child care, the provider of the child's home); office staff, volunteers and students on placement do not see them (a student the organization also employs works as staff). A family member sees the writer's first name and the organization's name; staff see the family member's name and relationship to the child. Before sending, staff see which family members a message will reach, whether each has signed in, and how many have messages switched off (a number, never their names). When staff note that a child is running low on supplies, the family members who receive messages get one message in the organization's wording (which may contain no link or web address), at most one a day until the note is marked restocked, giving the child's first name, the items and the first name of the staff member who noted it; the organization can switch it off, and KeepCount support never sends it. A message sent for a note made by mistake can be withdrawn: the family no longer sees it, and the staff keep it, marked withdrawn. Messages are not for emergencies: families phone the centre or home. They are not end-to-end encrypted: the staff described above, and KeepCount support in a support session, can read them. The writer can delete a message on the day it was sent; an owner, administrator or the site's supervisor can withdraw one the organization sent at any time, and families then no longer see it (the staff keep it, marked withdrawn). The activity log shows a family member who writes as "a family member", never by name, and records who started each conversation, the group and deletions, never a subject or a text. A family member or a staff member can report a message to the organization's owners, administrators and the site's supervisors: the report (which message, one of four reasons, who reported it and when; never any text) is kept in the activity log for the activity log's period; closing it records who closed it, when and what was done (one of three answers).

Photos shared with families. Where Families is on, the staff who care for a child (the owners and administrators, the site's supervisors, the staff the schedule assigns to the child's room and, in home child care, the provider of the child's home; never office staff, volunteers, students on placement or KeepCount support, though a student the organization also employs works as staff) can share a photo of a child or a group, with a short note. A photo is shared only when every child in it has photo consent, and families see it only while every child in it still has consent. Consent is given separately for each child, by a family member of the child in KeepCount or on the organization's signed form, and is never a condition of enrolment. Any family member of the child, or the organization, can withdraw it at any time: from then on KeepCount shares no photo with the child in it and shows none to families, group photos included (a link to a picture made before then keeps working until it expires), and the organization can delete the photos already shared; when the organization withdraws it, only the organization can record it again. A photo is seen by the family members of each child in it who receive photos, with the first name of the staff member who took it, and by the staff who care for those children. KeepCount does not tell a family the names of the other children in a group photo, and staff are asked not to name children in a note; the person sharing a photo sees its note word for word before it is shared. The person who shared a photo, or an owner, administrator or supervisor of its site, can correct or remove its note at any time: families then see only the corrected note, and the staff keep the note as it was first shared, with who last corrected it and when (each correction is in the activity log). KeepCount keeps the picture, the note, who took it, when and where, which children are in it, and each child's consent (when and by whom it was given and withdrawn). KeepCount's screens shrink a photo and save it again before it leaves the device, which removes what the camera adds to it, the place included; KeepCount does not check a file sent to its storage by other means. Photos are kept privately in Canada, in the database provider's file storage. They are never attached to an email or sent in an alert, and nothing KeepCount sends shows or describes one. Families see each child's photos of the last month; KeepCount does not open an older one for them, even from a file address kept from an earlier visit. Photos are never used to train any model, and KeepCount uses them for nothing else. KeepCount cannot stop a family member from taking a screenshot: the terms of use ask families not to post or share photos of other children, and the family's Photos page says so. The activity log records that a photo was shared or deleted and which children were in it, that its note was corrected or removed (by whom, never the note), and that consent was given or withdrawn (a family member is shown as "a family member"), never a note or a picture. The organization's export lists the photos' records and consent, not the pictures. A family member or a staff member can report a photo to the organization's owners, administrators and the site's supervisors: the report (which photo, one of four reasons, who reported it and when; never any text) is kept in the activity log and deleted with the photo's activity-log lines (see "How long information is kept"); closing it records who closed it, when and what was done (one of three answers).

Bringing records in from another child care app. An owner or administrator of the whole organization can bring children's records in from the export files of a child care app KeepCount can read. The files are read in the browser of the person bringing them in and are never uploaded to KeepCount or kept on the device; only what the review shows is sent, once the move is approved. Only what KeepCount uses is saved (children's names, dates of birth, rooms, start dates and weekdays; for an agency, each child's home address, never in place of one already recorded, and the other app's classroom, kept until the child is placed in a home; emergency contacts, family members' names, email addresses and relationships, and attendance times); family members brought in are added, not invited, and receive nothing. The other app's free text never becomes a record by itself: its allergy and medical note is kept only as a note to confirm, shown only to the owners and administrators and the supervisors of the child's site, and its "Permitted in photos" only as a note to confirm, never as photo consent. A child who has left comes in only for the attendance within the retention period. KeepCount keeps a record of each move (who, when and how many records; never a name or a file) and what it added, so that the move can be undone on its day.

The help assistant. Where an organization's owner turns on "Ask the assistant" (it is off unless they do), a question a person types is answered from KeepCount's guide for their role by Anthropic's service, in the United States. KeepCount sends Anthropic the question (at most 500 characters, with any email address or phone number in it removed), the text of the guide, the person's role and whether the organization is a centre or an agency; never their name, the organization's name or any record. The box asks people not to type names or details; if someone does, it is sent with the question. A question about self-harm or a child at risk is not sent: KeepCount shows crisis lines instead (9-8-8, 911 and a children's aid society). KeepCount keeps no copy of the question or the answer. The owner can turn it off at any time in Settings.

Waiting lists. Where a centre or agency takes applications to its waiting list in KeepCount: the family's name, email and phone, their relationship to the child and that they are its parent or guardian; each child's name and date of birth (or expected date of birth), the care asked for (start month, days and hours, the site, or for an agency the area), the priority grounds answered (including an enrolled brother's or sister's first name), the answers to the centre's own questions, the language the family chose (English or French), and the dates of the application, its confirmation, and any update or withdrawal.

Visits and offers. Where a centre or agency lets families book a visit in KeepCount: the family's name, email and phone, the age group and the month they hope care would start (both optional), the time booked, and the centre's reason if it cancels the visit. KeepCount emails the family a link to change or cancel the visit and a reminder the day before (unless the visit was booked within the last day); no child's name is asked for a visit. Where it offers a place from its waiting list: the site, the start date and the date to reply by, the centre's reason when it offers a place out of the list's order or takes an offer back, and the family's answer (accepted, declined, or not answered in time).

What KeepCount does not collect. Social insurance numbers, health card numbers, Ontario education numbers (which the Child Care and Early Years Act, 2014 restricts, s. 73), diagnoses, photographs of children (other than the photos shared with families, with photo consent, described above) and payment card numbers. Organizations agree in the terms of use not to enter them.

KeepCount works out statuses, due dates, the readiness score, whether a person is cleared to work with children and to count in ratio, and the day's "Needs a look" list each time a screen is shown, and does not store those results, except each organization's readiness score once a day (the numbers only, never a name), which its administrators see in their To do.

What KeepCount collects for its own business

• Organization accounts and billing: the organization's names, type, sites, contact and billing details, business or HST number, plan and payment status, trial and cancellation dates and any reason given, and who accepted the terms, when and which version. KeepCount takes no card and never stores a card number.
• Demo and trial requests: your name and contact details, the organization's details (such as its type, size and, if you give it, its Ministry licence number), what else you choose to tell us, our notes, the IP address of a trial request, and the trial links we send. Trial links and one-time links are stored only in scrambled (hashed) form. Only KeepCount support sees demo requests and trial links.
• Messages to us: what you write to hello@keepcount.ca or through Report a problem in the app (with the screen it was on and the app's version), and our replies. The hello@keepcount.ca mailbox is provided by Google Workspace, so what you write to us there, and our replies, are handled outside Canada.
• Support notes: what KeepCount support writes down about an organization's account. They are not shown in the app; an organization or a person can ask for what concerns them.
• Security records: IP addresses used to limit repeated requests; sign-in events with the IP address and browser; and the activity log described under "Who can see the information".
• Sign in with Google: where it is offered (only in demonstrations for now), a person can choose to sign in with their own Google account instead of a password. Google then confirms the person's email address to KeepCount and sends their name and photo; KeepCount keeps only Google's identifier for the account, the email address and that Google verified it, not the name or the photo (the name in KeepCount stays as the organization entered it). Google learns that the person signed in to KeepCount and handles this outside Canada, under the person's own agreement with Google. A person can stop using Google to sign in under My account (My details for staff and providers).
• Error reports: when a page fails, a short technical report (what failed and where, the browser and version, and the account and organization if someone was signed in). Email addresses, record identifiers and long numbers are removed before it is stored, and error messages are written not to name a person or a child. Reports are kept in Canada and read only by KeepCount support to fix problems, including in a daily summary emailed to support through the email provider.

Why

For an organization's records: to provide KeepCount to that organization. That means storing the records, showing them to the people the organization authorizes, working out statuses, due dates and the readiness score, sending the reminders and summaries it has set up, printing the binder, producing exports, and giving support when it asks or when its account seems to need help (a payment past due, a set-up that has stalled, a drop in its readiness score). Support looks at the daily readiness score and how much the organization uses KeepCount to offer that help (section 14.2 of the terms).

For our own information: to arrange demonstrations and trials, to set up and run accounts, bill for subscriptions and keep tax records, send account notices, answer messages, send KeepCount updates to people on the list, keep the service secure and prevent abuse, and meet our legal obligations.

KeepCount does not sell personal information, does not use it for advertising, and has no advertising or tracking cookies: the app's signed-in pages have no analytics, and the public pages may count visits only as "The public website" describes. KeepCount has no artificial-intelligence features, does not use facial recognition, does not use organizations' records to train AI models, and does not build profiles of children or families. Records in KeepCount are not used for any other business unless the organization asks (see GATS under "Who can see the information").

Emails

• On behalf of the organization: a weekly reminder to each person with something outstanding, which says how many things they have to do, never what they are (an organization can send it to its administrators only); completion emails, which tell a person they have completed everything required and tell the administrators or the organization's contact address (as its summary setting chooses) who completed; and a weekly summary for administrators that lists people by name with what is outstanding or due. The summary gives a serious occurrence's date and site, never what happened, an inspector's citation by section, never the inspector's words, and how many people are not cleared, without names. Reminder and summary emails carry an unsubscribe link that works at once.
• Safety alerts on behalf of the organization: when a check in a room or home falls due (head counts, sleep checks, a room short of staff, the site's daily checks, the drinking-water flushing and others), an alert goes to the devices of the staff in that room, or of the home's provider, who switched alerts on; if it is still not done after a few minutes, an alert and an email go to the supervisors, then the administrators. Reminders of homes not yet inspected this quarter go to the home's visitor and the agency's administrators, never to the provider, because the inspection is unannounced. Alerts about checks are sent only on operating days, from the opening to an hour after the closing where those times are recorded. Alerts name rooms, sites, homes and times, never a child. An organization can also have the room's devices told a few minutes before a check falls due (a heads-up naming the room or home and the time; no email); it is off until the organization sets it under Settings. A person can switch the alert emails off for themselves under My account, where devices are switched on and removed too.
• Account messages needed to run the account: demo and trial confirmations, invitations (a family member's is described under "Families: parents and guardians who sign in"), password resets, passkey and sign-in email notices (to the old address and the new), a notice when an owner, an administrator or KeepCount support resets the person's two-step verification, invitations to administer another organization, notices to administrators when a change to the regulation affects their policies, trial, billing and payment notices, and up to three set-up reminders in a new organization's first two weeks. They stop when the account closes (the regulation notices also while it is read-only); unsubscribing from reminders or updates does not stop them.
• KeepCount updates (below). KeepCount sends no other marketing email.

KeepCount's emails are written so that none names a child or carries a child's health information. An organization can pause the reminders, send the weekly summary to nobody and switch off alert emails (home visit reminders included) in Settings; completion emails and the account messages continue.

The KeepCount updates list

KeepCount sends occasional updates about changes to the software, changes to Ontario's child care rules and new Learn guides. You receive them if you asked for them (on keepcount.ca/learn, confirmed by an emailed link, or with the switch in your account), if you asked us in writing, or if you are an owner of an organization that pays for KeepCount, or an administrator or supervisor an owner chose to receive them: for as long as it pays, and for rule changes and guides for up to two years after it stops, never after you stop being an owner or one of the people an owner chose. A billing contact who is not one of them receives account messages only. Staff and providers are not added; administrators may show them an update's short part for staff in the app (KeepCount does not email it to them). We keep your email address, how you came onto the list, the wording you agreed to and the date, and for the Learn form the IP address and browser, so that we can show your consent. Every update has an unsubscribe link, and we keep a record of an unsubscribe so you are not added again. If an update bounces, we stop sending updates to that address; if you report one as spam, we treat it as an unsubscribe. We do not track whether you open an email or click its links.

Who can see the information

• Your organization: owners and administrators see their organization's records; a supervisor or an office staff member sees only their sites. Office staff manage people and their screening documents; they see no children's health information (see "Health information") and no incident records. Staff and office staff see a child's first name and initial; owners, administrators and supervisors see the full name. Volunteers and students see only their own records, the messages the office sends them and the conversations they start with the office. Only an owner deactivates or removes an owner's or an administrator's login. Each organization sees only its own records, and the database enforces this on every table.
• On the room screen, a site's staff and office staff see who is not cleared to work with children or to count in ratio today, never why; supervisors, owners and administrators also see why; volunteers, and students on placement who are not also employed, see none of it.
• A site's daily checks (other than the drinking-water records below) are read by its room staff, supervisors and office staff, and its play-material notes by its room staff and supervisors, with the owners and administrators in both cases; volunteers and students on placement see neither. The drinking-water and public health records are read and changed by the site's supervisors and the owners and administrators, with the room staff recording illness counts (which they also read), flushing, filter changes and checks of automatic flushing devices; office staff, volunteers and students do not see them. Only owners and administrators see the licensee's police record check lines.
• Staff clock-in and out times are seen by the person (their own), by the supervisors of the site they clocked in at and by the organization's owners and administrators, never by families. KeepCount works out no pay from them.
• The people who sign a child out (staff of the child's site, or the provider of the child's home) see the names, relationships and notes of the child's pick-up list and whether photo ID was checked. The list's phone numbers, and the child's family members who sign in with their email addresses, are seen by the owners, administrators and supervisors of the child's site; these phone numbers, and those kept for signing in, are in the organization's export.
• In a home child care agency, a provider sees the children of their own home (first name and initial), their home's day with who recorded each entry, and those children's allergies, medication, emergency contacts and sleep checks, which the regulation requires to be kept at the home or readily accessible to the provider. The agency's owners and administrators and the supervisors of the home's office see the provider's day as it is made, and the people in a provider's household, the agreement and the placement notes, which the provider's colleagues do not see.
• One sign-in for several organizations: an owner or administrator of one organization can also administer another with the same sign-in, when invited by an owner of the other organization (or by KeepCount support, for it) or when they set up a new one with the same email. They see an organization's records only while they have it open, after two-step verification, and receive the emails and alerts it sends its administrators. The other organization sees their name, sign-in email and access level, and in its activity log what they did there; it sees nothing of their own organization, where their own training and screening stay. An owner of the other organization can remove that access at any time.
• When someone views, prints, exports or downloads a person's record on KeepCount's screens, the organization's activity log records who did it and when; for a child, this includes their file (opened by staff, or by a family member, shown as a family member's view), the allergy list and the room screen's allergy details, the medication record, the arrivals and evacuation lists and the close-out. Exports, and a family member opening a child's file, are recorded by the database itself; other views by the screen, so a view made offline, or outside KeepCount's screens with a person's own sign-in, may not be recorded.
• For a licensing visit, an owner, an administrator or a supervisor can download a visit pack: the inspection binder, the period's records as spreadsheets (they name the children and the staff) and the files the binder links to. Medication doses and the allergy list go in only when an owner or administrator makes it. Making a pack is written to the activity log with what it held, and the pack is in the organization's hands from then on.
• KeepCount support can open an organization's records only through a support session, after a two-step sign-in, for eight hours at a time; the session is recorded in the organization's own activity log. Support is given by people acting for KeepCount Inc. who are bound to confidentiality. Outside a support session, support sees for each organization only its account and billing details (which can name a person, and include any reason for cancelling), its sites, set-up progress and readiness score, counts of its people, sign-ins, use and emails, support's own notes and, on the updates list, who receives updates, with their organization and role; never a record about a person or a child. Help with setting up, where an organization asks KeepCount support for it, is given in a support session in the same way.
• KeepCount Inc. and Ghayur Accounts and Tax Services (GATS), the accounting firm of KeepCount's founder, are separate companies. GATS has no access to the records organizations keep in KeepCount unless an organization gives it access itself; KeepCount shares none of them with GATS and does not use them for GATS's accounting, bookkeeping or tax services, or to market them, unless the organization asks. An organization that hires GATS decides itself what to give it. The "From GATS" card on an administrator's dashboard opens ghayurtax.com without telling GATS where the visit came from or which organization the person belongs to.
• KeepCount stopped issuing training certificates in October 2026: a person's completion is on their record. Certificates issued until then stay on the person's record, read-only, and in the organization's export until their retention period ends (the person sees their completion, not the certificate, in KeepCount; the organization can give them a copy from their record's export); keepcount.ca/verify no longer checks them.
• The organization shows its records to licensing inspectors and program advisors. KeepCount discloses information to anyone else only where the law requires it, for example a court order; we tell the organization first unless the law forbids it.

Service providers and where information is kept

When a centre or agency turns on payments through Zūm Rails (none has yet), KeepCount gives Zūm Rails the centre's or office's business details (its legal and display names, the name on bank statements, its Interac email and its address), the totals Zūm Rails sets its first limits from (how many families and payers it bills and what it invoices a month, without names) and the name and email of the owner who agrees, so Zūm Rails can send its application. Everything else Zūm Rails asks for (an identity check, the owners and directors, documents, the bank) the owner gives Zūm Rails directly; KeepCount does not receive or keep it.

Information handled outside Canada is subject to the laws of the country where it is handled and may be accessible to that country's courts, law enforcement and national security authorities. Several of these providers are United States companies, so United States law can also reach information they hold in Canada. Where an organization has added a training video, or a YouTube video to a collection in Resources, YouTube (Google) plays it in privacy-enhanced mode, under Google's own terms: when a page with a training video opens or that video plays, and when Play is pressed on a YouTube video in a collection, your device's IP address and browser details, not your name, go to YouTube outside Canada. A collection's other video links (Vimeo, Google Drive, OneDrive) open in a new tab, under the terms of the site that holds the video. Fonts and the app's scripts are served by KeepCount itself; the only outside scripts are Cloudflare's Turnstile check on the public forms, Cloudflare's Web Analytics script on the public pages (once it is switched on, as "The public website" says), YouTube's player, and Zūm Rails's Connect script, loaded from Zūm Rails only when someone opens its window to set up a pre-authorized debit.

Alerts on a device are sent only with its user's permission in their browser (in the KeepCount app, the phone's own permission). In a browser they are delivered by the push service of that browser (Google for Chrome and Android, Apple for Safari, Mozilla for Firefox, Microsoft for Edge on Windows), outside Canada, under that company's own terms with the person who uses the browser. The push service receives the device's push address and each alert encrypted for that device, which it cannot read; it is not given the person's name. A family member can switch on alerts on their own device in the same way. Alerts and notifications name rooms, sites, homes and times, or say "a new message" (to a family member: "You have a new message from" and the organization's name, with a link to sign in and read it), or say that a message or a photo was reported; they never carry a child's name, a message's subject or text, or a photo. Staff devices are told of a family's message only during the site's hours.

The KeepCount app. When it is released (it is not available yet): the KeepCount app for iPhone and Android is the same service as keepcount.ca, with the same rules about who sees what. It keeps on the phone the person's sign-in (removed when they sign out), records waiting to be sent while offline, and, where notifications are on, the phone's token. Apple's notification service and Google's Firebase Cloud Messaging, listed above, deliver its notifications: they receive the phone's token (Google also an identifier of the app on that phone, made only once notifications are switched on), each notification's words (rooms, sites, homes and times, the organization's name, or that there is a new message, something to read or sign, or a report; a home left unnamed is called by its provider's first name and initial, and that name is in its alerts; never any other person's name, a phone number, a child's name, a message's text or a photo) and the page a tap opens (an address that names the organization, site, room or conversation by an internal number, never a child), and unlike a browser's push service they can read those words. On an iPhone and on Android, what the app keeps is not copied to the phone's cloud backup or to a new phone. KeepCount does not save a photo taken in the app to the phone's photo library, and on Android the camera's photo is removed from the phone once the photo dialog closes. A file opened or exported in the app is kept in the app's own cache until the next file or the next start (and at sign-out when the phone is offline), and offered through the phone's share sheet, where the person chooses where it goes.

How information is protected

Everything travels encrypted (TLS) and is encrypted at rest. The following are also encrypted inside the database with a key the application holds, so a copy of the database alone does not reveal them:

• Children: names, pick-up notes, absence notes, safe-arrival follow-up notes, a sleep check's note, a close-out's explanations and note and the notes added to a day after it, which child a menu substitution for one child is for and why, the name and note of a parent's word at drop-off of who picks the child up, and the addresses of children in home child care.
• Contacts: emergency contacts; the names, phone numbers and notes of the people on a child's pick-up list; the names of family members who sign in and the phone numbers of those who sign in by phone.
• Health: the names of allergens and restrictions, notes on an allergy, where epinephrine is kept, the allergy notes brought in from another app to confirm; the names and amounts of medication, who signed a medication authorization and, for medication given on symptoms, when to give it; the products, instructions and signer of an authorization for sunscreen or a similar product; dose amounts and observations, the reasons a dose was recorded late, and the medications on site noted in a home visit checklist.
• Incidents: what happened, the action taken, witnesses, who notified the parent, the follow-up notes and corrective actions, and the accident report copies shared with family members.
• Families: the authorizations shared with family members and the names and statements they sign with; the name of who gave a written consent and its note; families' requests to change a child's lists and the organization's answers; the subjects and texts of messages with families; the notes on photos shared with families.
• Staff and homes: the subjects and texts of messages to staff, the addresses of homes, the names of the people in a provider's household, the notes of the measures in place while a household member's check is applied for, and the notes made before placing a child in a home.

Some other notes are not encrypted (for example a note on a playground or water-flushing check, or the reason given for a correction), nor are the facts around encrypted ones (whether an allergy is anaphylactic, the times of doses, an absence's reason); all of these are read only through the application's own checks. Passwords must be at least twelve characters and are checked against lists of leaked passwords. A person can also sign in with a passkey, whose fingerprint, face or PIN never leaves their device; the sign-in service keeps only the passkey's public key and what signing in with it needs, its name, and when it was added and last used. Owners and administrators of the whole organization use a second sign-in step (KeepCount asks for it from 14 days after their first sign-in), other administrators can be required to by their organization, and KeepCount support always uses one; sign-in attempts are rate-limited. Uploaded files, photos included, are private: only the people allowed to see a file can get a link to it, and KeepCount's screens make links that expire after ten minutes (a link cannot be cancelled once made, and someone allowed to see a file could make a longer-lasting one by going around KeepCount's screens); the one exception is organizations' logos, which are public. The database is backed up daily by the database provider, and KeepCount keeps its own encrypted copy of the database and uploaded files in Canada, in a separate account that only KeepCount can sign in to. An export an administrator downloads is under the organization's control and safeguards from then on. No system is perfectly secure; if something goes wrong, see "If there is a breach".

How long information is kept

The deletions in this table are made by scheduled jobs. The deletions of children's records, people's files and logins, the private details kept in the activity log and in sign-ins, and organizations wait the first time until KeepCount support has reviewed a trial run and confirmed it; until then those records are kept past their period. The other deletions in this table run on their schedule. An organization one of whose people also owns or administers another organization with the same sign-in is kept past its deletion date until that is resolved; KeepCount support sees how many are kept.

Your browser

KeepCount uses your browser's storage to keep you signed in. On the room tablet, or any other device the daily records are made on, it holds them until they can be sent (head counts and checks with their notes, sleep checks, what was done about a check's issue, attendance, which can include the name of the person a child was released to and how a parent approved someone not on the pick-up list, a parent's word at drop-off of who picks the child up, with that person's name, who said so and the note; outdoor times with their reason and note, notes of play materials, illness counts, roll-calls with whether each was a drill or an evacuation, when each started and finished, the counts of children and adults and which children were not yet found, kept as a code and never a name; catered food's temperatures with the caterer, a note and the reason for a correction; when a room tablet was handed back; staff clock-ins and outs (when, in or out, the room or kind of time, and who the screen showed); and medication doses; never a dose's observations, or a sleep check's note or what was seen); records waiting to be sent stay on the device after signing out, and are sent the next time the same person signs in on it. If KeepCount refuses a record, the device keeps a short list of what was not saved (what each record was, when and why, which can name a person), at most 50, until the person dismisses each one, after signing out too. A home visit typed in Log a visit and not yet saved is kept on that device as a draft (with the household members present and what was found, with the date to put it right; never a child or the medications on site) until it is saved or discarded; a draft older than seven days is discarded the next time Log a visit is opened on that device. To give a record kept offline the time it was made, the browser also keeps the last reading of KeepCount's clock and how far the device's own clock has moved since (numbers only, nothing about a person or a child), until the next reading replaces them; an earlier reading stays only while a record made under it waits to be sent, and the readings leave the device when you sign out with nothing waiting to be sent. The browser also keeps whether you asked for notifications on the To do strip; which person an administrator previews the staff pages as, until the tab is closed; which site or office you chose to work in, and which organization you opened last; that you chose an organization for this sign-in, until you sign out; which organization another tab of the same browser just opened; which columns you chose to show in a list; the name matches you make in the attendance import, each name kept only as a code with the child it matches; your ticks on the checklists in Learn; whether the tour was offered; and whether the page was just reloaded after an update. Unless this paragraph says otherwise, these stay until the browser's storage for KeepCount is cleared. So that KeepCount opens without a connection, the browser keeps a small KeepCount script (a service worker, which also shows alerts if you switch them on) and a copy of the app's own files, and the browser of each device you sign in on also keeps your name, email, role, sites and rooms, your preferences, the organization's name, plan state and settings, and the site's rooms and ratio rules; never a child's name, health information or any other record. Signing out removes them (the app's own files stay) and switches alerts off for that device. KeepCount itself sets no cookies: what it keeps in the browser is what this paragraph lists. Cloudflare, which delivers the site and runs the Turnstile check on the public forms, may set a cookie it needs to tell people from automated traffic; YouTube's player, once a page with a video opens or a video is played, may store information on the device under Google's terms; and pages of other services that KeepCount opens keep their own under their terms. KeepCount has no advertising or tracking cookies, so there is no cookie banner. For a family member, the browser keeps the sign-in, the language chosen for the family pages until the tab is closed, and, if they switch alerts on, the KeepCount script and the app's own files; nothing about a child is kept on the device. Photos shared with families are never kept on a device to be shared later: without a connection, KeepCount's screens do not start sharing one, and a family's Photos page opens photos only while connected (photos already on the screen stay until the page is closed). Sign out of a shared device when you finish.

Children

KeepCount is used by organizations and the people they authorize, including, where an organization uses Families, the parents and guardians it adds; it is not meant for the children in their care. Some staff, students and volunteers may be under 18; they use KeepCount only as their organization authorizes. Children's information is entered by the organization's staff on the organization's behalf and shown to the fewest people who need it, as "Who can see the information" describes. Nothing about a child is used for advertising, marketing or any purpose of KeepCount's own.

Your rights and choices

• Ask your organization to see or correct your records; administrators can export your record. You can change your own contact details and password under My details (My account for owners, administrators, supervisors and office staff, who also change their sign-in email there; an administrator corrects their phone number or address).
• A parent or guardian who signs in: ask the organization to see or correct your child's records or yours, or to end your access.
• Write to the Privacy Officer about information KeepCount holds for its own business, or if your organization cannot help. We answer within 30 days, and tell you if we need more time, as the law allows.
• Close your own account, as Deleting your account says.
• Unsubscribe from reminders or updates with the link in any of those emails.
• Complaints: write to the Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, for a child care program operated by a municipality, to the Information and Privacy Commissioner of Ontario (ipc.on.ca).

Deleting your account

You can delete your KeepCount account under My details (or My account, for owners, administrators, supervisors and office staff), Delete my account. A family member who signs in through Families closes their own account under My account, Close my account: at once their access to every child ends, the login is closed, the phone number they sign in with is deleted and their devices stop receiving notifications; their name stays with the children's records for the organization's period (three years after a child leaves, O. Reg. 137/15 s. 72(5), or longer) and their messages for the retention period after each conversation's last message, and hello@keepcount.ca removes the login's email address on request. If you cannot sign in, write to hello@keepcount.ca from the address you sign in with, with "Delete my account" in the subject; KeepCount Inc. closes the login, tells your organization, and answers within 30 days. At once, you are signed out everywhere and cannot sign in again, your phone number and home address are deleted, and your devices stop receiving notifications. The records your organization must keep still carry your name for their retention period (see "How long information is kept"), then are deleted automatically, with your login; the deletion screen shows the date.

If there is a breach

If a breach of security safeguards involving an organization's records happens at KeepCount or at one of its providers, KeepCount tells the organization without undue delay, and within 72 hours after KeepCount determines that a breach has occurred, with what it knows then: what happened, what information and which people are affected, what we have done and what the organization can do, and helps it notify the people affected as the law requires. For information KeepCount holds for its own business, KeepCount reports to the Privacy Commissioner of Canada and notifies the people affected where a breach creates a real risk of significant harm. We keep a record of every breach for at least 24 months.

The public website

The screens shown on keepcount.ca are drawn from a fictional demonstration centre. No real child's or employee's information appears on the public site.

keepcount.ca's public pages, never the app's signed-in pages, may count visits with Cloudflare Web Analytics: which page was opened, the page that led to it, the browser, device and country, and how quickly the page loaded. Its script keeps nothing in your browser (no cookies or other storage). Cloudflare says it does not use your IP address or browser details to follow visitors over time, and that it drops your IP address at its nearest data centre rather than keeping it with the counts.

The waiting-list pages (/apply) run Cloudflare's Turnstile check and are never counted by the web analytics.

Changes to this notice

When we change this notice we change the date at the top. If a change affects how information already collected is used, we email the administrators of every organization at least 15 days before it takes effect. Earlier versions are available on request.