Legal and Privacy

LEGAL

Please Note: Mothercraft® is a trade-mark of the Canadian Mothercraft Society. The Canadian Mothercraft Society also licenses the use of this trade-mark to Canadian Mothercraft of Ottawa-Carleton for the purpose of its operations out of the Ottawa region. For more information on Canadian Mothercraft of Ottawa-Carleton please go to: www.mothercraft.com.

PRIVACY POLICY

Introduction

Canadian Mothercraft Society and Mothercraft College of Early Childhood Education (referred to as “Mothercraft”) holds two primary types of information – personal and health information. This information is gathered to assist Mothercraft in the delivery of its services and programs.

Mothercraft always endeavours to ensure that the use of all personal and health information respects individual privacy rights and the legal obligations of Mothercraft.

The purpose of this policy is to detail Mothercraft’s standards in dealing with information. The policy is pursuant to applicable privacy legislation and, to the extent that there is any conflict between this policy and applicable privacy legislation, the legislation governs.

Definitions

For the purposes of this policy: “Mothercraft Staff” applies to all Mothercraft employees, contractors, consultants, agents, representatives, officers, directors, researchers, instructors, volunteers, and other related entities, whether individual or incorporated.

“Mothercraft Service User” applies to all persons who are participating in or benefiting from a Mothercraft program or service, including but not limited to all service users (parents/guardians and their children), students of Mothercraft College of Early Childhood Education, etc.

“Personal Information” means oral, written, and electronic collection, use, storage, and/or disclosure of information by Mothercraft where that information identifies an individual or where it would be reasonably expect that a person could be identified by the information. This includes but is not limited to information such as name, address, telephone number, email address, student number assigned by Mothercraft, employment history of the individual, educational history of the individual, and information relating to the individuals’ race, ancestry, creed/religion, place of origin, ethnic origin, citizenship, sex, sexual orientation, gender identity/expression, age, marital status, family status, and disability.

“Personal Health Information” or “PHI” means identifying oral, written, and electronic information collected, used, stored, or disclosed by Mothercraft about an individual, if the information:

Relates to the providing of health care to the individual;
Is a plan of service in the context of providing service to the service user;
Relates to payments or eligibility for health care in respect of the individual;
Is the individual’s health number; or,
Identifies a provider of health care to the individual or a substitute decision-maker of the individual.

Application

This policy applies to all Mothercraft Staff, Board Members and Volunteers, in regards to the collection, use, storage, and disclosure of personal information and personal health information that is in the custody and control of Mothercraft.

Further to this and other relevant Mothercraft policies, Mothercraft Staff may be required to participate in privacy training and/or sign documents (including confidentiality agreements) to ensure appropriate application of this policy.

Purpose

Mothercraft collects, uses, stores, and discloses personal information and personal health information in order to provide services, use services, teach, conduct research and compile statistics, improve services, provide payment and obtain payment, related to the range of programs and services provide by the organization.

Unless it is not reasonable in the circumstances, it is believed that all Mothercraft Staff and all Mothercraft Service Users know of the collection, use, storage, and disclosure of personal information and personal health information and are aware of this policy.

Unless prohibited otherwise by legislation, by being part of Mothercraft Staff or by being a Mothercraft Service User, you have implicitly consented to the collection, use, storage, and disclosure of your personal information and personal health information in accordance with this policy. You may withhold or withdraw this consent at any time by contacting Mothercraft’s Privacy Officer. Subject to application legislation, if you withhold or withdraw your consent, Mothercraft may be unable to retain your services and/or provide services to you.

Accuracy of Information

Personal information and personal health information will be as accurate, complete, and up-to-date as is necessary for the purposes of its use. Mothercraft Staff and Mothercraft Service Users are expected to inform Mothercraft, as soon as reasonably possible, regarding any correction, revision, or updates to the individual’s personal information and personal health information. Requests are expected to be made in writing and Mothercraft will respond to requests within 30 calendar days.

Collection, Access, and Disclosure

Mothercraft will strive to only collect personal information and personal health information required for the purposes outlined above. To that end, Mothercraft Staff are expected to determine which information is needed prior to collecting it and to limit requests for information appropriately.

The only persons who will collect, use, and store personal information and personal health information are Mothercraft Staff who need it for the purposes provided above, those outside persons who need it for the purposes provided above, and those outside persons who have a right to it by law. These people may include, but are not limited to, individuals employed in Mothercraft’s human resource department, individuals employed in Mothercraft’s accounting department, outside health care and community service providers who are working in partnership with Mothercraft.

Only persons who provide provincially funded health services to an individual can require an individual to produce their health card. From time to time, Mothercraft Staff may ask Service Users to voluntarily provide their health card number in order to facilitate referrals to provincially funded health resources. Service Users may decline to provide this information, however, should a Service User decline to provide this information it is with the understanding that Mothercraft may not be able to provide a full range of services.

All Mothercraft Staff are expected to take all reasonable and necessary precautions against the unauthorized disclosure of personal information and personal health information. Any disclosure shall only occur in a manner consistent with this policy. No Mothercraft Service User shall be permitted to access third party records except with the consent of the third party and/or as required by law.

If an individual wishes to review, or obtain a copy of, their personal information and/or personal health information, as held by Mothercraft, they may make a written request to the Privacy Officer. The request must be signed by the individual, their substitute decision maker (if applicable), or their guardian (if applicable). All requests will generally be responded to within 30 calendar days. However, up to 60 calendar days may be required in the case of complex requests or where there is a substantial volume of requests.

In regards to requests to review personal information and/or personal health information, an appointment will be made for the person to review their personal information and/or personal health information in a confidential manner on Mothercraft premises, in the presence of Mothercraft Staff. The requesting person may bring a support person to this appointment, if they wish.

Subject to applicable legislation, Mothercraft may refuse to produce all or some of the personal information and/or personal health information. Further, subject to applicable legislation, Mothercraft may require that a reasonable fee be paid in order to address costs, including but not limited to those related to retrieval, copying, and/or delivery.

Storage

Mothercraft will maintain personal information and personal health information as long as is required for its purposes as per the organization’s Storage and Retention of Records Policy. The retention period may be extended as a result of minimum retention periods provided in the applicable legislation. Further, the retention period may be extended for other reasons, such as pursuant to any litigation or legal action.

Privacy Breach

A privacy breach is any theft, loss, unauthorized collection, use or disclosure of personal information or personal health information, in contravention of this policy or applicable legislation.

A privacy breach may be experienced by a person or a group of persons.

Where there is an actual or suspected privacy breach (referred to as “Privacy Breach Complaint”), it should be immediately reported to the Mothercraft Privacy Officer. A Privacy Breach Complaint may be made by any Mothercraft Service User or Staff person. In the event that a Privacy Breach Complaint is made by Mothercraft Staff, the Mothercraft Staff person shall initially provide the Privacy Breach Complaint to their immediate supervisor, who will in turn forward to the complaint to the Mothercraft Privacy Officer.

Upon receipt and review of the Privacy Breach Complaint, the Privacy Officer or an assigned delegate will conduct an investigation. Mothercraft may also decide to conduct an investigation without a Privacy Breach Complaint. At any time, the Privacy Officer/delegate may refuse to proceed with an investigation and may discontinue the investigation. This may occur where the Privacy Officer/delegate believes that the matter does not come under this policy; the complaint is frivolous, vexatious or not made in good faith; or, having regard to all the circumstances, further investigation of the complaint is unnecessary.

In conducting the investigation, the Privacy Officer/appointee will strive to determine:

The scope of the breach (if any) and the risk of a future breach;
The cause of the breach or risk of a breach; and,
The actual and potential harm to the relevant persons, including any physical harm, identify theft, financial loss, damage to reputation, etc.

If, as a result of the investigation, it is concluded that a breach has occurred, the Privacy Officer/appointee will:

Report to the Office of the Privacy Commissioner of Canada the breach, the cause of the breach, as well as the actual and potential harm;
Report to the impacted individuals the breach, the cause of the breach, as well as the actual and potential harm;
Advise relevant Mothercraft Staff of the breach, the cause of the breach, as well as the actual and potential harm;
Establish and implement a plan of action to respond to the breach, limit harm, and prevent a future breach; and,
Where Ministry compliance is required, provide a written report outlining the nature of the breach, the plan or action in response to the breach and actions to prevent in the future.

If, as a result of the investigation, it is concluded that no breach has occurred, but a breach was possible, the Privacy Officer/appointee will establish and implement, a plan of action to prevent a future breach.

Upon the conclusion of the investigation, the Privacy Officer/appointee will prepare a written report detailing the investigation’s findings and any action taken. The report shall be sufficiently detailed to allow for confirmation that a full and proper investigation has occurred. The report may be provided, in full or in part, to the Complainant and impacted persons. The disclosure of the report is within Mothercraft’s full and absolute discretion, subject to applicable legislation.

In general, the Privacy Officer/appointee shall try to ensure that the investigation is concluded and the report prepared within 30 calendar days of receiving the -complaint.

Nothing in this policy should be construed as preventing or discouraging a person from reporting an issue to the Office of the Privacy Commissioner of Canada or other appropriate enforcement agency.

Inquiries and Complaints

If you have questions, comments or complaints about the Mothercraft privacy policy about the collection, use or disclosure of personal information, you may contact the Privacy Officer:

Max Ascenzi
Director of Corporate Service
646 St Clair Avenue West
Toronto Ontario M6C 1A9
Max.ascenzi@mothercraft.org

If you are not satisfied with the response provided by the Privacy Officer, you may contact the Office of the Information and Privacy Commissioner of Ontario, in writing, at 2 Bloor Street East, Toronto, Ontario, M4W 1A8 or by calling 416-326-3333.