Privacy Policy – Cyclone Santé Patient Portal

1. When does this Policy apply and what does it cover?

This Policy contains information about:

• how your personal information is processed when you access and use our Patient Portal or fill out forms through the Portal;
• the use of tracking technologies on the Portal, such as “cookies” (as defined below; click here to jump directly to the relevant section on cookies)

By “you”, we mean the individuals who have access to and use the Portal, namely:

• Physicians, medical doctors and other assessors with whom we have agreements;
• Our customers and their respective employees;
• Any other individual who is authorized to access and use the Portal.

If you are not authorized by us to access and use the Portal, you must not do so. If you do, we are not responsible for anything that may happen as a result of you providing your personal information.

This Policy does not apply to our general website nor to your interactions with us via social media, e-mail, or using our online contact form.

It also does not apply to any third-party websites, applications or other services that may be accessible through links available via the Portal. We are not responsible for their procedures and practices with respect to how they handle your personal information. They are responsible for providing you with their own privacy policies and we encourage you to review them before using these external services.

2. What do we mean by “personal information”?

In this Policy, “personal information” means any information that allows us to identify you directly or indirectly, including through “cookies” and other electronic data such as IP addresses. Some information may not be personal on its own but may become personal information if associated or combined with other information in such a way that allows us to identify an individual.

3. What types of personal information do we process and why?

Generally speaking, we collect your personal information in order to create your user account, allow you to access and use the Portal, and to generally administer the Portal, ultimately in order to provide our clients with our services.

Listed below are the categories and types of personal information that may be processed when you use the Portal, and the reasons for its processing.

Please note that if you provide Cyclone Santé with personal information concerning other individuals, you must first obtain those individuals' consent as required by applicable law.

Please also note that if you do not provide us with the information we require, you may not be able to access and use the Portal.

Applicable law may require that some technological functions of the Portal (such as non-essential cookies) be deactivated by default to the extent that they enable us to collect personal information to profile and/or geolocate individuals. In such cases, Cyclone Santé will ask for your opt-in consent before activating such functions, and you are free to revoke your consent at any time. This will however not affect the legality of the processing that occurred before your consent was withdrawn.

4. What about cookies and other tracking technologies?

In this Policy, when we refer to “cookies” we also include other similar technologies such as pixels, tags and beacons.

Cookies are small files used by web servers that are placed on your computer or other device when you visit a website in order to improve your online experience. For example, they can remember your language preferences so that you always see websites in your preferred language first, they can keep you signed in so that you don't have to re-enter your login information every time you visit a given website, and they can optimize the way a website's displays based on your specific device or browser type.

We and our partners use cookies to compile individual and aggregate data about site traffic and site interactions in order to continuously improve your experience with the Portal and its functionalities, to provide you with a personalized experience, and for statistics and predictive data analysis purposes.

Generally speaking, we use first-party, third-party, session and persistent cookies. The cookies set by us are called "first-party cookies" and the cookies set by our third-party partners and service providers are called "third-party cookies".

• Session cookies are temporary and are deleted instantly after closing a browser. Many session cookies are essential to make our Website work correctly, as they typically enable you to move around our Website and use its different features.
• Persistent cookies remain on your device for an extended period of time or until you manually delete them. Some persistent cookies have a predetermined "lifetime" during which they will remain on your device, while others can remain indefinitely. We use persistent cookies to help us remember some of your browsing preferences with respect to our Website so that you don't have to set the same parameters each time you visit our Website. This can be the case, for example, for your language preferences. If your preferred language is English, a persistent cookie can make it such that you always see the English version of our Website first. Persistent cookies can also help us recognize you when you view a resource belonging to us from another website or app (such as an advertisement) and help us record information about your web browsing habits during the lifetime of the persistent cookie.

Applicable law may require that some cookies be deactivated by default to the extent they enable the collection personal information to conduct profiling and/or geolocation. In such case, you will be asked for your opt-in consent before such functions can be activated.

Examples of the cookies we use are listed below:

For more information on cookies, you can refer to websites such as http://www.cookiecentral.com/ and https://www.allaboutcookies.org/.

To know how you can manage your cookies preferences on your web browser, please click here to jump to the section of this Policy that covers this topic.

5. To/With whom do we disclose or share your personal information, and why?

To be clear, we do not sell your personal information to data brokers. However, some of your personal information is shared with our service providers and other third parties that we use to provide the Portal, to conduct other activities such as marketing or auditing, or for other reasons as permitted or required by applicable law.

The following table provides more details.

In the case of a merger or acquisition, sale or corporate reorganization, bankruptcy filing, insolvency procedures or similar circumstances, your personal information may also be transferred or we may have to share some of your personal information to conclude, negotiate or discuss with third parties such potential transactions.

6. Where do we store your personal information and how long do we retain it?

The personal information collected through the Portal is stored in Canada on the servers of illuxi's third-party hosting service provider, Amazon Web Services, Inc.. Some of your personal information may also be stored and processed in other countries in which we engage service providers. Consequently, by using the Portal, you consent to the transfer of personal information to countries outside your country of residence which may have different data protection rules than in your country, such as the United States. While such information is outside of Canada, it is subject to the laws of the country in which it is held, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.

Cyclone Santé will retain your personal information for as long as necessary to provide its Services, or as required by applicable law, whichever is longer. If you would like more information about how long we retain your personal information, please contact us.

7. How do we keep your information secure?

Generally speaking, we have implemented various physical, administrative, organizational, technical and technological safeguards designed to protect the confidentiality and security of personal information under our control, taking into account the sensitivity, amount, distribution and format of such information. For example, we maintain an access management process and conduct security awareness training to make sure that our users are aware of safe practices with respect to managing information assets. Within our organization, we take steps designed to ensure that access to personal information occurs only on a "need-to-know" basis.

Illuxi has also implement security measures to protect the confidentiality and security of the personal information it processes through the Portal. For more information about their practices, please click here.

However, it is important to note that no method of transmission over the Internet, or method of electronic storage, is 100% secure, so you should always be cautious when sharing your personal information.

8. Do you have any rights regarding your personal information?

Yes, you do. In Canada, you generally have the right to access your personal information and to rectify it if inaccurate, in certain circumstances. On written request and subject to proof of identity, and if the law permits, you can request access the personal information that we hold about you and ask that any necessary corrections be made, where applicable, and as authorized or required by law. Conversely, to make sure that the personal information we hold about you is accurate and up to date, we kindly ask you to inform us of any change in your personal information so that we may update our records accordingly.

Also, when the information collected is based on your explicit consent, you have the right to withdraw your consent at any time by contacting us by email at expertises@cyclonesante.com, or by mail at:

Cyclone Santé Inc.
Attention : Privacy Officer
1470, rue Peel, Tour A, 8e étage
Montreal (Quebec) H3A 1T1
Canada

Please note that withdrawing your consent does not effect the legality of the processing which occurred before consent was withdrawn.

If you want to exercise your rights, please contact us using the contact information provided at the beginning of this Policy. We should respond to your request within 30 days. If we can't comply with your request, we will tell you why.

If you are located in Quebec, you can use the forms provided by Quebec's Commission d'accès à l'information to submit your request.

You also have the right to file a complaint if you're not satisfied with the way that we handled your request, or with our practices with respect to how we handle personal information. In Quebec, you can do so using the contact details provided on the Commission d'accès à l'information's website.

9. Can you manage your cookie preferences?

Yes, you can. However, some functionalities may require cookies in order to perform as expected, or for security purposes. You can control your cookie preferences through your browser.

Depending on the browser that you are using, different instructions are applicable. Click on your browser for more information:

• Google Chrome
  • You can also browse on Incognito Mode while using Chrome.
• Firefox
• Safari
• Microsoft Edge
• Opera

Google also offers the possibility of opting out of all behavioural and remarketing advertisings. Please visit the Google Privacy Center to learn how to do so.

10. Can we change this Policy?

We will update this Policy from time to time to reflect changes to our practices, technology, legal requirements and other factors. Please check the "Last Update" legend at the top of this page to see when this Policy was last updated.

Any changes made to this Policy are effective immediately upon publishing of the updated Policy posted on our Website, unless noted otherwise. Your use of our Services following these changes indicates your consent to the practices described in the updated version of this Policy.