PRIVACY STATEMENT
Back Be Nimble Massage & Wellness Centre is committed to safeguarding the personal information entrusted to us by our clients. We manage your personal information in accordance with Alberta’s Personal Information Protection Act (PIPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable laws. This policy outlines the principles and practices we follow in protecting your personal information. It is periodically reviewed to ensure that it provides adequate protection for your personal information.
This policy applies to Back Be Nimble Massage & Wellness Centre and to any person providing services on our behalf.
A copy of this policy is provided to any client on request.
What is personal information?
Personal information means information about an identifiable individual. This includes contact, health and financial information:
What personal information do we collect?
We collect only the personal information that we need for the purposes of providing services to our clients, including personal information needed to:
We normally collect client information directly from our clients. We may collect your information from other persons with your consent or as authorized by law.
We inform our clients, before or at the time of collecting personal information, of the purposes for which we are collecting the information. However, we don’t provide this notification when a client volunteers information for an obvious purpose (for example, when signing up for a user account on our client management website, or when providing credit card information to process a payment).
Use of service providers outside Canada
Back Be Nimble Massage & Wellness Centre contracts with companies outside of Canada to provide services on our behalf. These companies and their affiliates may store personal information outside of Canada.
For further information regarding storage of personal information outside of Canada or regarding Back Be Nimble Massage & Wellness Centre’s policies and practices regarding storage of information outside of Canada, please contact our Privacy Officer, whose contact information is listed at the end of this Privacy Statement.
Consent
We ask for consent to collect, use or disclose client personal information, except in specific circumstances where collection, use or disclosure without consent is authorized or required by law. We may assume your consent in cases where you volunteer information for an obvious purpose.
In cases where we collected personal information before January 1, 2004, we assume your consent to our use and, where applicable, disclosure for the purpose for which the information was collected.
We ask for your express consent for some purposes and may not be able to provide certain services if you are unwilling to provide consent to the collection, use or disclosure of certain personal information. Where express consent is needed, we will normally ask clients to provide their consent orally (in person, by telephone), in writing (by signing a consent form), or electronically (by clicking a button or checkbox).
A client may withdraw consent to the use and disclosure of personal information at any time, unless the personal information is necessary for us to fulfill our legal obligations. We will respect your decision, but we may not be able to provide you with certain products and services if we do not have the necessary personal information.
We may collect, use or disclose client personal information without consent only as authorized by law. For example, we may not request consent when the collection, use or disclosure is reasonable for an investigation or legal proceeding, to collect a debt owed to our organization, in an emergency that threatens life, health or safety, or when the personal information is from a public directory.
How do we use and disclose personal information?
We use and disclose client personal information only for the purposes for which the information was collected, except as authorized by law. The law also allows us to use that contact information for the purpose of collecting a debt owed to our organization, should that be necessary.
If we wish to use or disclose your personal information for any new business purpose, we will ask for your consent.
How do we safeguard personal information?
We make every reasonable effort to ensure that client information is accurate and complete. We rely on our clients to notify us if there is a change to their personal information that may affect their relationship with our organization. If you are aware of an error in our information about you, please let us know and we will correct it on request wherever possible.
We protect client personal information in a manner appropriate for the sensitivity of the information. We make every reasonable effort to prevent any loss, misuse, disclosure or modification of personal information, as well as any unauthorized access to personal information.
We will notify the Office of the Information and Privacy Commissioner of Alberta, without delay, of a security breach affecting personal information if it creates a real risk of significant harm to individuals.
We are required by professional association regulations and provincial legislation to keep records containing personal information for 10 years from the last date of service. If the client was under the age of 18 at the time of their last visit, records are retained for 10 years from the client’s 18th birthday.
We render client personal information non-identifying, or destroy records containing personal information once the information is no longer needed. We use appropriate security measures when destroying client personal information, including shredding paper records and permanently deleting electronic records.
We employ the following technical, administrative and physical safeguards:
Technical
Administrative
Physical
Access to records containing personal information
Clients of Back Be Nimble Massage & Wellness Centre have a right of access to their own personal information in a record that is in our custody or under our control, subject to some exceptions. For example, organizations are required under the Personal Information Protection Act to refuse to provide access to information that would reveal personal information about another individual. Organizations are authorized under the Act to refuse access to personal information if disclosure would reveal confidential business information. Access may also be refused if the information is privileged or contained in mediation records.
If we refuse a request in whole or in part, we will provide the reasons for the refusal. In some cases where exceptions to access apply, we may withhold that information and provide you with the remainder of the record.
You may make a request for access to your personal information by contacting our Privacy Officer, whose contact information is listed at the end of this Privacy Statement. You must provide sufficient information in your request to allow us to identify the information you are seeking.
You may also request information about our use of your personal information and any disclosure of that information to persons outside our organization. For personal information collected before January 2004, if we do not have a record of disclosures, we will provide information about any disclosure of your information that is likely to have occurred.
You may also request a correction of an error or omission in your personal information.
We will respond to your request within 45 calendar days, unless an extension is granted. We may charge a reasonable fee to provide a copy of your personal record, but not to make a correction. We will advise you of any fees that may apply before processing your request.
Questions and concerns
If you have a question or concern about any collection, use or disclosure of personal information by Back Be Nimble Massage & Wellness Centre, or about a request for access to your own personal information, please contact:
Clare Morgan, Privacy Officer
Back Be Nimble Massage & Wellness Centre
#101, 1921 – 91 Street SW
Edmonton, Alberta T6X 0W8
Phone: 780-466-0027
Email: contactus@backbenimble.ca
If you are not satisfied with the response you receive, you should contact the Information and Privacy Commissioner of Alberta:
Office of the Information and Privacy Commissioner of Alberta
Suite 2460, 801 - 6 Avenue, SW
Calgary, Alberta T2P 3W2
Phone: 403-297-2728
Toll Free: 1-888-878-4044
E-mail: generalinfo@oipc.ab.ca
Website: www.oipc.ab.ca
This policy applies to Back Be Nimble Massage & Wellness Centre and to any person providing services on our behalf.
A copy of this policy is provided to any client on request.
What is personal information?
Personal information means information about an identifiable individual. This includes contact, health and financial information:
- Contact information - name, home address, phone number, email address, emergency contact person.
- Health information - age, health & treatment history, names of other health-care providers, family medical history, subjective complaints, objective findings, examination results, diagnoses (if applicable), treatment plan, attendance records.
- Financial information - insurance information, credit card information, employer’s name, and other information to facilitate payment for services provided.
What personal information do we collect?
We collect only the personal information that we need for the purposes of providing services to our clients, including personal information needed to:
- open and manage a client profile on our client management website
- open and manage a treatment file
- contact clients about appointments
- deliver requested products and services
- assess, diagnose (if applicable), provide and evaluate treatment
- invoice for products and services
- facilitate direct billing to insurance benefit programs
- follow up with clients to determine satisfaction with products and services
- notify clients about upcoming events of interest
- meet regulatory requirements
We normally collect client information directly from our clients. We may collect your information from other persons with your consent or as authorized by law.
We inform our clients, before or at the time of collecting personal information, of the purposes for which we are collecting the information. However, we don’t provide this notification when a client volunteers information for an obvious purpose (for example, when signing up for a user account on our client management website, or when providing credit card information to process a payment).
Use of service providers outside Canada
Back Be Nimble Massage & Wellness Centre contracts with companies outside of Canada to provide services on our behalf. These companies and their affiliates may store personal information outside of Canada.
- Mindbody, Inc. – provides our client management website, through cloud-based business management software based in the United States. Personal information is voluntarily provided by the client and entered into this application when booking an appointment for the first time via clinic phone or online at https://clients.mindbodyonline.com.
- Wix.com, Inc. – provides our business website and is based in the United States. Wix.com, Inc. may collect, store and process certain non-personal and personal information of users of our website, solely on our behalf and at our direction.
For further information regarding storage of personal information outside of Canada or regarding Back Be Nimble Massage & Wellness Centre’s policies and practices regarding storage of information outside of Canada, please contact our Privacy Officer, whose contact information is listed at the end of this Privacy Statement.
Consent
We ask for consent to collect, use or disclose client personal information, except in specific circumstances where collection, use or disclosure without consent is authorized or required by law. We may assume your consent in cases where you volunteer information for an obvious purpose.
In cases where we collected personal information before January 1, 2004, we assume your consent to our use and, where applicable, disclosure for the purpose for which the information was collected.
We ask for your express consent for some purposes and may not be able to provide certain services if you are unwilling to provide consent to the collection, use or disclosure of certain personal information. Where express consent is needed, we will normally ask clients to provide their consent orally (in person, by telephone), in writing (by signing a consent form), or electronically (by clicking a button or checkbox).
A client may withdraw consent to the use and disclosure of personal information at any time, unless the personal information is necessary for us to fulfill our legal obligations. We will respect your decision, but we may not be able to provide you with certain products and services if we do not have the necessary personal information.
We may collect, use or disclose client personal information without consent only as authorized by law. For example, we may not request consent when the collection, use or disclosure is reasonable for an investigation or legal proceeding, to collect a debt owed to our organization, in an emergency that threatens life, health or safety, or when the personal information is from a public directory.
How do we use and disclose personal information?
We use and disclose client personal information only for the purposes for which the information was collected, except as authorized by law. The law also allows us to use that contact information for the purpose of collecting a debt owed to our organization, should that be necessary.
- Contact information may be disclosed to:
- third-party health benefit providers/insurers when reimbursement claims for all or part of the treatment cost have been submitted.
- Health information may be disclosed to:
- third-party health benefit providers/insurers when reimbursement claims for all or part of the treatment cost have been submitted.
- WCB or your employer if you made a WCB claim.
- other health-care professionals also providing you with treatment.
- your lawyer, if you were injured in an accident.
- research teams in an anonymous form to facilitate outcome research.
- Financial information may be disclosed to:
- your insurer or credit card company as required to facilitate payment.
If we wish to use or disclose your personal information for any new business purpose, we will ask for your consent.
How do we safeguard personal information?
We make every reasonable effort to ensure that client information is accurate and complete. We rely on our clients to notify us if there is a change to their personal information that may affect their relationship with our organization. If you are aware of an error in our information about you, please let us know and we will correct it on request wherever possible.
We protect client personal information in a manner appropriate for the sensitivity of the information. We make every reasonable effort to prevent any loss, misuse, disclosure or modification of personal information, as well as any unauthorized access to personal information.
We will notify the Office of the Information and Privacy Commissioner of Alberta, without delay, of a security breach affecting personal information if it creates a real risk of significant harm to individuals.
We are required by professional association regulations and provincial legislation to keep records containing personal information for 10 years from the last date of service. If the client was under the age of 18 at the time of their last visit, records are retained for 10 years from the client’s 18th birthday.
We render client personal information non-identifying, or destroy records containing personal information once the information is no longer needed. We use appropriate security measures when destroying client personal information, including shredding paper records and permanently deleting electronic records.
We employ the following technical, administrative and physical safeguards:
Technical
- Our website backbenimble.ca is protected by an SSL certificate which allows visitors to browse safely and securely.
- Our client management software at clients.mindbodyonline.com is protected by advanced security protocols and is PCI compliant. For more information, please visit https://company.mindbodyonline.com/legal/security-policy
- We use a fax transmission service that is HIPAA compliant and has enhanced security and encryption features specifically for health clinic applications
- We store electronic records on secured hardware, use antivirus software and passwords on all computers and take care to protect screen monitors from public viewing.
Administrative
- We train staff to handle your information only through the protected measures outlined in our privacy procedures. If consultants or contractors are hired, we take steps to ensure the consultant or contractor also protects your privacy.
- We conduct telephone discussions with sensitivity to ensure that your personal information is not inadvertently disclosed.
- We do not share your personal information outside our office for any marketing, promotional, publicity, educational, or research purposes without your consent.
Physical
- We store physical records containing your personal information in a secure place.
- We transfer physical records outside our office in sealed envelopes by secure methods.
- Any documents containing personal information are shredded using a high-security, micro-cut shredder, once they are no longer needed.
- Any computer hardware that is discarded has the hard drive removed and destroyed.
Access to records containing personal information
Clients of Back Be Nimble Massage & Wellness Centre have a right of access to their own personal information in a record that is in our custody or under our control, subject to some exceptions. For example, organizations are required under the Personal Information Protection Act to refuse to provide access to information that would reveal personal information about another individual. Organizations are authorized under the Act to refuse access to personal information if disclosure would reveal confidential business information. Access may also be refused if the information is privileged or contained in mediation records.
If we refuse a request in whole or in part, we will provide the reasons for the refusal. In some cases where exceptions to access apply, we may withhold that information and provide you with the remainder of the record.
You may make a request for access to your personal information by contacting our Privacy Officer, whose contact information is listed at the end of this Privacy Statement. You must provide sufficient information in your request to allow us to identify the information you are seeking.
You may also request information about our use of your personal information and any disclosure of that information to persons outside our organization. For personal information collected before January 2004, if we do not have a record of disclosures, we will provide information about any disclosure of your information that is likely to have occurred.
You may also request a correction of an error or omission in your personal information.
We will respond to your request within 45 calendar days, unless an extension is granted. We may charge a reasonable fee to provide a copy of your personal record, but not to make a correction. We will advise you of any fees that may apply before processing your request.
Questions and concerns
If you have a question or concern about any collection, use or disclosure of personal information by Back Be Nimble Massage & Wellness Centre, or about a request for access to your own personal information, please contact:
Clare Morgan, Privacy Officer
Back Be Nimble Massage & Wellness Centre
#101, 1921 – 91 Street SW
Edmonton, Alberta T6X 0W8
Phone: 780-466-0027
Email: contactus@backbenimble.ca
If you are not satisfied with the response you receive, you should contact the Information and Privacy Commissioner of Alberta:
Office of the Information and Privacy Commissioner of Alberta
Suite 2460, 801 - 6 Avenue, SW
Calgary, Alberta T2P 3W2
Phone: 403-297-2728
Toll Free: 1-888-878-4044
E-mail: generalinfo@oipc.ab.ca
Website: www.oipc.ab.ca