PRIVACY POLICY

The privacy policy of CLINIQUE MÉDICALE L’ACTUEL (“l’Actuel” or “we”) is based on regulations set out in the Act respecting the protection of personal information in the private sector and the Act respecting health and social services information, which together impose specific rules on private companies and healthcare and social-services organizations regarding the protection of personal information with the aim of avoiding confidentiality incidents that may invade people’s privacy (collectively, the “Act”).

Respect for your private life and the protection of your personal information are important to us; we are therefore committed to protecting it and using it according to best practice.

SCOPE OF THE POLICY

When you browse the l’Actuel website or when you use one of the products or services offered by l’Actuel or supply us with personal information after you have had the opportunity to consult this privacy policy (the “Policy”), then this Policy applies to you, meaning that you accept its terms and conditions.

The website comprises the site managed by l’Actuel and any mobile application made available to its patients, as well as any official social media account of l’Actuel’s (collectively, the “Website” ). L’Actuel’s products and services comprise all activities offered and managed by l’Actuel, including medical services, laboratory services and research activities, along with any related services, including treatment programs and psychosocial services (collectively, the  “Services”).

This Policy does not apply to the websites, pages or applications of third parties that can be accessed by means of our own website, and we are not responsible for such third-party sites. If you follow those links, we recommend that you examine the policies regarding the protection of personal information on those third-party sites before submitting any such information.

POLICY OBJECTIVES

The goal of the Policy is to apprise you of why and how l’Actuel, or any person acting on its behalf, will be collecting and processing your personal information, and of the rights available to you. It is written in simple, clear terms to ensure that users can give an informed consent.

POLICY CONTENT

1.      DEFINITIONS

In the Policy :

• “confidentiality incident” means access to information or any other use or communication of information not authorized by law; the loss of information or any other breach of its protection;
• “service provider” means a natural person who offers health services or social services within a health and social services body or who provides such a person with technical or administrative support services.
• “personal information” means any information which relates to a natural person and directly or indirectly allows that person to be identified;
• “health and social services information” means any information that allows a person to be identified, even indirectly, and that has any of following characteristics:
  • it concerns the person’s state of physical or mental health and his or her health determinants, including the person’s medical or family history;
  • it concerns any material taken from the person, including biological material, collected in the context of an assessment or treatment, or any implants, ortheses, prostheses or other aids that compensate for a disability of the person;
  • it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or groups that provided them;
  • it was obtained in the exercise of a function under the Public Health Act;
  • any other characteristic determined by government regulation.

Also considered to be health information is a personal piece of information such as the person’s name, date of birth or a health insurance number when it is combined with other health information or when it is collected for registration, enrolment or admission of the person concerned at, in or to an institution or for the taking in charge of the person concerned by another health and social services body.

2.      RESPONSIBILITIES RELATIVE TO THE PROTECTION OF PERSONAL INFORMATION (INCLUDING HEALTH AND SOCIAL SERVICES INFORMATION)

L’Actuel is responsible for protecting the personal information in its possession, and has designated the person below to ensure that protection. All requests for information pertaining to your personal data are to be addressed to him:

• Frédéric Sintrat, person in charge of the protection of personal information:
  frederic.sintrat@lactuel.ca
  1130-1001 Boulevard de Maisonneuve East, Montreal, Quebec H2L 4P9

The responsibility for ensuring the protection of personal information falls to the person named above, even though other people working at l’Actuel may be charged with collecting and processing personal information. This is why l’Actuel has adopted a training and awareness policy with regard to privacy. That policy is aimed at providing staff members with knowledge appropriate to their duties, as well as to risks associated with processing the personal information to which they have access.

The people working at l’Actuel who may collect and process personal information, and do so strictly within the exercise of their duties, are the following:

• reception staff (reception and telephone);
• people in the administration department;
• people from the human resources and finances department (for staff members);
• people from the IT department;
• people from the research department (academic, clinical and databank);
• people in charge of supplying the Services (doctors and other healthcare professionals, social workers, nursing staff and laboratory staff).

3.      COLLECTION OF PERSONAL INFORMATION

We collect your personal information so that we are able to provide you the Services or are able to hire you. It will be honestly and lawfully collected. In this respect, we will make sure to explain to you, in simple and clear terms before or at the time of collection, what purpose the collected information is to be used for. It is your right to have information about you deleted if it has been collected unlawfully.

Specifying the purposes of collection before or when that takes place allows us to determine what information we will need to achieve those objectives. We collect only the personal information needed for determined purposes, and it will be kept as long as it is needed to achieve those purposes.

The purposes for which l’Actuel may collect your personal information comprise:

• validating your identity and eligibility for the Services;
• setting up and administering your medical or employee file;
• supplying, maintaining and improving the Services;
• giving you access to l’Actuel’s patient portal;
• planning and confirming your appointments;
• responding to your questions and requests;
• enabling us to carry out internal operations in connection with the Services;
• communicating with you (by telephone, by mail or by email);
• sending you general information regarding the Services;
• personalizing the Services;
• processing transactions related to services not covered (transport costs for samples) and those offered by professionals working outside the health insurance system;
• employing and remunerating you;
• generating data for research and statistics purposes;
• conducting surveys and collecting feedback;
• keeping you informed about our partners’ products and services;
• meeting legal requirements and ensuring that our rights are respected.

Before personal information is used for a purpose not previously specified, the new purpose will be identified. Unless the new purpose for which the personal information is intended is provided for in the Act, we commit ourselves to obtaining your consent before using it for these new purposes.

L’Actuel can collect your personal information:

• from you directly;
• from a family doctor access desk;
• from the front-line access desk;
• from Dossier santé Québec (DSQ);
• from Dossier santé numérique (DSN);
• from the Régie de l’assurance maladie du Québec (RAMQ);
• from organizations in the health and social services sector;
• from institutions in the healthcare network.

L’Actuel may collect personal information about you without your consent if it is of serious and legitimate interest and if one or the other of the following conditions is met:

• the information is collected in your interest and cannot be collected from you personally in good time;
• collection from a third party is necessary to ensure the accuracy of the information.

The personal information concerning a minor under 14 years of age may not be collected from him without the consent of the person having parental authority or of the tutor, unless collecting the information is clearly for the minor’s benefit.

Personal information collected may include:

• first and last name;
• mailing address;
• email address;
• the information on your health insurance card or other form of identification;
• telephone number;
• age;
• date of birth;
• first and last names of your parents;
• sex;
• sexual orientation;
• follow-up summary at the clinic, including pharmacological profile;
• information concerning your social and family situation;
• data required to process payments (for example, credit card number and security code);
• information contained in your résumé, cover letter, and any other information you share with us when applying for a job;
• information required for payroll preparation, including social insurance number, financial institution and bank account number when you are hired;
• data on the multimedia content (video, audio, application, etc.) that you access through our website, our publications, our newsletter, etc.;
• location data (for example, it is possible to collect location data from a device’s IP address);
• other data supplied when you use our website, including data from analysis tools like Google Analytics or browser cookies;
• all the information you share when you interact with us, whether in person, by telephone, by email or any other way.

The methods used by l’Actuel to collect personal information may include:

• an online or paper form;
• entry of data by our staff (for example, when we set up your file or when you make an appointment with a healthcare professional);
• discussions with our medical team;
• data entry in our patient portal;
• written communications received by our staff;
• a mobile application offered to our patients;
• subscribe to our newsletter;
• certain cookies on our website.

Since no communications on social media are completely secure, we ask you not to transmit personal information in your message when you are communicating with us by that means.

When we collect personal information by means of technology having features that allow you to be identified, located or profiled, we will inform you beforehand of the use of such technology and the ways of activating those features. Profiling means the collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person’s work performance, economic situation, health, personal preferences, interests or behaviour.

4.      CONSENT OF THE PERSONS CONCERNED

We undertake to obtain your consent before collecting, using or communicating your personal information, except in situations where consent is not required under the terms of the Act.

For consent to be valid, the purposes for which the personal information will be used must be stated in such a way that you can reasonably understand how that information is to be used or communicated. You must be able to make an informed, enlightened decision, with full knowledge of the facts.

The consent of a minor under 14 years of age is given by the person having parental authority or by the tutor. The consent of a minor 14 years of age or over is given by the minor, by the person having parental authority or by the tutor.

The form of consent may vary according to the circumstances and nature of the information collected. In general, we seek to obtain explicit consent whenever sensitive personal information is concerned (for example, health and social services information). Implicit consent is generally considered sufficient when the personal information is less sensitive.

The means used by l’Actuel to obtain your consent may include:

• an online or paper form;
• orally when the personal information is collected in person or by telephone;
• a box allowing you to accept or refuse consent;
• a window allowing you to set cookies.

Generally, we obtain your consent before collecting your personal information or when that collection is being done. In certain cases, consent can be obtained after collection, but before the information is used (for example , when we wish to use personal information for purposes not previously specified).

Your consent is valid only as long as it takes to achieve the purposes for which it was requested.

You may withdraw your consent at any time, subject to legal or contractual restrictions. However, withdrawal of your consent could mean that we will no longer be in a position to provide you with certain Services or to keep you in our employ. We will inform you of the potential consequences and the risks associated with such a withdrawal. Nevertheless, your right to receive healthcare services and social services will not be compromised by your decision not to consent to the use and communication of health information or by your wish to restrict or refuse access to it.

In the case of a request to revoke consent, unless the Act does not permit it, we will delete the information concerned by the revocation within 30 days.

5.      PRIVACY OF PERSONAL INFORMATION

As part of our activities, health care and social-services personnel and professionals, including students and interns, working at l’Actuel may have access to your personal information if it is necessary in performing their duties – for which reason we make them aware of the importance of protecting the confidentiality of any information they use.

We will not disclose your personal information to a third party, unless you consent to it or if that disclosure is provided for by the Act.

However, when required to provide you with the Services or to hire you, we can communicate your personal information to service providers and representatives, who we insist comply with the same obligations regarding the protection of personal information that we do. They collaborate with l’Actuel to supply:

• technological solutions (data center, data storage and backup, hosting services, maintenance and support services, medical billing);
• professional services (tax, accounting, legal, corporate);
• financial services and banking operations;
• insurance services.

In the event that the transfer of personal information outside Quebec proves to be necessary – for example, in the cloud – or if the communication is included in an information technology project, we will undertake a privacy impact assessment taking into account the sensitivity of the information, its use, the safeguards the information would benefit from and the principles of privacy protection applicable in the State where this information would be communicated.

We may communicate personal information with a view to protecting a person or a group of people when there is reasonable cause to believe that that person or that group is threatened by a serious risk of death or critical injury, connected in particular with a disappearance or an act of violence, including a suicide attempt, and when the nature of the threat creates a sense of urgency. The information may in that case be communicated to the person or people exposed to that risk, to their representative or to any person who can help them. Only the information necessary for the purposes of the communication will be transmitted.

We may also communicate personal information to the Director of Criminal and Penal Prosecutions or to a person or body responsible, by law, for preventing, detecting or suppressing crime or violations of the law when the information is necessary for a prosecution concerning an offense under a law in Quebec.

We may also communicate personal information to a police force when it is necessary for the planning or execution of an intervention adapted to the characteristics of a person or the situation, in one or another of the following cases:

• the police force intervenes, at our request, to bring us help or support in the context of the services that we provide to a person;
• we act in concert or in partnership with the police force in the framework of mixed psychosocial and police intervention practice.

6.      COMMUNICATION OF HEALTH INFORMATION

We can share a piece of health information, without consent, with the following people:

• the person concerned by the information or a related person following an accepted access request;
• a service provider when it is required by the healthcare services or social services offered by that person;
• a researcher following obtention of an access authorization for research purposes;
• any person or group when a piece of information is necessary for the application of a law in Quebec;
• a person to whom l’Actuel entrusts a mandate or service contract when the information is necessary to the fulfilment of that mandate or the execution of that contract;
• a healthcare organization, a public organization, a professional order or an organization of another government, when the sharing is authorized by the delegated manager of government digital data for the Ministère de la Santé et des Services sociaux.

7.      ACCURACY OF PERSONAL INFORMATION

We ensure that your personal information, which is used on a continuous basis, including the information that may be shared with third parties, is generally up to date and accurate at the moment it is used.

We do not systematically update your personal information unless that is necessary for achieving the purposes for which it was collected. How accurate and up-to-date your information is depends on the changes you inform us of, data entries in your account on our patient portal, and updates carried out during your use of the Services.

It is important for the personal information that we hold about you to be accurate and up-to-date. For that reason, we recommend that you keep us informed if your personal information should happen to change.

8.      SECURITY MEASURES

We take the security measures needed to ensure the protection of your personal information. The nature of those measures varies according to their sensitivity, purpose of use, quantity, distribution and medium.

L’Actuel’s protection methods comprise:

• physical means: locking of filing cabinets and control of access to places where the personal information is kept (offices and servers);
• governance measures: appointment of a person responsible for the protection of personal information, training staff members and the implementation of clear, effective policies;
• administrative measures: security of workstations and control of access to personal information through secure authorizations;
• technical measures: the use of strong logins and passwords, of data encryption and of a firewall.

Despite these measures, given the inherent risks in the use of computer systems we can nevertheless not ensure or guarantee the security and confidentiality of the information that you provide us.

In the event of a confidentiality incident, we will take prompt action to reduce the risk of harm to you. We will notify the Commission d’accès à l’information du Québec (Quebec Access to Information Commission) and the people concerned of any incident presenting a serious risk of harm.

However, a person whose personal information is affected by a confidentiality incident will not be notified if and as long as such notification is likely to impede an investigation by a person or organization mandated to prevent, detect or suppress crime or infringements of the law.

Be careful when you receive suspicious emails. Before opening an email from l’Actuel that seems suspicious, get in touch with us by some other means (by telephone, for example) to confirm the origin of the email in question. If you have reasons for believing that any information about you has been compromised, please communicate with us at one of the addresses indicated in article 2 of the Policy without delay.

9.      RIGHTS OF PERSONS CONCERNED

The Act gives you various rights with regard to your personal information. Those rights include the following:

• Access and rectification: You have the right to be informed of the existence, the use and the communication of your information, and to consult it. If the information is medically sensitive in nature, we can grant you access through a doctor to help you understand the information in question.
  
  

You can contest the accuracy and completeness of your information and have the appropriate corrections made. When you demonstrate that any information is inaccurate or incomplete, we will make the necessary modifications. Where applicable, the modified information will be communicated to third parties who have access to the information in question.

• Cessation of dissemination: You have the right to request the cessation of the dissemination of your personal information and that any link attached to your name providing access to that information by any technological means be de-indexed.
  
  
• Restriction or refusal of access: You have the right to request that a particular service provider or one belonging to a category of service providers not have access to one or more pieces of health information that you have identified, unless the restriction risks jeopardizing your life or your integrity and it is impossible to obtain your consent in good time to lift it. The right of restriction may also include access by a spouse, direct ascendant, direct descendant or a researcher.
  
  

The restriction has no time limit. It remains in force until you modify it or withdraw it.

• Consent withdrawal: You have the right to withdraw your consent to the communication or the use of the personal information that we hold about you. Nevertheless, certain health information cannot be withdrawn, as it is essential to providing care services.
  
  
• Portability: You have the right to request that your personal information be communicated to you or be transferred to another organization in a structured, commonly used technological format.

To exercise one of these rights, kindly communicate with us at one of the addresses indicated in article 2 of the Policy. Your request must be accompanied by a copy of valid photo identification with signature. If your request is being made on behalf of another person, the person must provide a consent form, a power of attorney or a mandate signed by that person.

We will respond to you in writing no later than 30 days following receipt of the request. You will be able to read it either on site during normal working hours or remotely, and to obtain a copy. Access to personal information is free. However, reasonable fees may be charged for the transcription, reproduction or transmission of such information.

When a request is refused, we provide an explanation for our refusal, indicating either the appropriate legislative provision or the reasons why. Those reasons may include the exorbitant cost of providing the information, the fact that the personal information contains details about other people, the existence of legal grounds, exclusive security or commercial reasons, and the fact that the information is protected by professional secrecy or in the course of legal proceedings. On request, a person may help you understand the refusal, for example by making him- or herself available for a face-to-face discussion.

In addition, we may temporarily refuse to allow you to consult your file if, in the opinion of a healthcare professional, this would likely cause serious harm to your health. In that case we will document the reasons that led to this decision, will determine, on the recommendation of the healthcare professional, just when that right can be exercised, and will notify you accordingly.

If you have made a request and are not satisfied with our decision, you can file a complaint with the Commission d’accès à l’information, which might be able to revise our decision.

10.   TRANSPARENCY

We are committed to transparency when it comes to our policies and practices regarding the management of the personal information in our possession. On request, you can obtain information respecting these policies and practices, and that information will be made available to you in an easily understandable form within 30 days of the request being received.

11.   POSSIBILITY OF FILING A COMPLAINT

We have set up a procedure for handling complaints about our management of personal information, as a means of taking action. The process is simple, and complaints are dealt with confidentially.

All complains will be investigated. If a complaint is deemed to be well-founded, we will take the appropriate measures, including modification of our policies and practices as required.

You can make a complaint regarding our compliance with this Policy or the way we have handled your personal information by communicating with the person responsible for ensuring that compliance:

• Frédéric Sintrat, person in charge of the protection of personal information:
  frederic.sintrat@lactuel.ca
  1130-1001 Boulevard de Maisonneuve East, Montreal, Quebec H2L 4P9

You can file a complaint with the Commission d’accès à l’information if you believe that a violation of the Act has been committed by l’Actuel. To file a complaint with the Commission, please use the form accessible on its website at the following address: https://www.cai.gouv.qc.ca/commission-acces-information/formulaires-lettres-types?pour-les-citoyens/.