Healthcare in Metcalfe

Privacy Policy

How we protect the personal information people share with us

Last updated: July 28, 2026

1. Purpose and Commitment

Healthcare in Metcalfe (“HiM,” “we,” “us”) is a volunteer-led, non-profit corporation registered under the Ontario Not-for-Profit Corporations Act, 2010 (ONCA), working to improve access to primary health care in Metcalfe and the surrounding area. To do this work, we keep a contact list of residents, health professionals, partners, donors and volunteers who want to stay involved or support the cause.
We take the trust behind that information seriously. This policy explains, in plain language, what personal information we collect, why we collect it, how we use and protect it, and the choices and rights people have. We have built this policy around the fair-information principles set out in Canada’s federal privacy law (PIPEDA), which we adopt as our standard of good practice.

2. HiM's role — and why we do not collect health information

HiM is an advocacy and organizing group, not a health-care provider. We do not run a clinic, deliver care, book appointments, or take part in any clinical or health-related matter. Our work is things like building community support, working with partners, tracking demand for services, and helping bring a satellite family medicine office to Metcalfe.
Because that is our role:

HiM does not ask for or intentionally collect personal health information. We do not hold patient records, health histories, diagnoses, health-card numbers, appointment details, or anything similar. That information should be provided only to the applicable physician or health-care provider.

This is a deliberate boundary, not an oversight. By staying entirely out of the custodian role, HiM protects people’s most sensitive information and keeps its own responsibilities clear and simple. The only information we handle is the basic contact information described in this policy — and we never need health information to do our work.

3. Definitions

Personal information — information about an identifiable individual, such as a name, email address, mailing address or postal code.
Personal health information — information about a person’s health, health history or health care. HiM does not collect or hold this type of information (see Section 2).
Consent — a person’s agreement to HiM collecting and using their information. Consent may be express (clearly given, for example by signing up or opting in) or implied (reasonably understood from the circumstances).
Aggregate / de-identified information — combined totals or general figures (for example, the number of supporters in a postal-code area) that cannot identify any individual.

4. The principles we hold ourselves to

HiM follows the ten fair-information principles. In short, we are:

Accountable — a designated privacy contact is responsible for this policy and our compliance with it.
Clear about purposes — we identify why we collect information at or before the time we collect it.
Consent-based — we collect, use and share information with people’s knowledge and consent, which they can withdraw.
Sparing — we limit collection to what we actually need.
Purpose-limited — we use and keep information only for the purposes it was collected for.
Accurate — we keep information as correct and up to date as is reasonable.
Protective — we safeguard information with security appropriate to its sensitivity.
Open — we make this policy and our practices available to anyone who asks.
Accessible — people can ask what we hold about them and request corrections.
Answerable — people can challenge our compliance and raise concerns with us.

5. What information we collect

We collect only basic contact information, and only what a person chooses to give us — for example, when they join our contact list, sign up at a community meeting or the Farmers’ Market, complete a form, or get in touch with us. This usually includes:

Name
Email address
Mailing address or postal code
The person’s role or organization, where relevant (for example, a health professional or a partner agency)
Communication preferences, including whether the person wants updates, volunteer information or fundraising requests

Providing a mailing address or postal code is optional. We ask for it because knowing roughly where our supporters live helps us understand and demonstrate how much a local health-care centre would benefit the community. We do not need — and never ask for — any health information.

6. Why we collect it and how we use it

We use the contact information we collect to:

keep interested residents informed about our work and progress;
build and maintain relationships with health professionals and partner agencies;
understand and demonstrate community need — including how many people, and which areas, would benefit from a local health-care centre. When we report this to funders, government or partners, we use only aggregate, de-identified figures (such as totals and general areas), and never identify individuals;
coordinate volunteers;
acknowledge and thank donors; and
carry out the activities in our Strategic Plan.

We use information only for the purposes for which it was provided. We ask for a person’s express consent before using their contact information for fundraising, and every email update includes a simple way to unsubscribe.

7. How we obtain consent

We collect personal information directly from the person, with their knowledge and consent. People share their information in different ways — by signing up at an event, completing a form, or contacting us. By providing their information and selecting the applicable options, they consent to HiM using it for the purposes selected.
Consent can be withdrawn at any time. Anyone can ask to be removed from our lists or to stop receiving messages, and we will act on that request promptly.

8. How we share information

HiM does not sell, rent or trade personal information — ever. We share personal information only:

with the person’s consent;
with trusted service providers who help us operate (for example, an email newsletter service), who are expected to protect it and use it only on our behalf; or
where we are required to by law.
We do not share identifiable contact information with any physician or health-care provider. Where it is useful to show community support to partners, funders or government, we share only aggregate, de-identified information that cannot identify any individual.

9. How we store and protect information

HiM’s contact list is kept in a shared Google Drive as its central record. Any temporary or paper copies are securely stored and destroyed when no longer needed. The Board Secretary is responsible for this information and controls access to it, limiting access to only the directors and volunteers who need it for their roles and removing access promptly when a person’s role with HiM ends.
We protect this information with reasonable safeguards, including access controls and strong passwords. Some of our service providers may store information on servers located outside Ontario or Canada, where it may be subject to the laws of those places. We choose reputable providers and take reasonable steps to ensure information is protected wherever it is held.

10. How long we keep information

We keep personal information only as long as it serves the purpose it was collected for — generally, for as long as a person wishes to stay on our contact list and remain involved with HiM. When information is no longer needed, or when a person asks us to remove it, we dispose of it securely.

11. Your rights

You have the right to:

ask what personal information HiM holds about you;
ask us to correct information that is wrong or out of date;
withdraw your consent and ask to be removed from our lists; and
unsubscribe from our emails at any time.

To make any of these requests, contact our privacy contact (Section 12). We will respond within a reasonable time and at no cost for routine requests.

12. Privacy contact and complaints

The Board Secretary is HiM’s designated privacy contact, responsible for this policy, for the security of and access to our contact list, and for answering questions and concerns:

Board Secretary — sarahcoopergodoy@gmail.com. If you have a concern about how HiM has handled your personal information, please raise it with our privacy contact first so we can try to resolve it. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

13. If something goes wrong (privacy breach)

If personal information is lost, stolen, or accessed by someone who should not have it, HiM will act quickly to:

contain the breach;
assess what happened and how serious it is;
notify the people affected where there is a real risk of significant harm;
record the incident; and
take steps to prevent it from happening again.

14. Changes to this policy and review

The Board of Directors reviews this policy at least once a year, normally at its January Annual Meeting, and updates it as HiM’s activities change. The current version and its date are shown at the top of this document. We make this policy available to anyone who asks.