Privacy Policy

Policy Date: August 2024
CloudMD Software and Services Inc. (“CloudMD”, “we”, “us”, “our”) last updated this Privacy Policy (“Policy”) on August 29, 2024.

General Information

CloudMD Software & Services Inc. offers health and wellness services to individuals located in Canada through the provision of Occupational Health and its below mentioned subsidiaries.

Occupational Health and non- Occupational under this policy refer to the collective services provided by:

• Oncidium
• Benchmark (Benchmark Systems Inc.)
• D & D
• ATF Canada
• Wellpoint

Services include independent medical assessments and evaluations, disability (short term) management, case management, occupational injury reporting, occupational therapy services and other medical counselling services as agreed to between CloudMD Software & Services Inc., and your employer or insurance provider.”

We recognize the need for appropriate protections and management of your personal information and personal health information (“PI” as described below). This policy explains how we collect, use, and disclose your PI.

Application of Policy

This Policy describes CloudMD’s management of information, including the purposes for which we collect, use, and disclose Information and the safeguards we use to protect information during your use of Occupational Health, and the services we provide therein. When you provide us with your Personal Information, we agree to only use or disclose Personal Information as permitted by law or under the terms and conditions contained within this Policy.

What is “Personal Information (PI)”?

For purposes of this Privacy Policy and Notice, the term “Personal Information” means information about an identifiable individual that is provided to Occupational Health or collected by us, such as name, address, contact information, but may also include medical history, recent diagnosis, or other personal health information as defined by applicable privacy laws. For details on the Personal Information collected and how it is processed, see “What Personal Information Do We Collect” and “How is Personal Information Used” below.

Any data that has been collected in which personal identifiers have been removed, such that the information could not be reasonably used to identify the individual, is not considered Personal Information.

Consent and Authorization

Occupational Health will obtain the appropriate consent from individuals for the collection, use, or disclosure of their personal information, except where the law provides an exemption.

We may obtain express consent for the collection, use, or disclosure of personal information or we may determine that consent has been implied by the circumstances. Express consent is an affirmative authorization given by the individual to Occupational Health, either orally or in writing.  Implied consent is one in which Occupational Health has not received an affirmative authorization, but the circumstances make it reasonable to believe that an individual understands how Occupational Health will collect, use or disclose personal information and has given Occupational Health permission.

All consent is obtained fairly without deception. If personal information is needed for additional use, processing or disclosure beyond what is provided under this Policy, we will seek additional express consents.  Individuals may withdraw consent at anytime; in such circumstances the individual will be informed how withdrawal of consent may impact their uses, or if services cannot continue to be provided without consent for personal information processing. Withdrawal of consent is not retroactive and is subject to legal restrictions. In the event consent is withdrawn, Occupational Health may need to continue to retain the personal information in accordance with applicable laws and regulations, until such time it can be securely destroyed.

We will collect, use, and disclose your Personal Information without your consent only in limited circumstances and as permitted or required by applicable law or regulatory requirement. For example, Personal Information may be used or disclosed without consent for the purpose of acting in respect of an emergency that threatens the life, health, or security of an individual. In certain limited circumstances, we may be called upon to release your Personal Information in response to a court order, subpoena, search warrant, or applicable law or regulation. We will cooperate in responding to such requests, taking appropriate measures to ensure that the requester understands the sensitive nature of the Personal Information that they may receive, and that disclosure is necessary to comply with applicable law.

Your Rights Regarding Your Personal Information

Except in the limited circumstances established by law, individuals have a right to obtain access to their Personal Information. Individuals may also request us to correct their Personal Information where they believe it to be out of date or otherwise inaccurate. Requests for access or correction must be made in writing and should be addressed to our Privacy Officer (please see the contact details set forth below). We will assist you if you inform us that you need assistance in preparing a request concerning Personal Information. Administrative charges may apply.

What Personal Information Do We Collect?

Personal information we collect is limited to that which is necessary for the purposes Occupational Health has identified. Depending on the services provided, we may information such as:

• Profile Information: Name, Address(s), Telephone, Email, Date of Birth, Preferred language (or if interpretation is needed).
• Personal Health Information: symptoms and current issues, medical history, prescriptions and past treatments, answers to medical questionnaires as needed.
• Alternative contacts: if applicable, name and contact of legal representative/ guardian/ power of attorney, legal correspondence.
• Employment: if using program through employer, includes date of hire, employee identification number, company, information related to role and responsibilities. May include social insurance number, rate of pay and bank information, but only IF administering services related to payroll for employer/company.
• Insurance/ Referral Source: Claim and Policy Numbers, Policy Holder, Insurer, Referral Source, claim forms.

How Is the Personal Information Used?

We will use your Personal Information for the purposes for which it was collected as outlined above, and as required or permitted by applicable law. Specifically, we will use your Personal Information to:

1. To identify individual and contact as needed to schedule and provide services ;
2. To facilitate, schedule, conduct independent medical evaluations (IME)s, provide an opinion on benefit eligibility or accommodation, make proper decisions on file and expediate appointments with specialists;
3. To book services as needed to provide IMEs, including transportation, translation, and videoconference platforms if applicable;
4. To connects individuals to the corporate program that covers the services accessed;
5. To process License Appeal Tribunal (LAT) requests and other proceedings;
6. To process invoicing to customers and government billing portal for auto files (HCAI);
7. To composing legal correspondence if interacting with legal representatives.;
8. To verify requests for access, corrections and disclosures of information and confirm consent, whether requests come directly from you or your legal representatives.
9. As required by Occupational Health to maintain compliance with applicable legislations, regulations and licencing bodies.

What Personal Information Do We Share?

We may share your Personal Information with third parties as follows:

1. Health Professionals: your Personal Information may be shared with health professionals contracted by Occupational Health for the provision of IMEs.
2. Insurance Providers: in circumstances where you are engaging in our services as part of a claim or benefits provided by your insurance company, we may share your Personal Information with the insurance company as required by agreements with your provider.
3. Employees and Agents: we may provide your Personal Information to our employees, those of our affiliates and our respective agents and those third parties that require such information in order to help us provide services to our clients and administer our business. All employees sign confidentiality agreements and are subject to CloudMD’s privacy and security program requirements.
4. Service Providers: we may share your information with third-party service providers, including transportation services, interpretation, and online hosting/ information processing for provision of their services. We enter into confidentiality agreements with such providers which require them to use the Personal Information they receive only to perform services as directed by us.
5. Legal Disclosure: we may disclose your Personal Information if we are required or permitted by applicable law or legal process, which may include obligations to report suspected abuse or neglect, lawful access by foreign courts, law enforcement or other government.
6. With Consent: we may otherwise disclose your Personal Information when we have your prior consent to share the information. In such cases we will have written contracts in place with the third parties requiring them to comply with terms of confidentiality similar to the applicable terms of this Privacy Policy as well as all applicable statutes, regulations and laws pertaining to the protection of such Personal Information.
7. We may also use third parties to analyze aggregate data collected on the Platform for research purposes in accordance with applicable law. To the extent we allow a third-party service provider access to your Personal Information for the purposes outlined herein, they will only be permitted to collect it or use it for purposes consistent with this Privacy Policy, under the terms and conditions of a business associate agreement and applicable law.
8. In the event of a reorganization, merger, acquisition, asset sale or similar transaction, we may transfer all Personal Information we collect to the relevant third party involved in the transaction, with your consent, if and as required under applicable privacy laws.

Other Information / Logging

If you use virtual tools and platforms as part of our services, we may collect and use information about how you interact with the tool/platform, including Internet Protocol addresses, Internet domain names, operating system used to access, and the time spent on each page and the time and date of each visit. This information is used for auditing and tracking purposes, for security of our information systems, to improve content and to create a better experience for users of the Platform.

De-Identification

We may remove identifiers from your Personal Information and maintain, use, and disclose it in a de- identified form and combine it with other information to generate aggregated information. Such de- identified information will be owned by us, and we shall have unrestricted title, rights, and interest to it which may include, without limitation, the right to use, disclose, rent, or sell the de-identified information.

Retention

We will retain your Personal Information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws or regulatory college retention requirements), resolve disputes and enforce our legal agreements and policies.

Data Residency

Your information, including your Personal Information, is processed, and stored at our data centres in Canada.

Verification

We will engage in periodic assessments to verify that our privacy practices continue to comply with this Privacy Policy.

Updates to This Privacy Policy

To ensure that this Privacy Policy is kept up to date, we may change this Privacy Policy from time to time. Notice of changes to the Privacy Policy will be posted on the Site and will be effective thirty (30) days.

BY ENGAGING IN OUR SERVICES, YOU SIGNIFY YOUR ACCEPTANCE OF THE TERMS OF THIS PRIVACY POLICY.

If you have any questions about this Privacy Policy or the handling of your Personal Information, please contact our Privacy Office, and privacy@cloudmd.ca

*All information available in accessible formats upon request.