Privacy policy

The collection of personal information is the first stage of the personal information life cycle. In the course of its activities, VirtuaSanté collects only the information necessary for the provision of its services, the creation of your health record and compliance with its professional and legal obligations.

When you book online, VirtuaSanté obtains your consent to the collection and use of your personal information (name, contact information, date of birth) for the purpose of managing your appointment.

At your first visit, VirtuaSanté obtains your consent to the collection, use and, where necessary, disclosure of your personal information for the purpose of providing its services and managing your file.

This consent remains valid for as long as necessary to achieve these purposes, subject to your right to withdraw it at any time.

VirtuaSanté will seek your consent for any use or disclosure of your personal information that is not already covered by this consent or that is not otherwise authorized by law.

VirtuaSanté undertakes to use personal information only for the purposes for which it was collected.

In the course of its activities, VirtuaSanté may use technology service providers that host or process personal information outside Quebec, including elsewhere in Canada or in the United States. This is notably the case for Cal.com and Stripe.

Before disclosing personal information outside Quebec or entrusting a person or organization located outside Quebec with the task of collecting, using, disclosing or keeping such information on its behalf, VirtuaSanté conducts a privacy impact assessment (PIA), in accordance with the Act. This assessment takes into account, in particular, the protection afforded by the jurisdiction concerned, the applicable security measures and the guarantees offered by the provider.

VirtuaSanté limits the information transferred to what is necessary and puts in place, where required, appropriate contractual, technological and organizational measures to ensure its protection.

We use your personal information to:

• Manage appointment booking;
• Provide healthcare services and ensure follow-up care;
• Manage billing and payments;
• Communicate with you regarding your services, your file and your appointments;
• Ensure the administrative management of our activities;
• Comply with our legal and professional obligations.

With your consent, we may also use your contact information to send you promotional communications, including newsletters, surveys, promotions or special offers. You may withdraw your consent to receive these communications at any time.

We may also use certain information, where permitted by law, for analysis, research or service quality improvement purposes. The information used for these purposes is limited to what is necessary.

Information relating to your health record is kept for the period provided by applicable laws and professional rules, including those of the Ordre des infirmières et infirmiers du Québec.

Information related to billing and financial records is kept for the period provided by applicable laws, including the five-year period where it applies.

Upon expiry of the applicable retention periods, personal information is securely destroyed or anonymized, in accordance with applicable requirements.

When personal information is no longer necessary and its applicable retention period has expired, VirtuaSanté takes the necessary measures to destroy it securely.

Paper documents containing personal information are destroyed, in particular, using a shredder or any other means ensuring secure destruction.

VirtuaSanté implements appropriate physical, technical, computer and administrative measures to protect personal information against confidentiality incidents.

A confidentiality incident may occur, in particular, when personal information is accessed, used, disclosed or lost without authorization.

For example:

• A staff member accesses personal information without authorization;
• Personal information is sent to the wrong recipient;
• The organization is the victim of a cyberattack, including phishing or ransomware.

Where an incident presents a risk of serious injury, VirtuaSanté takes the measures provided by law, including the assessment of the risk, the keeping of a register and, where required, notification of the Commission d’accès à l’information and the persons concerned.

VirtuaSanté also takes the necessary measures to reduce the risks and to prevent a similar incident from recurring.

To report an incident or ask a question regarding the protection of your personal information, please contact the person in charge of the protection of personal information at the contact details indicated in section 1.

You have the following rights, among others, subject to the conditions and exceptions provided by law:

• Access: ask whether VirtuaSanté holds personal information about you and, if so, request access to it;
• Rectification: request the correction of personal information that is inaccurate, incomplete or equivocal;
• Withdrawal of consent: withdraw your consent where the processing of your information is based on it. Withdrawal may, however, affect our ability to provide you with certain services;
• Restriction of access: request, where permitted by law, that a particular professional or category of professionals not have access to certain information that you identify;
• Complaint: file a complaint with VirtuaSanté’s person in charge of the protection of personal information or, if you wish, with the Commission d’accès à l’information du Québec;
• Portability: request, in the circumstances provided by law, that certain computerized personal information about you be disclosed in a structured, commonly used technological format or be transmitted to another organization.