Understand the pain. Recover your movement.

This English text is a courtesy translation. In case of any discrepancy, the French version prevails.

1. Why this policy exists

This policy explains, in plain terms, what personal information we collect, why, who we share it with, how long we keep it and how you can exercise your rights.

It is adopted in accordance with the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25.

Personal information is any information that makes it possible to identify a natural person, directly or indirectly. Information concerning your health is sensitive and receives heightened protection.

The clinic's osteopath is a member of the Corporation des professionnels ostéopathes du Québec (CPOQ) and is bound by its code of ethics, in particular with respect to professional secrecy and record keeping. A copy of the code of ethics is available at the clinic on request.

2. Who this policy applies to

• Our clients and, where applicable, their legal representatives (parent, tutor, mandatary);
• visitors to our website www.cliniqueosteorouyn.com;
• people who use our online booking portal cliniqueosteorouyn.janeapp.com;
• our suppliers and business partners.

3. The information we collect

3.1 Clients

We open a record for each client. It contains:

• the date the record was opened;
• your last name, first name, address, telephone number, email address, date of birth and sex;
• the name and contact information of your legal representative, if you are a minor or unable to consent;
• the reason for each consultation;
• your health history, your medication and any information relevant to your condition;
• the results of our assessments and, where applicable, any examination reports you provide;
• our appraisal of your condition;
• a description of the treatments provided and their dates;
• the recommendations made to you;
• progress notes, correspondence and other documents related to your follow-up;
• the information required for billing and receipts (payment method, amounts, and, when you request an insurance claim: insurer's name, policy number and certificate number).

When you pay by card, your card number is entered directly on the payment terminal and transmitted to our payment processor. We neither see nor keep your full card number. We keep only the record of the transaction: amount, date, card type and last four digits.

We collect only the information necessary for the purposes described in section 4.

3.2 Website

Our website www.cliniqueosteorouyn.com is an information page. It contains no forms and asks you for no personal information.

The site is hosted and delivered by Cloudflare, Inc. To deliver the page and protect it against attacks, Cloudflare processes technical connection data, including your IP address, browser type and device used. This data serves only the operation and security of the site.

Traffic measurement. We use Cloudflare Web Analytics to know how many people consult the site and which pages are visited. The tool works through a small script that measures page performance data, such as loading time. It has three characteristics we consider important:

• it places no cookies and accesses no storage in your browser;
• it does not follow you from one site to another and builds no profile about you;
• your IP address is discarded by the provider as soon as the measurement is received and is kept neither in its databases nor in its logs.

The statistics we consult are aggregated and do not make it possible to identify you.

Our site uses no technology capable of identifying you, locating you or profiling you. See section 7.

3.3 Online booking portal

The booking buttons on our site redirect you to cliniqueosteorouyn.janeapp.com, a portal operated on our behalf by Jane Software Inc. (North Vancouver, British Columbia). That portal uses the word "patient" to designate our clients: this is the software's terminology, not a distinction in the nature of our services.

When you book there, you provide us with your name, contact information, date of birth, reason for consultation and, where applicable, your answers to the health questionnaire. This information feeds directly into your record and remains under our responsibility: Jane acts as a supplier and accesses it only on our instructions or where the law requires.

Two exceptions fall to Jane rather than to us:

• If you create a Jane account to manage your appointments, your login credentials (email, telephone number, password) are controlled by Jane. Contact Jane with any question about them: privacy@jane.app.
• The portal places its own cookies and calls on the third-party services described in section 7.2.

3.4 Suppliers and partners

First name, last name, title, business contact information and the information needed to pay fees and meet our tax obligations.

4. Why we collect this information

We do not use your information for other purposes without your consent, except in the cases provided by law. We carry out no commercial solicitation based on your record.

5. How we collect it

We collect your information directly from you: in person at the clinic, by telephone, by email, on the forms you fill out, and through the online booking portal.

We may receive information from a third party when you authorize us to do so, for example the report of a health professional who follows you.

In limited cases, the law allows us to collect information without your consent, in particular where this is necessary to prevent serious injury or to meet a legal obligation.

6. Your consent

Your consent must be free, informed and given for specific purposes. Because information concerning your health is sensitive, we obtain express consent when your record is opened.

You may withdraw your consent at any time, subject to our legal, ethical and contractual obligations. In particular, we remain required to keep your record for the period indicated in section 9. We will then explain the consequences of withdrawal, for example the impossibility of continuing your follow-up safely.

7. Cookies and tracking technologies

A cookie is a small file placed on your device by a website.

7.1 Our website

Our site places no cookies for audience measurement, personalization or advertising. The traffic measurement tool described in section 3.2 works without cookies and without access to your browser's storage.

Cloudflare may place a strictly technical cookie where this is necessary to verify that your browser is not a robot or to apply a security measure. This cookie is not used to identify you or to follow you from one site to another, and it cannot be disabled without preventing the site from working.

Because no non-essential cookies are used, our site does not display a consent banner.

7.2 Booking portal

The portal cliniqueosteorouyn.janeapp.com uses its own cookies, managed by Jane and its suppliers.

Necessary cookies cannot be disabled without preventing the portal from working. The other two categories are your choice: a consent management tool asks you on your first visit, and you can change your choice afterwards through the "Cookie Preferences" link at the bottom of the portal's pages.

These cookies and the services that place them fall to Jane. We invite you to consult its cookie policy and its privacy notice, available from its legal centre.

8. Who we share your information with

We never sell, trade or rent your personal information, and we disclose it to no one for marketing purposes.

8.1 Our suppliers

Each has access only to the information necessary for its mandate and is bound by a contract governing confidentiality and security.

8.2 Other disclosures

We may disclose your information:

• to your insurer, at your request or with your authorization, to process a claim;
• to a health professional, with your consent, to ensure continuity of your follow-up;
• where the law requires it, in particular in response to a court order;
• where necessary to prevent serious injury to your health or safety, or to that of others.

8.3 Disclosure outside Quebec

Some information is processed outside Quebec:

• your records are hosted in a data centre located in Canada, but outside Quebec;
• appointment reminders by text message pass through suppliers established in the United States and may be stored there temporarily;
• the third-party suppliers of the booking portal listed in section 8.1 are established outside Canada and receive technical information about your browsing when you use the portal;
• your card payments are processed under a Canadian merchant agreement, but our supplier's infrastructure may include components located outside Quebec;
• the connection and traffic measurement data of our site are processed by the Cloudflare data centre closest to the request, determined by network routing. Because no location service is used, this processing may take place in a country or region different from the one the visit comes from. The IP address is discarded on receipt and is not kept.

Before each of these disclosures, we conducted a privacy impact assessment to confirm that the information receives adequate protection, and the disclosure is governed by contract.

9. How long we keep it

The seven-year period applicable to records corresponds to the record-keeping requirement of the CPOQ code of ethics and to the conditions of our professional liability insurance.

Site connection and traffic data. We ourselves keep no connection logs for our site. Cloudflare does not keep its customers' request logs by default: this retention must be enabled explicitly and we have not enabled it. The traffic statistics we consult contain no IP address, since it is discarded as soon as the measurement is received, and Cloudflare displays only a limited history. Cloudflare does not publish a single retention period applicable to all of its technical data, as periods vary by product and configuration; its policy provides that data is deleted or destroyed at the expiry of the applicable period.

At the expiry of the period, the information is securely destroyed, by shredding for paper and permanent deletion for electronic files, or anonymized.

If practice ceases. If the clinic ceases its activities, your information will either be securely destroyed or, with your consent, transferred to another osteopath who will take custody of it. You will be informed of the measure retained and of how to obtain a copy of your record before it takes effect.

10. How we protect it

Restricted access. The clinic has no employees. The osteopath, who is responsible for the protection of personal information, is the only person with access to the records.

Physical measures. Paper records, if any, kept under lock in a space to which the public does not have free access; premises locked outside opening hours; screens placed out of visitors' sight.

Technological measures. Access to the electronic record protected by a strong password and two-factor authentication; encrypted devices that lock automatically; encrypted connections to the site and the portal (HTTPS); backups provided by our supplier; security updates applied regularly; payment terminal compliant with payment card industry standards.

Contractual measures. Every supplier with access to personal information is bound by a contract governing confidentiality and security.

As no system is infallible, we undertake to react quickly in the event of an incident (section 12).

11. Your rights

You have the right to:

• know what information we hold about you and obtain a copy of it, for yourself or for a person you authorize;
• have corrected any information that is inaccurate, incomplete or equivocal;
• request the deletion of information that is out of date or no longer justified by the purposes of collection;
• receive your information in a structured, commonly used technological format, or ask that it be transmitted to another organization (portability). This right covers the information you provided to us, not the information we produced, such as our assessment notes;
• request that dissemination cease or that information be de-indexed, in the cases provided by law;
• withdraw your consent at any time, subject to legal and contractual restrictions;
• file a complaint (section 14).

We make no decision concerning you based exclusively on automated processing.

How to exercise your rights. Send a written request to the person identified in section 13, by email or by mail. We may need to verify your identity before acting on it. We respond within 30 days of receiving your request. Our response is free of charge, except for reasonable transcription, reproduction or transmission fees, of which we will inform you in advance.

12. Confidentiality incidents

In the event of unauthorized access to, use or disclosure of personal information, or its loss, we undertake to:

1. identify the cause and remedy it without delay;
2. assess whether the incident presents a risk of serious injury;
3. if so, notify the Commission d'accès à l'information du Québec and the persons concerned, and indicate the measures they can take to reduce the risk;
4. take the measures necessary to prevent a similar incident from recurring.

We keep a register of all incidents, retained for at least five years.

13. Person in charge of the protection of personal information

Address to him any question, access or correction request, or complaint relating to this policy.

14. Complaints

If you believe we have not respected your rights or this policy, send a written complaint to the person identified in section 13. We open a separate file for each complaint, containing the complaint, our analysis, the supporting documents and the response provided. We respond within 30 days. Every complaint is handled confidentially.

If our response does not satisfy you, you may contact the:

For a complaint concerning the osteopath's professional conduct rather than the handling of your information, you may also contact the disciplinary committee of the Corporation des professionnels ostéopathes du Québec:

15. Changes

We may amend this policy at any time. The current version is published on our website and takes effect as soon as it is posted. The update date appears at the top of the document.

16. Version history