External Privacy Policy
Purpose
The Clinic Network. and its subsidiaries (collectively, The Clinic Network) are committed to maintaining the privacy and confidentiality of all personal information that we collect, store, use and disclose. We are bound by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) as well as applicable provincial privacy regulations, in the jurisdictions that we operate in.
This Privacy Policy explains how The Clinic Network collects, stores, uses, shares, and safeguards your personal information. Personal information includes information that may identify you as an individual. By accessing The Clinic Network’s services, you agree to the terms of this Privacy Policy. Depending upon the goods or services being provided, The Clinic Network may require additional consent(s), after you are provided the relevant information.
Every employee, consultant, service provider, vendor, student, volunteer, and partner associated with The Clinic Network must adhere to a policy of confidentiality with respect to personal information that may be obtained through the course of their involvement with The Clinic Network. This includes adherence to the terms of this Privacy Policy. This policy will be reviewed by the individual, when they first become involved with The Clinic Network and remains in effect, indefinitely.
Personal Information Collected by The Clinic Network
Information The Clinic Network requests from you:
If you access The Clinic Network’s medical cannabis services as a patient through The Clinic Network, in order to be assessed for medical cannabis and order medicinal cannabis from licensed producers/sellers, you will be asked for consent to provide The Clinic Network with personal information about yourself, such as: your first name, last name, address, phone number, email address, provincial health card number, other government issued identification and if required, insurance and payment information. We will also ask you to provide us with personal health information, such as: the name and location of your physician/nurse practitioner, pharmacy, supporting health records, your authorized daily amount of medicinal cannabis, diagnosis, the period of authorized use, the quantity and dosage form of medicinal cannabis you wish to purchase. We may also ask you to provide your medical cannabis order history from your licensed producer/seller, medication history and emergency contact information.
Your medical history, records, personal information, personal health information, payment information and insurance related information may also be required and collected in order to provide goods and/or services by The Clinic Network, or for research purposes.
In addition to this, calls may be recorded for quality assurance purposes. Voice consent may be offered to patients, which will be recorded and retained.
Information The Clinic Network obtains from healthcare providers and external parties:
You may be advised to seek health related services from The Clinic Network by a health care provider, such as: your family physician, specialist physician, medical clinic, pharmacy/pharmacist, or other health care professional. Your health care provider may share a copy of your relevant medical records and health related documentation with The Clinic Network, so we can provide you access to goods and/or services. Your licensed producer/seller may also provide us with your medical cannabis order details.
Information automatically gathered:
The Clinic Network uses cookies to automatically collect certain information, including personal information, when you visit our website. For example, The Clinic Network may collect, and store information related to your use of our website, including pages visited, duration at the site, the date and time of your visit. The information collected is used to help The Clinic Network provide a more relevant, efficient, and useful site experience for you. This information is also used to perform statistical analyses of user behavior and characteristics to measure interest in and use of the various areas of the site and The Clinic Network services offered.
Social Media:
If you choose to interact with The Clinic Network through social media and/or blogs regarding your use of medicinal cannabis, related experiences or goods or services received through any of The Clinic Network’s divisions, the information provided may be used and viewed by others. The Clinic Network is not responsible for the privacy or use of this information.
How We Use Your Information
The Clinic Network collects your personal information to provide goods and/or services to you. In addition to those uses mentioned previously, we collect personal information for the following reasons:
- to communicate with you;
- to communicate with external parties;
- to respond to your requests;
- to improve our website;
- to improve the services that we provide;
- to provide you with information and offers that we believe you may find useful, including marketing materials, product promotions, advertisements, coupons and other information on services and products offered by The Clinic Network or third parties;
- to create aggregated information that is no longer identifiable;
- to provide you with Health Canada regulatory information and updates;
- to better understand what products and services are important to you.
Consent
The Clinic Network will not collect, use, or disclose health information without a patient’s consent, or his or her substitute decision maker’s consent, or as required by law. Consent to the collection, use or disclosure of health information may be express or implied.
“Express Consent” means permission that we have specifically obtained from you.
“Implied Consent” means that we have concluded from your statements, actions, circumstances or pre-existing relationship with The Clinic Network, that you would agree to the collection, use or disclosure of your information, and we need not ask you for your express consent.
For most health care purposes, consent is implied as a result of consent to treatment. However, in some circumstances, express and sometimes written, consent may be required. If applicable, we will ask for your express consent before:
- disclosing your information to someone who is not a health information custodian (e.g. to an insurance company, employer, lawyer, etc.) or
- disclosing your information to a health information custodian for the purposes other than providing you with health care (e.g. a doctor working for an insurance company).
You may withdraw or limit your consent at any time, unless doing so prevents The Clinic Network from obtaining and storing the information we require from you, to be compliant with applicable regulations and/or professional standards. You can provide express (written) instruction, that specific information is only to be used or disclosed by certain individuals or for certain purposes.
We may collect, use, or disclose your information without your consent, in certain circumstances, if permitted under applicable regulations (e.g. providing health information to those in the circle of care).
You may opt out of receiving any promotional e-mails or newsletters by unsubscribing; by simply follow the unsubscribing instructions on the website or at the bottom of our emails.
The Clinic Network may also aggregate and anonymize information to generate data and reports concerning demographics, purchasing patterns, trends, and patient behavior.
Personal health information will not be used for any purpose other than providing care, without your express consent.
How We Share Your Information
The Clinic Network may share your personal information with the following parties for these purposes:
- Licensed Producers – The Clinic Network will communicate your personal information with Licensed Producers to facilitate your registration so they can fulfill your order.
- Health Care Practitioners – with your express consent when required, The Clinic Network may share your personal information with your health care practitioner in connection with your use of medicinal cannabis or for provision of goods and services through The Clinic Network’s other divisions. This includes medical cannabis order details obtained from your licensed producer/seller.
- Public Profiles. If you provide personal information to The Clinic Network Blog/through Social Media, this information will be publicly available and therefore may be seen by other users.
- Private, Provincial or Federal Government healthcare benefit plans for re-imbursement purposes if applicable.
- Provincial health departments for practitioner billing purposes.
Third party service providers
The Clinic Network may use third parties to provide technical support and perform tracking and reporting functions, conduct quality assurance testing, and provide other services in connection with its services. The Clinic Network may share your personal information with them so that they can perform the required services.
Third parties and client requests
Upon receipt of a written request by a client or patient to share personal information with a third party, The Clinic Network will provide the requested data.
Business Transfers
The Clinic Network reserves the right to disclose and/or transfer your personal information to a third party in the event of an actual or proposed sale, purchase, lease, amalgamation, merger, joint venture or other type of disposition or financing, to ensure a continuance of service.
Should another company acquire The Clinic Network or substantially all of its assets, The Clinic Network will ensure that the company will assume the rights and obligations with respect to that information as described in this Privacy Policy.
Investigations
The Clinic Network reserves the right to investigate abuses and enforce all/any aspects of the Privacy Policy. The Clinic Network may disclose your personal information to a third party as authorized by law, during an investigation.
How We Store Your Personal Information
The Clinic Network stores your personal information on webservers located in Canada.
How We Protect Your Personal Information
The Clinic Network is committed to protecting all information provided to us by patients by maintaining physical, technical, and procedural safeguards that are appropriate to the sensitivity of personal information. While The Clinic Network cannot guarantee absolute security, the Company has security protocols in place to protect patient information. Patient information is stored electronically in electronic medical record systems that have restricted access.
How You Correct Your Information
To correct any inaccuracies regarding your personal information, please contact The Clinic Network at info@theclinicnetwork.ca or call us at 1 (844) 262-0942 . Please note that before The Clinic Network can provide you with any information, we will require verification of your identity.
How Long We Keep Your Information
The Clinic Network retains your personal information for the period that you are accessing our services, however, we are required to retain personal health information/records in accordance with requirements of applicable provincial regulated health professional colleges. This information must be retained and be accessible for: resolving disputes, case reviews, preventing fraud, investigations/audits by regulators and continuity of care.
Disposal of Health Information
When personal health information is disposed of, The Clinic Network will take reasonable steps to ensure secure destruction. Where a third party is retained to dispose of personal health information, we will enter into a written agreement with the third party that sets out the requirements for secure disposal and require the third party to confirm in writing that secure disposal has occurred.
Breach of Security Safe-guards
A breach of security safeguards is defined in PIPEDA as: the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards that are referred to in clause 4.7 of Schedule 1 of PIPEDA, or from a failure to establish those safeguards.
Under PIPEDA it is an offence to knowingly contravene PIPEDA’s reporting, notification and record-keeping requirements relating to breaches of security safeguards and doing so could lead to fines.
Privacy Breach
If a patient’s health information has been stolen, lost or subject to unauthorized use, access, disclosure, copying or modifications, our first priority will be to identify and contain the breach, then to take steps to correct it and to prevent reoccurrence. We will also notify any patient whose health information may have been disclosed, lost, or shared in an unauthorized manner, at the first reasonable opportunity.
Reporting of Breaches to the Office of the Privacy Commissioner of Canada (OPC)
Privacy regulations require that we report any breach of security safeguards involving personal information under our control, if the breach of security safeguards creates a Real Risk of Significant Harm (RROSH) to an individual or group of individuals.
The obligation to report the breach rests with an organization in control of the personal information implicated in the breach. The term control is not defined in the Act and is used in a number of provisions and contexts, which can lead to some ambiguity as to its meaning.
Real Risk of Significant Harm
Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Factors that are relevant to
determining whether a breach of security safeguards creates a real risk of significant harm include the sensitivity of the personal information involved in the breach of security safeguards and the probability the personal information has been/is/will be misused and the number of individuals impacted.
Prevention of Future Breaches
Once the immediate steps are taken to mitigate the risks associated with the breach, organizations need to take the time to investigate the cause of the breach and consider whether to develop a prevention plan. The level of effort should reflect the significance of the breach and whether it was a systemic breach or an isolated instance. This plan may include the following:
- a security audit of both physical and technical security;
- a review of policies and procedures and any changes to reflect the lessons learned from the investigation and regularly after that (e.g., security policies and collection policies, etc.); and
- a review of employee training practices; and
- a review of service delivery partners (e.g., dealers, retailers, etc.).
External Links and Sites
Any external websites linked from the The Clinic Network website do not operate under this Privacy Policy. The Clinic Network strongly recommends that patients/clients examine the privacy policies of third-party websites regarding their procedures for collecting, storing, and using personal information.
Changes to Our Privacy Practices and This Privacy Policy
We reserve the right to change this privacy policy at any time and the current policy (as posted on our website) will govern. This privacy policy is not intended to, nor does it create any contractual or other relationship between you and us or provide or create any legal rights on behalf of any party (however, this privacy policy does not, and is not intended to, circumvent privacy legislation enacted by Federal or Provincial Legislatures).
Contact Us
If you have any questions regarding our use of your personal information, please contact The Clinic Network at info@theclinicnetwork.ca or call us at 1 (844) 262-0942. The Clinic Network reserves the right to not disclose information for legal, security, regulatory or intellectual property reasons.
The Clinic Network has a designated Privacy Compliance Officer who can be reached at: privacy@theclinicnetwork.ca
Use the below link to read the complete Personal Information Protection and Electronic Documents Act (PIPEDA). http://laws-lois.justice.gc.ca/eng/acts/P-8.6/
