Privacy policy

1. Who we are, and scope

Tandem Santé inc., 179 rue de Chambois, Québec, Quebec G1B 2J4, Canada.

This policy covers inquiries, free consultations, communications and client records. It supplements the contractual notice without broadening any authorization to disclose.

The person responsible for the protection of personal information receives questions, requests and complaints: Émilie Tétreault, emilie@innova-conseil.ca, 343 202-1503.

2. Information collected, and how

We collect the contact details needed to respond to a request. Where a consultation or services are contemplated, we may also collect date of birth, information about the authorized representative, health and support needs, medication and allergies, functional, cognitive, psychosocial and environmental information, and the relevant assessments, plans, interventions and communications.

Appointment, billing and payment data are limited to administrative needs.

Collection takes place from the person, their representative or authorized sources, by telephone, email, documents or forms provided, videoconference and in-person meetings. We explain what information is necessary and the consequences of refusing. We do not require information unrelated to the stated purpose.

3. Use and consent

The purposes are to respond to requests, assess needs and risks, develop the care plan, deliver and document services, communicate with authorized persons, manage appointments and billing, protect safety and meet our obligations. Routine quality review is carried out only to the extent permitted by law.

Health information is sensitive. Where required, consent is express, free, informed and specific to the purpose. It may be limited or withdrawn under the conditions set by law, verbally where the law permits. We explain the practical effects on the safe delivery of services.

A representative’s authority is verified; caregiver status alone does not authorize access to the complete record. A new, distinct purpose is subject to analysis and to any additional consent required.

This policy does not constitute a general authorization to use records for research, marketing or technology development.

4. Access and disclosure

Only professionals directly involved in a clinical record and who need to know have access to it. Other authorized functions receive only the administrative information required.

Disclosures to external professionals, institutions and family members are limited to the relevant authorizations or to another legal basis.

Suppliers may support email, records or administrative functions. Information entrusted to them must be governed by the required confidentiality, security and use-limitation conditions.

Disclosure to an authority, to legal counsel or in the context of a transaction takes place only within the limits permitted by applicable law.

5. Safeguards and where data is held

Tandem Santé uses Microsoft 365, notably Outlook for professional email and SharePoint for the retention of records and documents.

• mandatory multi-factor authentication for Microsoft 365 access;
• encryption of emails containing personal or confidential information;
• access to clinical records limited to professionals directly involved in the record and who need that information;
• restricted SharePoint external sharing;
• BitLocker encryption enabled on computers used for client records.

These measures do not guarantee that no incident will occur.

According to the information currently shown in Tandem Santé’s Microsoft 365 admin centre, the data-at-rest location for the email and file services used is in Canada. This does not mean that all access, support operations, processing or technical data are limited to Canada, nor that hosting is located exclusively in Quebec.

Technology suppliers or their personnel may process or access information outside Quebec. Any communication or handling of information outside Quebec must comply with the applicable legal conditions, including the privacy impact assessment and the required contractual framework.

6. Retention, destruction and governance

We limit retention to the applicable purposes and obligations. Clinical records may have to be kept after services end; a deletion request does not remove those obligations. Specific periods depend on the document and the responsible professional, and may be requested from the person responsible.

Information that is no longer necessary and no longer required to be kept must be securely destroyed.

Governance rests on the person responsible, the obligations of professionals, function-based access, the handling of requests and complaints, retention and destruction, supplier verification and incident management. Management approves internal rules and corrective measures; professionals protect the records for which they are responsible.

7. Your rights, complaints and incidents

You may request access to your information, its correction, explanations about its processing, and a restriction or withdrawal of consent where permitted. The right to portability, where applicable, covers eligible computerized information collected from you. Other rights of access remain applicable.

For a formal access or correction request, write to Émilie Tétreault, emilie@innova-conseil.ca, 343 202-1503. We verify identity and authority, and respond within the legal time limits, normally within 30 days for access and correction. A refusal explains its grounds and the available recourse.

A complaint does not affect the quality of care. You may also contact the Commission d’accès à l’information du Québec.

We document confidentiality incidents, take reasonable measures to reduce risk and prevent recurrence, and notify individuals and authorities where required. Material changes to this policy will be communicated by an appropriate means; fresh consent will be sought where the law requires it.