Privacy Policy

PRIVACY POLICY

Effective Date: August 27, 2026

1. INTRODUCTION

  • MoCA Test Inc., operating as MoCA Cognition (“MoCA Cognition,” “we,” “us,” or “our”), is a corporation incorporated under the laws of the Province of Quebec, with its registered office at 4896 Taschereau Blvd., Suite 230, Greenfield Park, Quebec J4V 2J2, Canada. We are committed to protecting the privacy of individuals who interact with us.
  • This Privacy Policy (“Policy”) describes how we collect, use, disclose, and safeguard personal information in connection with the Website and the professional and research Services described in our Terms of Use, including the MoCA Cognition website at mocacognition.com (the “Website”), the Montreal Cognitive Assessment (MoCA), the MoCA Duo application (“Duo”), MoCA Training and Certification, XpressO XR, the MoCA Data Platform, and related cognitive assessment services (collectively, the “Services”). Capitalized terms not defined in this Policy have the meaning given to them in the Terms of Use.
  • This Policy is intended to reflect applicable requirements under Canadian federal and provincial privacy law (including the Act respecting the protection of personal information in the private sector (Quebec) and PIPEDA), applicable U.S. state privacy laws, and the General Data Protection Regulation (“GDPR”) and UK GDPR, where applicable.
  • This Policy applies to Authorized Users (including healthcare professionals, researchers, academics, and other individuals who register for or access the Services) and to visitors of the Website. Where Duo or XpressO XR is used by an Authorized User’s organization in connection with a patient or research participant, Section 5 below and the applicable written agreement between MoCA Cognition and that organization govern the treatment of assessment-related information.

2. ROLES AND RESPONSIBILITIES

  • For information relating to Website visitors and Authorized User accounts (such as registration, licensing, Training and Certification, and support communications), MoCA Cognition acts as the controller (or, under applicable law, the “organization” responsible for that personal information).
  • For assessment- or study-related information processed through Duo or XpressO XR, the Authorized User’s organization determines the purposes and identifiers used for the assessment and is responsible, as between the parties, for compliance with privacy, health information, and research obligations applicable to it, including obtaining any consents required from patients or participants. MoCA Cognition processes this information to provide the Services and, where applicable, acts as a service provider or processor on the organization’s behalf, as further described in the applicable agreement.

3. INFORMATION WE COLLECT

  • 3.1 Information You Provide to Us
    • To register for full access to the Services, Authorized Users are required to provide certain information, including their name, email address, profession or professional title, and organizational affiliation. Depending on the Service, additional information may be requested. Where required information is not provided, full access to the Services may not be available.
    • Account and registration information, such as name, professional title or affiliation, email address, and credentials used to access the Services.
    • Information submitted in connection with Training and Certification, including enrollment, completion, and renewal records.
    • Billing information, such as institute or organizational name and billing address, and transaction details (such as the item purchased, price, and order date), collected when you purchase Training and Certification.
    • Licensing and permission inquiries submitted to us.
    • Information you provide when you contact support or otherwise communicate with us.
  • 3.2 Information Collected Automatically
    • When you visit the Website or use certain Services, we and our service providers may automatically collect technical information, such as IP address, browser and device type, operating system, referring pages, pages viewed, and timestamps, including through cookies and similar technologies described in Section 13.
  • 3.3 Assessment-Related Information (Duo and XpressO XR)
    • As described in Section 5, Duo and XpressO XR are designed to operate using unique identifiers (such as Participant IDs or Study IDs) rather than directly identifying information.
    • Through these Services, we process:
      • assessment responses and related timing or interaction metrics (“Test Response” data);
      • automatically generated cognitive performance scores and sub-scores; and
      • limited demographic fields (such as age, gender, or education level) where configured for a given implementation.
    • None of these, on their own, are intended to directly identify a patient or participant.

4. HOW WE USE INFORMATION

  • We use the information described above to:
    • provide, operate, maintain, and support the Services;
    • create and administer Authorized User accounts and process Training and Certification;
    • process purchases and payments for Training and Certification;
    • generate automated MoCA and XpressO XR scores and related assessment information;
    • respond to inquiries and provide customer and technical support;
    • maintain, secure, and improve the Services, including through de-identified or aggregate analysis, as further described in Section 5;
    • meet legal, regulatory, quality, and contractual obligations; and
    • communicate with you about the Services, including updates to this Policy or the Terms of Use.

4.1 MARKETING COMMUNICATIONS

  • When registering, Authorized Users may agree to receive updates from MoCA Cognition about the Services and related developments. You may withdraw this consent at any time by contacting us at the details in Section 16 or using the unsubscribe mechanism included in our communications.
  • Where we wish to contact you for a purpose beyond these general updates, we will seek your explicit consent for that purpose before proceeding.

5. ASSESSMENT DATA, DE-IDENTIFICATION, AND PROTECTED HEALTH INFORMATION

  • Duo and XpressO XR are designed to operate without directly identifying patient or participant information. Consistent with our Terms of Use, MoCA Cognition does not require or accept directly identifying Protected Health Information (“PHI”) through these Services, including through fields intended for Study IDs, Participant IDs, or other unique identifiers.
  • Organizations using Duo or XpressO XR are responsible for ensuring that the identifiers they use do not themselves contain directly identifying information, and for maintaining, separately from the Services and under their own control, any mapping between an identifier and the identity of a patient or participant.
  • Where permitted by applicable law and not restricted or excluded by an applicable written agreement, we may use de-identified or aggregate assessment information to validate and improve the Services and scoring methodologies, conduct quality assurance and analytics, and support research and product development.

6. NATURE OF THE ASSESSMENTS AND AUTOMATED PROCESSING

  • The Services, including the paper-based MoCA, Duo, and XpressO XR, do not, on their own, establish a diagnosis or identify a specific disease or condition. A diagnosis requires comprehensive clinical assessment by an appropriately qualified healthcare professional.
  • Duo generates an automated MoCA score based on assessment responses. The responsible healthcare professional reviews and interprets this score and may adjust it where appropriate; automated scoring supports, but does not replace, professional clinical judgment.
  • XpressO XR is a rapid, self-administered assessment tool that provides an automated indication of memory performance.
  • In all cases, clinical interpretation and any resulting decisions remain the responsibility of the qualified healthcare professional or researcher using the Service.
  • Where applicable law grants you rights concerning solely automated decision-making producing legal or similarly significant effects, please contact us using the details in Section 16 to discuss those rights; because assessment results are reviewed and applied by the responsible healthcare professional or researcher rather than by MoCA Cognition, such rights are generally more directly exercised with respect to that professional or the organization for which they act.

7. LEGAL BASES FOR PROCESSING (EEA/UK)

  • Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases:
    • Contract: processing necessary to provide the Services you or your organization have requested;
    • Consent: where you have provided consent to specific processing and consent is the appropriate legal basis;
    • Legitimate interests: for example, to secure, support, and improve the Services, including through de-identified analysis, provided such interests are not overridden by your interests or fundamental rights; and
    • Legal obligation: where processing is necessary to comply with applicable legal or regulatory requirements.

8. SHARING AND DISCLOSURE

  • We may disclose information described in this Policy:
    • to our affiliates and subsidiaries;
    • to service providers and contractors who support the Services (such as hosting, analytics, and support providers) and who are contractually required to protect the information and use it only as instructed;
    • to payment processors who process purchases of Training and Certification on our behalf and who are contractually required to protect the information and use it only as instructed;
    • to fulfill the purpose for which the information was provided, or with your consent;
    • in connection with a corporate reorganization, merger, acquisition, or sale of assets, consistent with the Terms of Use;
    • to comply with applicable law, regulation, court order, or a valid governmental or regulatory request; and
    • where we believe disclosure is necessary to protect the rights, property, safety, or assessment integrity of MoCA Cognition, Authorized Users, or others.
  • We do not sell personal information. We do not share personal information for advertising or marketing purposes unless you have provided specific, opt-in consent to that sharing. Where we wish to share your information with a third party for a purpose other than those described in this Section, we will seek your explicit consent before doing so.

9. DATA RESIDENCY AND INTERNATIONAL DATA TRANSFERS

  • Data residency: Personal information processed by MoCA Cognition under this Policy is hosted on servers located in Canada.
  • Authorized Users may access or export information (for example, as a CSV file) from other jurisdictions. In that case, the applicable organization is responsible for any resulting transfer and for the subsequent storage and processing of that information in accordance with the privacy and data protection obligations applicable to it.
  • Where MoCA Cognition transfers personal information internationally on behalf of an organization — for example, to support a specific deployment or integration — appropriate safeguards will be implemented as required by applicable law and the applicable agreement. Depending on the circumstances, this may include Standard Contractual Clauses or another recognized transfer mechanism, which may be incorporated into a data transfer agreement (“DTA”) entered into on request.
  • Billing and transaction information may be processed or stored by our payment processor outside Canada in connection with processing a purchase; such processing is governed by the payment processor’s own privacy practices.

10. DATA SECURITY

  • We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction, including encryption in transit, access controls, and secure storage practices. No system can be guaranteed completely secure, and we cannot warrant the absolute security of information transmitted to or through the Services.

10.1 INCIDENT AND BREACH NOTIFICATION

  • If we become aware of a confidentiality incident or personal data breach involving personal information for which we act as controller or organization, we will assess the risk presented and, where required by applicable law, notify the relevant supervisory authority (such as the applicable U.S. state authority, the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec, or the relevant EU/UK data protection authority) and affected individuals without undue delay, and maintain a record of the incident as required by applicable law.
  • Where an incident involves information for which an Authorized User’s organization is the controller — including assessment-related information processed through Duo or XpressO XR — we will notify that organization without undue delay so that it may fulfill its own notification obligations, in accordance with the applicable agreement.

11. DATA RETENTION

  • We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, meet legal, regulatory, accounting, or contractual requirements, and resolve disputes. When information is no longer needed for these purposes, we securely delete, de-identify, or anonymize it in accordance with applicable law. We may retain and use de-identified or anonymized data for legitimate business purposes, including research, analytics, and quality improvement, without further notice.
  • We retain billing and transaction records for as long as necessary to meet applicable accounting, tax, and audit requirements.
  • As noted in the Terms of Use, Duo will be discontinued effective December 1, 2026. Registered users are responsible for exporting any information they wish or are required to retain before that date.

12. YOUR PRIVACY RIGHTS

  • Subject to applicable law and any exemptions or limitations, you may have the right to:
    • access a copy of the personal information we hold about you;
    • request correction of inaccurate or incomplete information;
    • request deletion of your personal information;
    • request restriction of, or object to, certain processing;
    • request a portable copy of information you provided to us, where applicable; and
    • withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

12.1 UNITED STATES

  • If you are a resident of a U.S. state with a comprehensive privacy law, you may have the right to know, access, correct, or delete your personal information, and to opt out of certain processing (such as targeted advertising or profiling with legal or similarly significant effects), subject to that state’s requirements. We do not knowingly sell or share personal information as described in Section 8. We will not discriminate against you for exercising these rights.

12.2 CANADA, INCLUDING QUEBEC

  • If Quebec or other Canadian privacy law applies to you, you may exercise your rights, including the right to access and rectify your personal information, by contacting our privacy officer at the details in Section 16. You may also contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada, as applicable.

12.3 EUROPEAN ECONOMIC AREA AND UNITED KINGDOM

  • If the GDPR or UK GDPR applies to you, you also have the right to lodge a complaint with your local data protection supervisory authority.

12.4 PATIENTS AND RESEARCH PARTICIPANTS

  • If you completed an assessment through Duo or XpressO XR as a patient or research participant, your assessment is associated with a Study ID, Participant ID, or similar identifier rather than with directly identifying information held by MoCA Cognition, as described in Section 5.
  • If you, or the healthcare professional or organization that administered your assessment, provide us with the applicable identifier, we may be able to locate the corresponding record and facilitate the request — including a request for deletion — in accordance with our agreement with that organization and applicable law. Without that identifier, we are generally unable to locate or act on a request concerning a specific assessment, as MoCA Cognition does not hold information linking the identifier to your identity.
  • Please contact the healthcare professional or organization that administered your assessment in the first instance; they can either action your request directly or provide us with the identifier needed to do so.
  • To exercise any of the rights described in this Section, please contact us at [email protected]. We may need to verify your identity before responding and may decline requests as permitted by applicable law.

13. COOKIES AND SIMILAR TECHNOLOGIES

  • The Website uses cookies and similar technologies to operate, secure, and improve the Website, understand usage, and, where applicable, support analytics. You can control cookies through your browser settings; disabling certain cookies may affect Website functionality.

14. CHILDREN’S PRIVACY

  • The Website and Authorized User–facing features of the Services are not directed to individuals under 18 years of age, and we do not knowingly collect personal information from them through those features.
  • Use of Duo or XpressO XR by a minor patient or research participant, where clinically or scientifically appropriate, occurs under the direction and responsibility of the administering healthcare professional or researcher and the applicable organization, in accordance with their own consent and legal obligations.
  • If you believe we have inadvertently collected information directly from an individual under 18 through the Website or account features, please contact us at the details in Section 16.

15. CHANGES TO THIS POLICY

  • We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable legal or regulatory requirements. The “Effective Date” above reflects the most recent revision. Where required by applicable law, we will provide appropriate notice of material changes and obtain consent where required.

16. CONTACT US

If you have questions about this Policy or wish to exercise your privacy rights, please contact our privacy officer:

MoCA Cognition

4896 Taschereau Blvd., Suite 230

Greenfield Park, Quebec J4V 2J2

Canada

Email: [email protected]

General support: [email protected]