Privacy Policy - Medic Solutions

1. Introduction

At Médic A.S. Solutions Inc. (“Medic Solutions”), respect for your privacy is a priority. Medic Solutions has adopted this privacy and protection of personal information policy in order to provide clarity and information on the ways in which we collect, use, communicate, store and process users’ personal information in any manner as part of the conduct of our activities, including delivery of our products and services, notably in the field of group insurance (the “Services”) and including our website (the “Site”). For the purpose of this Privacy Policy, the word « Site » also include any application for smartphones, pads and other digital devices, that is operated by Medic Solutions.

Medic Solutions reserves the right to deny you the use of this Site where it has reason to believe that you do not comply with the following Privacy Policy.

2. Terms of that Privacy Policy

As a group insurance firm, we collect, use, disclose, store and process information, notably for the purposes of rendering our Services and to confirm your identity, create your profile, record your enrolment to a group insurance plan, manage that plan, perform transactions such as the treatment of claims, provide services, make reports, manage our relations with our employees and service providers, prevent fraud and fulfil legal or regulatory obligations.

Confidentiality is important to us and is at the heart of our client relationship. We use all information, especially personal information, in accordance with the highest ethical standards, and we comply with Quebec and Canadian laws on the protection of privacy.

By using the Site or our Services or by providing personal information (through this Site, by email, by mail, in person or during a virtual conference or pursuant to the conclusion of an employment or service agreement with Medic Solutions), you consent to terms and conditions set forth herein and to the collection, use, communication, conservation and processing of your personal information by Medic Solutions, its representatives and its service providers, in accordance with this policy.

This Privacy Policy does not apply to, and Medic Solutions is not responsible for, any third-party websites which may be accessible through links from this Site, such as, notably, the client portal provided by one of Medic Solutions’ supplier, Solutions Segic Inc. (“Segic”). If you follow a link to any of these third-party websites or use the client portal provided by Segic, they will have their own privacy policies and you will need to check these policies before submitting any personal information.

3. Our Objectives and the Type of Personal Information that we Collect

Medic Solutions is a group insurance firm that operates in the province of Quebec. We are responsible for the processing of your personal information that is disclosed to us.

We may collect and process different types of personal information in the course of operating our business and providing our services, including:

Contact information such as name, physical address, email address and telephone number;

Personal information defined as “sensitive” (the “sensitive information”) in the Act respecting the protection of personal information in the private sector (Québec), namely medical, biometric or other intimate information, or information which, due to the context of its use or communication, entails a high level of reasonable expectation of privacy, such as, without limitations:

Birth dates;

Social insurance numbers;

Medical information, among others on the health of our members and their beneficiaries or dependents;

Information on the health, dental, and pharmaceutical claims of our members and their beneficiaries or dependents;

Financial information, such as your salary and your benefits.

Special categories of personal information (such as racial or ethnic origin, trade-union membership, health, sexual orientation, etc.)

Biographical information such as job title, employer, photograph or video or audio content;

Billing and financial information such as billing address, bank account and payment information, information related to the production of tax forms or information related to payroll management;

Services information such as details of Services that we have rendered to you or details regarding the protections you selected;

Claim reports of members;

Recruitment information such as your curriculum vitae, your education and employment history, details of professional memberships and other information relevant to potential recruitment or association to or with Medic Solutions or a corporation related to Medic Solutions;

Professional information or information related to the contract for services of our services providers or to the employment of our employees (such as title and compensation history, schedule, benefit and leave information, information regarding any issues or disputes that may arise, performance reports and evaluations, psychometric test results, disciplinary records, date of termination of employment and the reasons for the termination of the employment, surveys and any information relevant to the protection of health and safety at work);

Information collected by Medic Solutions on the use of Internet, of its network, its devices and its premises by its employees and services providers and information related to their use of their professional email address. Medic Solutions may also collect images, videos and photos of its premises through closed circuit video cameras;

Marketing, communication preferences and related information, such as feedback and survey responses; and

Any other personal information provided.

We generally collect personal information that you voluntarily provide, but we may collect information from third parties and as agents on behalf of our members where we or they have obtained the required consent, or as otherwise permitted or required by law. We may also collect information through our Site, notably through the forms that you may fill out and provide us with.

We will obtain your consent prior to collecting, using or disclosing personal Information for any purpose, except where otherwise permitted or required by law. Consent may be provided orally or in writing. It may also be implied, such as where you continue to provide personal information to us in the context of our ongoing relationship or for the purpose of the performance of our Services, such as the information you provide us with for the purpose of assessing your admissibility to a group insurance plan or to handle your claims or those of your beneficiaries or dependents.

By providing us with personal information, you consent to our collection, use, disclosure, storage and processing of such personal information in accordance with this Privacy Policy and as permitted or required by law.

To the extent that you provide us with personal information of another individual (such as your beneficiaries or dependents), you represent that you duly notified them and that you have the necessary consent to this disclosure of personal information.

4. Minors Under 14 Years of Age

We do not voluntarily collect information from children or other persons who are under 14 years of age. If you are a minor under 14 years old, please do not provide us with any personal information without the express consent of a person having parental authority or a tutor.

If you provide us with personal information regarding one of your beneficiary or dependent who is a minor under 14 years of age, you must have parental authority over or be the tutor of that person. By providing such personal information, you consent to its collection, use, disclosure, storage and processing by Medic Solutions.

If you are a parent or tutor and you know that your children have provided us with personal information, please contact us.

If we learn that we have collected personal information from minor children under 14 years of age without the consent of a person having parental authority or a tutor (whether because it was provided by a person over 14 years of age not having parental authority over or being a tutor of that child and without the consent of such person having parental authority or being a tutor, or because it was provided directly by a minor under 14 years of age without the consent of a person having parental authority or being a tutor) we will take steps to delete that information from our servers.

5. Means of Collection of Personal Information

We collect your personal information from yourself and during interactions with you, as follows:

During the course of the performance of the Services;

When information is publicly available, notably on this Site, in public records or on social networks pages or accounts;

When using the client portal provided by Segic;

By mail, when you write to us or provide documentation;

By email, when you write to us or provide documentation or make claims;

Through the various forms that we provide (either in person, by email or through the Site), by example the Enrolment Form, the Modification of Coverage and Adding of a Dependent Form, the Change of Beneficiary Form, the Direct Deposit Form, etc.;

Through your employer or union;

When you contact Medic Solutions’ customer service;

When you file claims to your care provider;

When you register for newsletters or seminars provided by Medic Solutions;

Following a verbal or written request from Medic Solutions for the purpose of providing our Services.

6. Purposes for which your Personal Information is Collected

We may use personal information in one or the other of the following ways, either with your consent or, where applicable, according to another legal basis under the applicable laws. In each case, we identify the grounds that we rely on to use your personal information:

To provide our Services and to conduct our business, to administer and perform our Services, including to carry out our obligations arising from any agreements entered into between you and us;

To confirm your identity and create your profile;

To record your enrolment to a group insurance plan and to manage that plan;

For administrative purposes and for the management of insurance contracts;

To adjust the member’s prime, following the analysis of claim reports;

To perform transactions such as the treatment and the payment of claims;

To provide services and to fulfil the needs and preferences of our members and to answers the questions, comments and other demands for information from our members;

To respond to requests for information or enquiries from visitors of our Site or to persons to whom we render Services;

To facilitate the use of our Site and to ensure content is relevant and to ensure that content from our Site is presented in the most effective manner for you and for your device;

For marketing and business development purposes – to provide details of new Services, updates in group insurance matters and invitations to events where an individual has chosen to receive these;

For research and development purposes (including from a security perspective) – analysis in order to better understand our members’ services and marketing requirements and to better understand our business and develop our services and offerings; you may unsubscribe at any time;

For recruitment purposes – to enable us to process applications for employment and to assess and individual’s suitability for any position for which he/she may apply at Medic Solutions or a corporation related to Medic Solutions;

To manage relations with services providers and employees, including verifying the identity of people working for Medic Solutions, managing taxes and social security, planning schedules and monitoring attendance and hours worked, processing social benefits, managing payroll, allowances sick leaves and leaves, evaluate performance and handle requests from Medic Solutions’ employees or service providers in relation to their work or the provision of their services;

To fulfil our legal, regulatory, or risk management obligations – to comply with our legal obligations;

To fight against fraud and/or other relevant background checks, notably as may be required by applicable law and regulation and/or best practice at any given time (if false or inaccurate information is provided and fraud is identified or suspected, details may be passed to fraud prevention agencies and may be recorded by us or by them). Where we process special categories of personal information we may also rely on substantial public interest (prevention or detection of crime) or legal claims;

To enforce our legal rights, to comply with our legal or regulatory reporting obligations and/or to protect the rights of third parties;

To ensure that we are paid – to recover any payments due to us; and

To reorganize or make changes to our business – In the event that we undergo a reorganization (for example if we merge, combine or divest a part of our business), we may need to transfer some or all of personal information to the relevant third party (or its advisors) as part of any due diligence process or transfer to that reorganized entity or third party your personal information for the same purposes as set out in this Privacy Policy or for the purpose of analyzing any proposed reorganization.

7. Disclosure of Personal Information

We will always try to minimize, as much as possible in the performance of our Services and the application of the legal rules to which we are subject, the disclosure of personal information concerning you. However, in the course of providing our Services or operating this Site, we may share personal information with certain third parties, including the following:

Where an exception allowing the disclosure of such personal information is provided by the law;

Third-party service providers and/or partners who provide us with services pertaining to client portal (such as Segic), information technologies’ support (IT), website, social networks pages or accounts, application development, hosting and maintenance, and with other services. These third parties may have access to, or process personal information as part of providing those services for us. We limit the information provided to these service providers to that which is reasonably necessary for them to perform their services, and our contracts with them require them to maintain the confidentiality of such information;

Law enforcement and governmental entities, when required by law. For greater clarity, we may disclose personal information or other information if required to do so by law or in the good faith belief that such action is necessary to comply with applicable laws, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies; and

An acquirer, successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.

We will only use personal information to fulfil the primary purpose and applicable legitimate purpose it was collected for, or for a purpose compatible with that primary purpose.

Within Medic Solutions, the access to personal information is limited to employees, mandataries or agents who are entitled to know this information and to whom this information is reasonably needed for the performance of their duties or the execution of their mandate or contract (need-to-know basis).

8. Time of Conservation of Personal Information

We will only keep personal information for as long as reasonably necessary to fulfil the relevant purposes set out in this Privacy Policy and in order to comply with our legal and regulatory obligations, notably the rules dictated by the Autorité des marches financiers (Québec) and the Act respecting the protection of personal information in the private sector (Québec), as well as any other applicable law. Subject to any preservation period provided by any of such laws, you personal information, once the purpose for which it was collected is achieved, will be destroyed or anonymized, pursuant to the Act respecting the protection of personal information in the private sector (Québec).

9. Places of Storage of Personal Information

We will always try to limit, as much as possible, all disclosure of personal information outside of the province of Québec, and, as the case may be, such disclosure will not happen without an assessment of privacy-related factors pursuant to the Act respecting the protection of personal information in the private sector (Québec) and any other applicable law. It is understood, however, that third-parties suppliers (such as Segic, Microsoft, WordPress, Google or a cloud services provider) may hold, sometimes even without our knowledge, personal information concerning you on servers or facilities located in other countries or jurisdictions, for storage or internal processing only, with respect to the services they may provide us.

By providing us with personal information, you consent to such potential storage of personal information on servers or installations outside of Canada and accept that we are not responsible for such detention, it being understood that Medic Solutions: (i) shall take the necessary means to ensure that it does business with trustable, verified and secure suppliers, which are broadly used and known in their field of activities and which operate, as much as it is possible in the then-applicable technological context, inside Canada; and (ii) shall take, at the best of its capacities and in accordance with reasonable commercial practices, in the then-applicable technological context, contractual or other reasonable measures to ensure protections of personal information at least equivalent to those applicable in Québec.

It is understood that when personal information is located outside your country of residence, they may be subject to the laws of the country where they are stored, and may be subject to a disclosure to governments, tribunals or law enforcement agencies or regulations of the country in question, pursuant to its laws.

However, our practices regarding your personal information stays at all times governed by this Privacy Policy.

10. Protection of your Personal Information

We follow generally accepted industry standards to protect the information submitted to us, both during transmission and once we receive it. We maintain appropriate physical, technical and administrative safeguards to protect personal information against accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, misuse, and any other unlawful form of processing of the personal information in our possession.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. We cannot ensure or warrant the security of any information you transmit or provide to us, and you do so at your own risk. We also cannot guarantee that such information may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or administrative safeguards. If you believe personal information has been compromised, please contact our Chief Privacy Officer (see contact information at Paragraph 14 below).

11. Rights in Relation to your Personal Information

Under certain circumstances and in accordance with applicable data protection laws, including the Act respecting the protection of personal information (Québec), an individual has the following rights:

Access: entitled to ask if we are processing information and, if we are, request access to personal information. Subject to applicable law and, where applicable, payment of a reasonable transcription, copy or transmission fee, the individual may receive a copy of the personal information we hold and certain other information about him or her or it;

Portability: the right to obtain copy of a computerized personal information in a structured, commonly used technological format;

Rights with respect to the use of technologies: your right to be informed if we are using a technology comprising functions allowing to identify, localize or profile you, as the case may be, and to be informed of the means to activate such functions, as the case may be;

Accuracy: we are required to take reasonable steps to ensure that the personal information in our possession is accurate, complete, not misleading and up to date;

Correction: entitled to request that any incomplete or inaccurate personal information we hold be corrected.

Erasure: entitled to ask us to delete, destroy or remove personal information in certain circumstances. There are certain exceptions where we may refuse a request for erasure or destruction, for example, where the personal information is required for compliance with law or in connection with claims or required by contract between the parties;

Right to be forgotten: the right to ask us to cease any disclosure of a personal information or that any hyperlink allowing to access it by a technological mean be de-indexed, or to ask that the hyperlink be re-index, if the disclosure of the personal information violates the law or if the conditions provided by the Act respecting the protection of personal information (Québec) are met;

Restriction: entitled to ask us to suspend the processing of certain personal information, for example to establish its accuracy or the reason for processing it;

Automated decision making: the right to have us rectify any personal information used to render a decision based exclusively on automated processing and the right to present its observations to our Chief Privacy Officer; and

Consent: when we obtained the consent to the processing of personal information, the right to withdraw this consent in the circumstances provided by the law.

To exercise one or the other of these rights, please contact our Chief Privacy Officer which contact information are provided at Paragraph 14.

12. Process for Dealing with Complaints

The Chief Privacy Officer which contact information is provided at Paragraph 14 will process in the shortest delays any complaint reported to him with respect to the use, disclosure, storage and processing, by Medic Solutions, of your personal information. He will give you the opportunity to communicate to him, within 15 days (or any other longer period that may be granted to you by the Chief Privacy Officer, at his / her sole discretion), a written or verbal statement of the grounds of your complaints as well as any exhibit, document or material evidence in support of this complaint. The Chief Privacy Officer will then render his / her decision regarding your complaint, within a maximum delay of 30 days following the expiry of the aforementioned period for the communication of the statement.

Finally, it is also possible to file a complaint with an authority governing data protection in the applicable jurisdiction, namely, in the province of Québec, the Commission de l’accès à l’information.

13. Confidentiality Incidents

Any confidentiality incident involving personal information shall be immediately reported to the Chief Privacy Officer which contact information is provided at Paragraph 14. A confidentiality incident includes the following situations:

Access not authorized by law to a personal information;

Use not authorized by law of a personal information;

Disclosure not authorized by law of personal information;

The loss of personal information or any other breach of the protection of such information.

14. Chief Privacy Officer

If you have any question about how we handle your personal information, or if you wish to make a formal request pursuant to this Privacy Policy, please contact Medic Solution’s Chief Privacy Officer:

Mrs. Manon Fraser, at m.fraser@medicsolutions.ca

15. Applicable Laws and Jurisdiction

This Site and Privacy Policy are governed by and construed and interpreted according to the laws of the Province of Québec (Canada) and the Canadian federal laws applicable therein.

You hereby expressly attorn to the Courts of the judicial district of Montreal, Province of Québec (Canada), which shall have exclusive jurisdiction with respect to any proceeding arising or in connection, in any way, with this Site, its use or any matter in connection with the protection of your personal information.

16. French and English Versions

In case of conflict between the French and English versions of this Privacy Policy, the French version shall prevail.

17. Modification of this Privacy Policy

We may modify the content of this Site without notice. This Privacy Policy may be modified, without notice, from time to time in the future. We thus encourage you to examine it each time you visit this Site, specially to be informed of the way we process your personal information.

This Privacy Policy has last been updated in September 2023.

For any additional information with respect to this Site, please contact us at the following address: m.fraser@medicsolutions.ca