Privacy Policy

Hinotori Consulting Solutions Inc. is incorporated under the laws of Canada and operates the PREP Institute platform ("Platform") at prepinstitute.ca. The Platform delivers online workforce training and professional development programs across healthcare, trades, language and test preparation, and workplace compliance sectors.

For privacy-related questions, Hinotori Consulting Solutions Inc. acts as the data controller responsible for personal information collected through the Platform.

We collect information you provide directly, information collected automatically, and information from third parties:

We use personal information to:

• Create and manage your account and authenticate your identity
• Process enrolment, track program progress, and issue completion records
• Review and process compliance documents required for program participation
• Process payments and send receipts, invoices, or refund notifications
• Connect students with academic coaches and recruiters on the Platform
• Communicate with you about your account, programmes, and Platform updates
• Provide customer support and respond to enquiries
• Send promotional communications where you have given consent (you may opt out at any time)
• Analyse usage to improve Platform features and content
• Comply with legal obligations and enforce our Terms of Use
• Detect, investigate, and prevent fraud, abuse, or security incidents

Where applicable under Canadian privacy legislation (PIPEDA and provincial equivalents), we rely on the following bases to process personal information:

• Consent — for account creation, marketing communications, and optional profile data
• Contract performance — to provide the services you have enrolled in
• Legitimate interests — for security monitoring, fraud prevention, and Platform analytics
• Legal obligation — to comply with applicable laws and regulations

We do not sell personal information. We may share it in the following circumstances:

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law. Specifically:

• Active accounts: retained for the duration of the account relationship
• Closed accounts: most personal data is deleted or anonymised within 24 months of closure; financial records may be retained for up to 7 years for tax and audit purposes
• Compliance documents: retained for the minimum period required by applicable regulatory requirements, then securely deleted
• Server logs: typically retained for up to 12 months

You may request earlier deletion of your personal information subject to our legal retention obligations (see Section 7).

Under PIPEDA and applicable provincial legislation, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Withdrawal of consent — withdraw consent for non-essential processing at any time (this does not affect the lawfulness of processing before withdrawal)
• Deletion — request deletion of your personal information, subject to our legal obligations
• Portability — receive your data in a structured, commonly used format where technically feasible
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe your rights have been violated

To exercise any of these rights, contact us at prepadmin@hinotori.ca. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

The Platform uses cookies and similar technologies for authentication session management, security, and aggregated usage analytics. We do not use third-party advertising cookies.

Most browsers allow you to control cookies through their settings. Disabling session cookies will prevent you from signing in to the Platform.

We implement industry-standard technical and organizational measures to protect personal information against unauthorised access, loss, or alteration, including:

• Encryption in transit (TLS 1.2+) and at rest for sensitive data
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Regular security assessments and vulnerability monitoring
• Secure, audited third-party cloud infrastructure (Google Cloud Platform)

No method of transmission over the Internet is 100% secure. We will notify affected users and relevant authorities of any breach as required by applicable law.

The Platform integrates the following key third-party services, each governed by their own privacy policies:

• Clerk (clerk.com) — identity and authentication management
• Stripe (stripe.com) — payment processing; Stripe is PCI DSS certified
• Google Cloud Platform (cloud.google.com) — cloud infrastructure, application hosting, and secure document/object storage. We use Google Cloud because it provides enterprise-grade security certifications (ISO 27001, SOC 2), Canadian-region data residency options, and the reliability required for a regulated training environment.
• Microsoft 365 (microsoft.com) — staff productivity, internal communications, and document collaboration. Certain correspondence or records related to your enrolment may be processed within the Microsoft 365 environment, which is governed by Microsoft's Data Protection Agreement and complies with Canadian privacy requirements.
• D2L Brightspace (d2l.com) — learning management system (LMS) used to deliver course content, track program progress, and facilitate assessments. D2L is a Canadian company headquartered in Kitchener, Ontario, and stores learner data in accordance with Canadian privacy law (PIPEDA). Your enrolment status, course activity, and completion records may be shared with D2L to operate your learning environment.

We are not responsible for the privacy practices of third-party websites linked from the Platform, including partner institution websites. Please review their policies before submitting personal data.

The Platform is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16 without verifiable parental consent. If you believe a minor has provided us with personal information, please contact us immediately at prepadmin@hinotori.ca and we will take steps to delete it.

Hinotori Consulting Solutions Inc. is based in Canada (Calgary, Alberta, Canada). Personal information is primarily stored and processed in Canada. Where data is transferred to service providers located outside Canada (such as the United States), we ensure appropriate safeguards are in place consistent with Canadian privacy law, including contractual data protection clauses.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy on this page with an updated effective date. For material changes, we will provide additional notice via email or an in-platform notification at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised Policy.

For privacy-related questions, access requests, or complaints, please contact our Privacy Officer at:

If you are not satisfied with our response, you may escalate to the Office of the Privacy Commissioner of Canada.