Security Policy.

We hold health information, home addresses, custody arrangements, and photographs of children. That is a serious responsibility, and this page sets out what we actually do about it — both in the building and online.

Physical security at the centre

The door is locked. Entry during the day is controlled, and visitors do not walk into the rooms unaccompanied.

Sign in and out. Every child's arrival and departure is recorded, including who collected them.

Pickup verification. A child is released only to a parent, guardian, or a person on the authorised pickup list. If staff do not recognise the person collecting, the child stays with us until we have reached you. This occasionally causes a delay for a family, and we consider that an acceptable trade.

Restricted pickup list. Where a family has named someone who must not collect their child, that name is on the room's list and treated as confidential.

Paper files are locked. Registration files, medical information, and incident records are stored in locked cabinets in a staff-only area, not in the rooms.

Medication is secured. Stored in original labelled containers, accessible to staff and not to children, with administration logged each time.

Staff screening and training

• Every person working with children holds a current criminal record check with vulnerable sector clearance
• Educators hold recognised Alberta early childhood certification, and certification levels are verified
• First aid and CPR certification is kept current
• Staff receive training on privacy, confidentiality, and safeguarding, and are told plainly that discussing a child outside the centre is a dismissible matter
• Students, volunteers, and relief staff are screened and are never left alone with children

Access control on information

We work on the principle that a person should see only what their role requires.

• Educators see their own room's health, allergy, emergency contact, and pickup information
• Administrative staff see enquiries, registrations, and billing
• The staff portal requires a sign-in, and sessions expire
• Staff access is removed on their last day, not at some point afterwards

Website and portal security

Everything is served over HTTPS. Traffic between your browser and this site is encrypted in transit.

Security headers are set to reduce the risk of clickjacking, content-type confusion, and cross-site scripting.

Every form is validated on the server, not only in your browser, so a submission cannot bypass our checks by disabling JavaScript.

Rate limiting is applied to public forms to prevent abuse and automated submissions.

Spam traps are used instead of CAPTCHA, so you are not asked to identify traffic lights before you can ask about a daycare space.

The staff portal is not indexed by search engines and is protected at the routing level, so an unauthenticated request never reaches the page.

No card details are stored. We do not process payments through this website.

What we deliberately do not do

• We do not send children's personal or health information over unencrypted email or ordinary text message
• We do not use consumer messaging apps to share documents about children
• We do not store registration data with third-party marketing platforms
• We do not embed advertising or social media tracking scripts on this site
• We do not leave a signed-in device unattended in a public part of the centre

If something goes wrong

No system is perfect, so we plan for failure as well as prevention.

If we become aware of a breach affecting personal information, we will:

1. Contain it immediately and establish what was affected
2. Notify affected families directly, and tell you plainly what was involved
3. Notify the Office of the Information and Privacy Commissioner of Alberta where the breach presents a real risk of significant harm, as PIPA requires
4. Notify Alberta childcare licensing where children's records are involved
5. Tell you what we changed so it does not happen again

We will not minimise a breach or wait to see whether anyone notices.

Reporting a vulnerability

If you find a security problem with this website, please tell us rather than publishing it. Email idealdaycareedmonton@gmail.com with enough detail to reproduce the issue.

We ask that you do not access, modify, or delete data belonging to anyone else, and do not run tests that degrade the site for other people. We will acknowledge a genuine report, fix what needs fixing, and thank you properly.

Reporting a safeguarding concern

Concerns about a child's safety are urgent and are handled differently from anything else on this page. Speak to the centre director in person or on (780) 450-1568.

Where there is reason to believe a child may be in need of intervention, we are legally obliged to report it to Alberta Children's Services, and we will. That obligation overrides confidentiality, and it applies to every member of staff.

Emergency preparedness

We run and log monthly fire drills, and we maintain procedures for shelter in place, severe weather, a lost child, medical emergencies, power or heat loss, and an unauthorised person attempting to collect a child. Each of these is practised rather than merely written down.

Accurate emergency contact numbers are the weakest link in any of these plans. Please update us the day yours changes.

Contact

Security questions, vulnerability reports, or concerns about how information is handled: (780) 450-1568 or idealdaycareedmonton@gmail.com. See also our Privacy Policy and Terms of Service.