Privacy

What we know about you, and why.

We hold health information about people who are often not able to advocate for themselves. This page explains what we collect, who sees it, and how to get it back or corrected.

Last updated [DATE]. Applies to findingdora.ca and to every service Finding Dora Senior Care Services provides.

Before publishing. This is a working draft, not legal advice. Have an Alberta privacy lawyer review it, and fill every [PLACEHOLDER]. Two items need a real decision rather than a fill-in: whether any of your records fall under Alberta’s Health Information Act because of your CDHCI relationship, and whether any of your service providers store data outside Canada, which Alberta’s PIPA requires you to disclose specifically.

Who we are

Finding Dora Senior Care Services, [LEGAL ENTITY NAME], [ADDRESS], Edmonton, Alberta. We provide in-home care to seniors across Edmonton and surrounding communities.

Our privacy officer is [NAME, ROLE]. Reach them at [EMAIL] or [PHONE]. Alberta’s Personal Information Protection Act requires every organisation to designate one, and to name them on request. Any question, complaint or request about your information goes to that person.

The law we work under

Alberta’s Personal Information Protection Act (PIPA) governs how private organisations in this province collect, use and disclose personal information. Where we handle information that crosses provincial or national borders, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply.

[LEGAL REVIEW REQUIRED: Alberta’s Health Information Act applies to designated custodians and their affiliates. A private home care agency is generally not a custodian, but a contracted relationship under Client Directed Home Care Invoicing may change how some records are treated. Confirm this before publishing and adjust this paragraph rather than deleting it.]

What we collect

If you enquire

Your name, phone number, email if you give it, the community you are in, and whatever you tell us about the situation. We keep enquiries that do not become clients for [X MONTHS], then delete them.

If you become a client

Considerably more, because we cannot care for someone safely without it:

Name, address, date of birth, phone, emergency contacts
Health information: diagnoses, medications, allergies, mobility, continence, cognition, dietary needs, and the name of the family doctor
The care plan, and visit notes written by caregivers after each shift
Incidents, falls and near misses
Payment details, and invoices
Where funded care applies, your Alberta personal health number, your Alberta Blue Cross information, and correspondence with your case manager
Home access details such as a key code or lockbox, and who else has access

If you apply to work here

Application materials, references, certification and registration details, police check with vulnerable sector search, and the records employment law requires us to keep.

When you use this website

[Confirm and edit to match what you actually run.] Standard server logs, and whatever the contact form captures. [If you use analytics, name the tool and say whether IP addresses are anonymised. If you keep loading web fonts from a third party, say so — it transmits the visitor’s IP address to that provider. Self-hosting the fonts removes the disclosure and is the simpler answer.]

We do not sell information to anyone, we do not run advertising, and we do not build profiles of visitors.

Why we collect it

To assess whether we can meet someone’s needs, and to write a care plan
To deliver care safely, and to brief the caregiver who attends
To match a caregiver to a client, including on language and on fit
To bill, and where applicable to invoice Alberta Blue Cross
To respond in an emergency
To meet employment, insurance, tax and regulatory obligations
To improve how we work, using information that no longer identifies anyone

We collect only what those purposes need. If we later want to use information for something else — a case study, a photograph, a testimonial — we ask first, separately, in writing.

Consent

We ask for express, written consent before care begins, and health information is never collected on implied consent alone.

Where a client cannot consent for themselves, we take direction from the person with legal authority — an agent under a personal directive, a guardian, or a trustee — and we ask to see the document.

You can withdraw consent at any time by telling your care manager or the privacy officer. Some withdrawals mean we can no longer provide care safely, and we will say so plainly rather than continuing on a plan we cannot deliver. Withdrawal does not apply retroactively to records we are legally required to keep.

Who sees it

As little as the job allows.

Your caregiver and care manager. Caregivers see what they need to care for you safely, not the whole file.
Alberta Blue Cross and Assisted Living Alberta, where funded care or CDHCI is involved, for assessment and billing.
Family members, only those the client has named, and only to the extent the client agreed.
Emergency responders and health providers, where someone’s health or safety is at risk.
Service providers who work for us — [scheduling and care software, payroll, accounting, IT support, website host]. They are bound by contract to protect it and to use it only for the work we hired them for.
Where the law requires it, including a lawful order, or a report we are obliged to make where an adult is at risk of abuse or neglect.

We do not disclose information to anyone else without consent.

Information stored outside Canada

[REQUIRED BY PIPA IF IT APPLIES. If any provider — scheduling software, email, backups, form handler, website host — stores or processes data outside Canada, you must say so here, name the countries, explain why, and give the privacy officer as the contact for questions about it. If everything is hosted in Canada, say that instead: it is a genuine selling point with this audience.]

How we protect it

Access limited to staff who need it for their role
Encrypted devices and accounts, with multi-factor authentication
Caregivers do not keep client information on personal devices beyond the scheduling app, and paper notes come back to the office
Confidentiality agreements signed by every employee, and privacy training at orientation
Locked storage for paper files
[Breach response: who is told, how quickly. PIPA requires reporting a breach to the Alberta Information and Privacy Commissioner where there is a real risk of significant harm, and notifying affected individuals as directed.]

How long we keep it

Enquiries that do not become clients: [X months]
Client care records: [X years] after care ends [confirm against your insurer’s and your professional colleges’ requirements, which are usually the longest]
Financial records: as required by the Canada Revenue Agency
Unsuccessful job applications: [X months]
Employee records: [X years] after employment ends

PIPA requires us to keep information used to make a decision about you for at least one year, so you have a reasonable chance to ask for it.

Your rights

You can ask to see your file. Write to the privacy officer. We respond within 45 days, as PIPA requires, or tell you why we need longer. There may be a reasonable fee for a large request, and we will quote it before starting.

You can ask us to correct it. If something is wrong, tell us and we will fix it, or note your disagreement on the record if we do not agree.

You can complain. Start with our privacy officer at [EMAIL]. If you are not satisfied with the answer, you can take it to the Office of the Information and Privacy Commissioner of Alberta, oipc.ab.ca, 1-888-878-4044. You do not have to come to us first, and using our process does not affect your right to go to them.

We will not treat anyone differently for asking a privacy question or making a complaint.

Photographs, testimonials and reviews

We do not photograph clients or use anything they said without separate written consent, given after care has been going for a while rather than at intake. Consent can be withdrawn, and we will take the material down.

Changes

If we change this policy we will update the date at the top. Where a change is significant and affects current clients, we will tell them directly rather than relying on them to notice.

Contact

[NAME], Privacy Officer
Finding Dora Senior Care Services
[ADDRESS], Edmonton, Alberta [POSTAL CODE]
[EMAIL] [PHONE]