Personal Information
Protection Policy

• Personal information: any information concerning a natural person that allows, directly or indirectly, for that person to be identified.
• Confidentiality incident: unauthorized access to, unauthorized use or disclosure of, loss of, or any other breach in the protection of personal information.
• Represented person: an adult protected by a protective supervision regime (tutorship, curatorship) or a homologated protection mandate, or whose care is subject to substitute consent.
• Privacy Officer: the person designated by RAPHA to oversee the application of this policy and act as the point of contact with the Commission d'accès à l'information (CAI).
• Partner facility: a private seniors' residence (RPA), CHSLD, intermediate or family-type resource (RI/RTF), or any other facility with which RAPHA has entered into a service agreement.

Depending on your interaction with us, we may collect:

• Identification information: full name, residential or visit-site address, phone number, email address, date of birth (when necessary for care coordination).
• Care-related information: clinical history, health information relevant to foot care (diabetes, circulatory issues, allergies, relevant medication), follow-up notes. This information is collected only with your explicit consent, solely for care delivery, and never through the website or an online booking form.
• Billing information: information required to issue official receipts, particularly for reimbursement by private insurers or public programs (e.g., home support tax credit).
• Communication data: messages exchanged, appointment requests, contact preferences submitted through any channel (phone, email, online form, instant messaging, or booking platform).
• Technical browsing data: anonymized IP address, browser type, pages visited, and session duration, used solely for performance analysis.
• Information about a legal representative or caregiver: when a client is represented by a mandatary, tutor, curator, or caregiver, we may collect that person's name, their relationship to the client, and proof of the homologated mandate or tutorship/curatorship judgment.
• Information about subcontracting nurses: when RAPHA engages nurses or licensed practical nurses as subcontractors, we collect information necessary to verify their right to practice (OIIQ or OIIAQ licence number), professional liability insurance, and fitness to practice.

We apply the principle of minimal collection at all times: we only collect information strictly necessary for the purposes described in section 5.

We collect your information:

• directly from you;
• from your legal representative or caregiver, where applicable;
• from a partner facility, in the context of coordinated care in a residence.

Your information is used solely for the following purposes:

• delivery, coordination, and follow-up of foot care;
• appointment management and clinical record keeping;
• billing and issuance of official receipts;
• communication related to your care or file;
• verification of RAPHA subcontractors' right to practice and insurance;
• compliance with our legal, regulatory, and ethical obligations;
• continuous improvement of our services and website;
• commercial or promotional communications, only with your prior consent (section 13).

Your information will never be used for any other purpose without your prior, explicit consent.

We process your information on the basis of:

• your free, informed, and specific consent (or that of your legal representative, where applicable), obtained at first contact or upon signing the care consent form;
• the performance of the care service contract binding you to RAPHA;
• our legal and professional obligations arising from the LPRPSP, Act 25, and OIIQ standards.

Simply browsing our website constitutes acknowledgment of this policy. Booking a care service through our digital channels implies your acceptance of the collection and processing of your information for the purposes described in section 5.

A significant portion of our clientele resides in private seniors' residences or CHSLDs. We therefore apply the following principles, drawn from the Civil Code of Québec:

• Every person, including one protected by a protective supervision regime or a homologated mandate, is presumed capable of consenting to their own care. This capacity is assessed for each proposed care service, not permanently on the sole basis of a diagnosis or protective regime.
• Where a person is found incapable of consenting and there are no contrary advance medical directives, consent is given by their mandatary or tutor (art. 15 C.C.Q.); failing that, by the spouse or, failing a spouse, by a close relative or a person showing special interest in the person.
• RAPHA may request proof of the homologated mandate or tutorship/curatorship judgment before dealing with a representative, and may consult the Public Register of Representation Mandates of the Curateur public du Québec when necessary.
• If a person incapable of consenting categorically refuses a proposed care service despite their representative's consent, RAPHA does not proceed with the care and documents the situation, in accordance with article 16 C.C.Q.

We never sell, rent, or monetize your personal information.

We may disclose it only:

• to our care staff or subcontracting nurses, strictly to the extent required for care delivery;
• to selected third-party service providers (web hosting, online booking, communications processing, clinical management software), bound by contractual confidentiality obligations compliant with Act 25;
• to partner facilities, in the context of coordinated care and with required consent;
• to competent authorities, when required by law or court order.

RAPHA engages third-party providers for certain administrative functions, including:

• website hosting;
• online appointment booking;
• clinical record and billing management;
• email communications (newsletters, reminders).

Each of these providers is, or must be, bound by a written agreement guaranteeing a level of personal information protection compliant with the LPRPSP. Where information is likely to be stored outside Québec by one of these providers, a Privacy Impact Assessment (PIA) is required before the transfer (section 14).

• Clinical records: retained for a minimum of five (5) years from the last service rendered, in accordance with generally applied practice in private nursing practice in Québec.
• Billing records: retained according to applicable civil and tax prescription periods (generally six years for tax purposes).
• Commercial communication information: retained until you withdraw your consent.
• Technical browsing information: retained for a limited period for performance analysis purposes, then deleted or anonymized.

Upon expiry of these periods, your information is securely destroyed or irreversibly anonymized.

Under Act 25, you have the following rights:

• Right of access — view the information we hold about you.
• Right of rectification — have inaccurate, incomplete, or ambiguous information corrected.
• Right of erasure — request deletion of your information, subject to our legal and professional retention obligations.
• Right of de-indexation — request that information about you causing harm or contravening the law cease to be disseminated.
• Right of portability — receive your information in a structured, commonly used format (CSV, JSON), or request its transfer to a designated third party.
• Right to withdraw consent — at any time, without retroactive effect on processing already carried out.
• Right to file a complaint — with the Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca · 1 888 528-7741.

We implement technical, physical, and organizational security measures proportionate to the sensitivity of the information, including:

• encryption of data in transit and at rest;
• access restricted to authorized and trained personnel (care staff, subcontractors, Privacy Officer);
• regular staff and subcontractor training on confidentiality practices;
• periodic review of our security practices and measures.

Health information is never stored in unsecured tools or transmitted through unencrypted channels without your consent.

In accordance with Canada's Anti-Spam Legislation (CASL), RAPHA obtains your express or implied consent before sending you any commercial electronic message (newsletter, promotion, non-essential reminder). Each such message:

• clearly states the sender's identity and contact information;
• includes a simple, free unsubscribe mechanism, processed within a maximum of ten (10) business days.

Strictly administrative communications related to an already-booked appointment (confirmation, reminder, schedule change) are not considered commercial electronic messages under CASL.

Implied consent based on an existing business relationship expires after a limited period (generally two years following a purchase, or six months following a simple inquiry): after this period, express consent must be obtained to continue promotional communications.

Certain third-party service providers we use may store or process information outside Québec. In accordance with section 17 of the LPRPSP, we conduct a Privacy Impact Assessment (PIA) before any such transfer and only proceed when the level of protection provided is deemed adequate.

Upon written request, we can inform you of the territories involved and the safeguards in place.

In the event of a confidentiality incident presenting a risk of serious harm, in accordance with sections 3.5 to 3.8 of the LPRPSP:

• we take reasonable measures without delay to contain the incident and reduce the risk of harm;
• we diligently notify the Commission d'accès à l'information (CAI) and the affected individuals as soon as we have reason to believe such an incident has occurred;
• we record the incident in a register, whether or not the risk is deemed serious, kept for at least five (5) years.

In accordance with section 3.1 of the LPRPSP, RAPHA has designated the following Privacy Officer:

This person is responsible for overseeing the application of this policy, handling rights requests, and managing any privacy-related complaints.

We review this policy periodically to reflect changes in our practices and legal requirements. Any material changes will be announced on our website with an updated revision date. Continued use of our services following publication of a revised version constitutes acceptance of the changes.

If you believe your rights have not been respected after contacting us, you may file a complaint with the Commission d'accès à l'information du Québec (CAI):