Last revised: May 25, 2021
At Switch Health Solutions Inc. (“Switch”, “we”, “us”, “our”), we are committed to protecting your privacy and safeguarding your Personal Information (defined below). The purpose of this Privacy Statement is to inform you about the types of Personal Information Switch collects, uses and discloses from or about you in connection with your use of (i) the Switch websites: www.switchhealth.ca, www.switchhealth.clinic, and (collectively, the “Website”); and (ii) our COVID-19 screening and testing services (the “Services”).
This Privacy Statement explains how we use and disclose that information, the choices you have regarding such use and disclosure, and how you may correct that information.
We show our commitment to your privacy, by complying with the laws and regulations under applicable privacy laws in Canada, and specifically the Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA), the Personal Health Information Protection Act, 2004 (Ontario) (PHIPA), and other applicable Canadian provincial legislation and the regulations thereunder. This Privacy Statement has a limited scope and application. Consequently, the rights and obligations contained in this Privacy Statement may not be consistent with privacy requirements for all jurisdictions. If you are using the Website or Services and are not a resident of Canada, you should note that by providing your Personal Information to us, you are consenting to: (i) the collection, use, and disclosure of your Personal Information in Canada which may not have the same Personal Information protection laws as the jurisdiction in which you reside; and (ii) the collection, use, and disclosure of your Personal Information in accordance with this Privacy Statement and the laws of Canada.
Modifications to this Privacy Statement
From time to time, we may make changes to this Privacy Statement. The Privacy Statement is current as of the “last revised” date which appears at the top of this page. We will treat Personal Information in accordance with the Privacy Statement under which it was collected, unless we have your consent to treat it differently. Your continued use of the Website or our Services after an update or amendment to this Privacy Statement means that you consent to the collection, use, and disclosure of your Personal Information as described in the updated Privacy Statement.
By accessing or using the Website or our Services, you signify your consent to our collection, use, disclosure of your Personal Information in accordance acceptance with the terms of this Privacy Statement. You can withdraw your consent at any time, however, if you choose to do so, we may not be able to provide you with our Website and Services.
1. What is Personal Information?
“Personal Information” is any information about an identifiable individual. This information may include but is not limited to your name, contact information, information that relates to your physical or mental health, including information that consists of the health history of your family, information related to the providing of healthcare to you.
2. What Personal Information do we collect?
Personal Information that you give to us
We collect and maintain different types of Personal Information in respect of the individuals with whom we interact. This Personal Information may include, but is not limited to:
- contact and identification information, such as your name, email, address, telephone number, health card number, sex, passports (for travelers) and date of birth;
- biometric information, such as your image as it appears on your passport or other form of identification;
- information, including your personal health information relating to the provision of COVID-19 screening test;
- payment information, including your credit card number and billing address; and
- any other Personal Information that you choose to provide to us.
We may also collect Personal Information about your child when you request that we provide our services for the benefit of your child. We will not collect a child’s Personal Information without the consent of the child’s parent or legal guardian.
We only use your biometric information (e.g., your image as it appears on your passport or other form of identification) for identification purposes, including the validation of your identity.
Personal Information that we receive from third parties
As a general rule, we collect Personal Information directly from you. For example, we collect Personal Information from you when you create an account or sign-up for a COVID-19 screening test or serology test through our Website or otherwise. In addition to the Personal Information that you provide directly to us through our Website or otherwise, we may receive your Personal Information from your physician or other healthcare provider who has requisitioned a COVID-19 screening test or serology test from us on your behalf.
You acknowledge and agree that Switch shall not be responsible for any information that you provide MD Connected or any other physician or healthcare provider that is not disclosed to Switch or does not relate to your use of our Website or Services.
Other information that we receive from third parties and tracking technologies
- Strictly Necessary Cookies: These are Cookies that are required for the operation of our Website. They include, for example, Cookies that allow you to remain logged in to your account and navigate throughout the Website.
- Targeting Cookies: These Cookies record your visit to a website, the pages a user has visited and the links the user has followed. This information is used to make the Website and the advertising displayed on them more relevant to each user’s interests and to track the effectiveness of marketing efforts as well as those of third parties. This information is generally shared with third parties for this purpose.
3. Where do we store your Personal Information?
We will store the Personal Information that we collect and receive about you on our proprietary patient portal that is accessible on our Website. The servers for our patient portal are located in Canada.
If you have any questions about our storage practices, please contact our Privacy Officer using the contact information provided below.
4. How do we use your Personal Information?
We identify the purposes for which we use your Personal Information at the time we collect such information from you and obtain your consent, in any case, prior to such use. We generally use your Personal Information for the following purposes (the “Purposes”):
- to establish, maintain and manage our relationship with you, including by contacting you, so that we may provide you with any services or communications that you have requested or purchased;
- to verify your identity, including in connection with the services or communications that we provide to you or that you have requested;
- to facilitate and administer your access to the Website, and your use of the Website’s functionality;
- to assist with your interactions with us when communicating with us or using our services;
- to provide you with the services you have requested, including conducting diagnostic and screening for infectious diseases and communicating those results to you;
- to provide the swab taken during your COVID-19 screening test to a third party laboratory to testing;
- to communicate your test results to you;
- to communicate with your physician or other healthcare provider regarding your test results;
- to provide you with access to the results of your COVID-19 screening test;
- to verify and confirm that a transaction or service has been completed;
- to process your payments and other similar transactions through the Website;
- to facilitate communications with third-party service providers with whom we have a contractual relationship such as, MD Connected and the third-party laboratories that we work with;
- to advise you about new programs and services that may be of interest to you;
- to notify you of certain activities relating to your use of our services;
- to respond to your inquiries, complaints or requests;
- to collect opinions and comments in regard to Switch’s operations;
- to protect Switch against error, fraud, theft, and damage to the Website, our assets and other properties;
- to conduct analysis and evaluations to understand usage trends and to improve the Website, our services, communications, and operations;
- to investigate legal claims;
- such purposes for which Switch may obtain consent from time to time; and
- such other uses as may be permitted or required by applicable law, including providing your Personal Information to public health authorities.
Please note that we use several third party tools, software, and service providers to assist use in fulfilling the Purposes and managing our internal operations. Please see section 16 for more details on these tools, software, and service providers.
By consenting to our collection, use and disclosure of your Personal Information through the Website you allow us to fulfill the Purposes for which we collect your Personal Information.
When we collect your Personal Information for research and development purposes, we ensure that any information used for our analysis and reports will be de-identified and aggregated in a manner that will not identify you.
We will collect your consent prior to sending you any commercial electronic messages, unless an exception to obtaining your opt-in consent applies under Canada’s Anti-Spam Legislation (CASL). You will have the opportunity to opt-out of receiving commercial electronic messages at any time.
Please note that we may collect, use and disclose your Personal Information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.
5. To whom do we provide your Personal Information?
Generally, we will only make disclosures of Personal Information to persons for whom you have provided your consent. Please note that this consent may be implied by your actions. You acknowledge and agree that we may disclose your Personal Information as follows:
- we may disclose your Personal Information to third party service providers, such as physicians, laboratories, nurse practitioners, or other healthcare professionals where such third parties are assisting us in fulfilling the Purposes;
- we will disclose your Personal Information to third party physicians or other healthcare practitioners, including MD Connected physicians, that are responsible for requisitioning your COVID-19 screening test and/or communicating your results to you. This information may include your name, date of birth, sex, address, and phone number. Please note that when your requisitioning physician is a MD Connected physician, your Personal Information will also be shared with MD Connected;
- we will disclose your Personal Information, including your name, date of birth, sex, address, and phone number to the laboratory we use to analyze the swabs collected as part of your COVID-19 test for the laboratory to analyze your test results and to communicate your results to us and your requisitioning physician or other healthcare practitioner;
- if you test positive for COVID-19, we will provide your Personal Information, including your name, date of birth, health card number, sex, age, and phone number to federal and provincial public health authorities in accordance with federal and provincial legislation, including to the Public Health Agency of Canada and in connection with the Government of Canada’s Quarantine Case Management System. Please note that your requisitioning physician or healthcare practitioner may also have a legal obligation to disclose such Personal Information to public health authorities; and
- we may also make disclosures of Personal Information to a potential buyer in connection with a transaction involving the sale of some or all of the business of Switch (in which case the use of your Personal Information by the new entity would continue to be limited by applicable law), or as otherwise permitted or required by law.
Your Personal Information may also be disclosed:
- as permitted or required by applicable law or regulatory requirements;
- to comply with valid legal processes such as search warrants, subpoenas or court orders;
- as part of our regular reporting activities under applicable law to protect the rights and property of Switch;
- during emergency situations or where necessary to protect the safety of a person or group of persons; and
- for any additional purposes for which we have obtained your consent to disclose your Personal Information.
Since we may share your Personal Information with third parties, as described in this Privacy Statement, your Personal Information may be collected, used, and disclosed outside of your jurisdiction of residence. As such, your Personal Information may potentially be accessible to law enforcement and national security authorities of another jurisdiction.
If you would like further information about our policies and practices regarding third parties (including our service providers) to whom we disclose Personal Information, please contact our Privacy Officer using the contact details provided below.
By providing your Personal Information to us, you consent to our disclosure of this information to our services providers and other third parties, as described in this Privacy Statement, including those that may be located outside of your jurisdiction of residence, for the purposes of processing your Personal Information on our behalf, providing services to us or to you, operating and hosting the Website, and business and for the other purposes described in this Privacy Statement.
6. When and how do we obtain your consent?
We generally obtain your consent prior to collecting your Personal Information, and in any case, prior to using or disclosing your Personal Information for any purpose. You may provide your consent to us either orally, electronically or in writing. The form of consent that we seek, including whether it is express or implied, will largely depend on the sensitivity of the Personal Information and the reasonable expectations you might have in the circumstances. In limited circumstances, we may rely on a third party to obtain your consent to the sharing of your Personal Information with us.
You may change or withdraw your consent by providing us with reasonable notice, subject to legal or contractual obligations. You may also expressly instruct that your personal health information not be used or disclosed for healthcare purposes without your consent.
Please note that if you withdraw or vary your consent to our collection, use, or disclosure of your Personal Information, we may not be able to provide you with the communications and/or services that you request through the Website.
7. How long will we use, disclose or retain your Personal Information?
We will use, disclose or retain your Personal Information for as long as necessary to fulfill the purposes for which that Personal Information was collected and as permitted or required by law.
8. How can you review your Personal Information that we have collected, used or disclosed?
If you make a written request to review any Personal Information about you that we have collected, used or disclosed, we will provide you with any such Personal Information to the extent required by law. We will make such Personal Information available to you in a form that is generally understandable and will explain any abbreviations or codes.
When requesting access to your Personal Information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the Personal Information that we hold about you. If you require assistance in preparing your request, please contact our Privacy Officer.
Your right to access the Personal Information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the Personal Information that we hold about you. In addition, the Personal Information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your Personal Information, we will endeavour to inform you in writing of the reasons why, subject to any legal or regulatory restrictions, and remedies available to you.
9. How do you know that the Personal Information we have on you is accurate?
We will make reasonable efforts to ensure that your Personal Information is kept as accurate, complete and up-to-date as possible. If your Personal Information happens to change during our relationship, please keep us informed of such changes. You can make changes to certain of the Personal Information we possess about you through the Website. In some circumstances we may not agree with your request to change your Personal Information. Please contact our Privacy Officer if you wish to update the Personal Information that we hold about you.
At any time, you can challenge the accuracy or completeness of your Personal Information in our records. If you successfully demonstrate that your Personal Information in our records is inaccurate or incomplete, we will amend the Personal Information as required. Where appropriate, we will transmit the amended information to third parties having access to your Personal Information.
10. How fast will we respond to your written requests?
We will attempt to respond to each of your written requests not later than 30 days after receipt of such requests. We will advise you in writing if we cannot meet your requests within this time limit. You have the right to make a complaint to the Privacy Commissioner of Canada and/or other relevant governmental authority in respect of our failure to respond to a request within a reasonable time period.
We will not charge any costs for you to access your Personal Information in our records or to access our privacy practices without first providing you with an estimate of the approximate costs, if any.
11. How do we know that it is really you requesting your Personal Information?
We may request that you provide sufficient identification to permit access to the existence, use or disclosure of your Personal Information. Any such identifying information shall be used only for this purpose.
12. What safeguards have we implemented to protect your Personal Information?
We have implemented commercially reasonable physical, organizational, administrative, contractual and technological security measures to protect your Personal Information from loss or theft, unauthorized access, disclosure, copying, use or modification. The only employees, who are granted access to your Personal Information, are those with a business ‘need-to-know’ or whose duties reasonably require such information.
We take reasonable steps to ensure that all affiliates and other third parties that are engaged to perform services on our behalf and are provided with Personal Information are contractually required to observe the intent of this Privacy Statement and our privacy practices.
13. How do you contact us regarding access to your Personal Information or our privacy practices?
All comments, questions, concerns or complaints regarding your Personal Information, this Privacy Statement or our privacy practices, should be forwarded to our Privacy Officer at the following email address: email@example.com
***If you choose to communicate with us via email, please be aware that email is not a 100% secure medium for sending any personal or confidential information to us. ****
14. How is this Privacy Statement interpreted?
This Privacy Statement includes examples but is not intended to be restricted in its application to such examples; therefore, (a) where the word "including" is used, it shall mean "including without limitation"- the words “include” and “includes” has corresponding meanings; and (b) where the word “or” is used, it is not exclusive.
This Privacy Statement does not create or confer upon any individual any rights or impose upon Switch any rights or obligations outside of, or in addition to, any rights or obligations imposed by Canada's federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this Privacy Statement and Canada's federal and provincial privacy laws, as applicable, this Privacy Statement shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.
15. Additional Information on our Tools and Partners
In connection with our collection, use, and disclosure of your Personal Information as well as the operation and management of our business, Website, and Services, Switch utilizes several tools and partners that assist us in fulfilling our objective of accomplishing our goal of implementing and adhering to lawful, transparent, and fair privacy practices. In the interest of providing you with as much information as possible to assist you in making an informed decision as to whether to (a) share your Personal Information with us; and (b) provide your consent to our collection, use, and disclosure of your Personal Information, we provide a summary of the tools and partners.
In addition to the tools and software we identified in the sections above, we may use the following tools and software to support our business and Personal Information processing objectives:
- Acuity Scheduling: We use the Acuity Scheduling software to assist with scheduling appointments at our clinics. The use of the Acuity Scheduling software assists us with the collection of the Personal Information we require to schedule appointments. The Personal Information (and other information) collected in connection with our use of Acuity Scheduling software is synced with our systems, including Outlook and SharePoint.
- ***Aircall***We use Aircall’s software to record calls with our customers for training and monitoring purposes. This software is used by our customer service team.
- Amazon Web Services (AWS). Our platform is hosted by AWS’s servers located in Montreal, Canada. The servers used by AWS to host our platform is specific to Switch. AWS also provides certain computational and security capabilities that assist us with the operation of our business and in providing you with our services.
- Intercom. We use Intercom’s ticketing system software to help us connect with you and provide you with our communications and support.
- Microsoft Office Suite. We use Microsoft Office Suite, including Outlook, Exchange 365, and SharePoint to manage our internal systems and operations.
- Squarespace: We use Squarespace software to assist with scheduling appointments at our clinics. The use of the Squarespace software assists us with the collection of the Personal Information we require to schedule appointments. The Personal Information (and other information) collected in connection with our use of Squarespace is synced with our systems, including Outlook and SharePoint.
- We use SRFax software to send electronic faxes to share certain Personal Information with public health units in a manner that is compliant with PHIPA.
- We use Stripe’s payment processing platform to process payments made through our Website or in connection with our Services.
- We use Voyce’s translation services in real time to provide you with assistance during your telehealth appointment with our Switch nurses.
Please note that the above list may not be exhaustive and is updated from time to time without notification to you. Please contact our Privacy Officer if you have any questions or concerns.
In addition to the partners we identified in the sections above, we may use the following partners in support of our business and operations:
- Laboratory Partners. We use the following third party laboratory services:
- Alpha Labs;
- Medical Labs of Windsor;
- Hematology Translational Laboratory;
- Public Health Labs;
- National Microbiology Lab; and
- Toronto Institute of Pharmaceutical Technology.
- Delivery & Transportation Services Partners. We use Purolator and Uber for transportation and delivery services. We may provide these partners with you name, address, phone number, and email in connection with the services that they provide to us or to you.
Please note that the above list may not be exhaustive and is updated from time to time without notification to you. Please contact our Privacy Officer if you have any questions or concerns.