Privacy Policy

1. About This Privacy Notice

This Privacy Notice explains how personal information is collected, used, disclosed, stored and otherwise processed in connection with UHN Protocols.

“ProtologiQ” means ProtologiQ Corp., the company that owns and operates UHN Protocols and provides the underlying software, technical infrastructure, maintenance, support and related services.

“UHN Protocols” means the software application and related services owned and operated by ProtologiQ, including the UHN Protocols website, the UHN Protocols mobile applications for iOS and Android, and the related software, databases, infrastructure, systems and functionality through which the service is provided.

“Participating Department or Program” means a department, program, division, service or other organizational unit that separately subscribes to UHN Protocols under an agreement with ProtologiQ and is authorized to use UHN Protocols and/or make Content or functionality available through it.

Current Participating Departments or Programs include the Department of Thoracic Surgery, Toronto General Hospital, University Health Network (“UHN”) and the Toronto Lung Transplant Program, Toronto General Hospital, UHN.

Other departments, programs, divisions, services or organizational units may become Participating Departments or Programs in the future by entering into their own applicable subscription or licence agreement with ProtologiQ.

Each Participating Department or Program has its own subscription or licence, Content, Users, permissions and authorized functionality. Participation by one Participating Department or Program does not provide another department, program or organizational unit with access to UHN Protocols or to that Participating Department or Program’s Content or functionality unless separately authorized.

This Privacy Notice applies to personal information processed through UHN Protocols, whether UHN Protocols is accessed through its website, an iOS or Android mobile application, or another interface or functionality made available by ProtologiQ.

2. Personal Information We May Collect

Depending on how you use UHN Protocols, personal information may include:

  • name and contact information;
  • account identifiers and login-related information;
  • department, program, organization or institutional affiliation;
  • role, appointment, training level or professional information;
  • account permissions and access status;
  • learning records, journal entries and User-created learning notes;
  • information relating to leave requests and scheduling;
  • application information;
  • curricula vitae, letters of recommendation and other application documents;
  • communications with support personnel;
  • payment and transaction-related information where paid functionality is offered;
  • device, browser, network and security information;
  • timestamps and audit information;
  • records of account, Content and feature activity; and
  • other information provided through authorized UHN Protocols functionality.

UHN Protocols is not generally intended to collect patient personal health information. Users must not enter patient-identifying information or patient personal health information into functionality that has not been expressly designed and authorized for that purpose.

3. How Personal Information Is Used

Personal information may be used to:

  • create, authenticate and manage accounts;
  • determine and administer access permissions;
  • provide Content and functionality;
  • support educational and training activities;
  • maintain learning records;
  • allow authorized Supervisors to review learning information where applicable;
  • submit, review and manage leave requests;
  • operate shared calendars and scheduling functions;
  • receive and manage applications;
  • communicate with Users and applicants;
  • provide technical support;
  • troubleshoot access or functionality;
  • administer subscriptions or paid access where applicable;
  • maintain Platform security;
  • detect and investigate misuse or unauthorized access;
  • maintain audit records;
  • maintain, improve and support UHN Protocols;
  • comply with legal, regulatory, contractual and institutional requirements; and
  • establish, exercise or defend legal rights where appropriate.

Personal information will not be used for purposes unrelated to UHN Protocols or the applicable Participating Department or Program’s authorized activities unless permitted or required by law.

4. Roles of Participating Departments or Programs and ProtologiQ Corp

Each Participating Department or Program determines the purposes for which personal information is collected and used in connection with the Content and functionality that it provides through UHN Protocols, subject to applicable law and its agreement with ProtologiQ Corp.

This may include decisions concerning:

  • who is authorized to use its Content or functionality;
  • educational and training activities;
  • Supervisor access;
  • leave administration;
  • scheduling;
  • applications and selection processes; and
  • other department- or program-specific activities.

ProtologiQ Corp. owns and operates UHN Protocols and provides the technical services required to deliver the service.

Depending on the applicable agreement, ProtologiQ Corp’s services may include hosting and maintaining the Platform, technical support, routine software maintenance, minor Content updates, schedule updates, user-access administration and troubleshooting of access or functionality.

In providing these services, ProtologiQ Corp. may process personal information on behalf of a Participating Department or Program.

ProtologiQ Corp. may also process information for purposes for which ProtologiQ Corp. itself is responsible, including Platform security, technical operations, account authentication, service administration and compliance with legal obligations applicable to ProtologiQ Corp.

ProtologiQ Corp’s technical administration of an account or permission does not, by itself, mean that ProtologiQ Corp. determines whether an individual is institutionally eligible to receive access.

5. Separate Participating Departments and Programs

Access to UHN Protocols is permission-based.

Authorization by one Participating Department or Program does not automatically authorize access to information, Content or functionality associated with another Participating Department or Program.

For example, a User authorized by the Department of Thoracic Surgery, Toronto General Hospital, UHN does not automatically have access to information or functionality made available by the Toronto Lung Transplant Program, Toronto General Hospital, UHN.

Similarly, affiliation with Toronto General Hospital, UHN does not, by itself, provide access to UHN Protocols or to any particular Participating Department or Program’s environment.

Personal information associated with one Participating Department or Program will be accessible to another Participating Department or Program only where such access is authorized and appropriate.

6. Learning Information and User-Created Notes

UHN Protocols may collect educational activity information, records of practical learning experiences, journal entries, progress information and User-created learning notes.

Where applicable, authorized Supervisors may be permitted to review learning records or User-created notes.

Access is controlled according to the permissions associated with the applicable Participating Department or Program.

Users should not include patient-identifying information or patient personal health information in learning notes or journals unless a specific feature has been expressly approved for that purpose.

If a learning-note feature is modified or discontinued, previously created information may continue to be retained where required or permitted by applicable legal, institutional, contractual or records-management requirements.

7. Leave Information

UHN Protocols may collect information when a User submits or manages a request for leave or another absence.

This may include:

  • the User’s identity;
  • requested dates;
  • type or category of leave where applicable;
  • information entered into the request;
  • request status;
  • reviewer information;
  • submission and modification timestamps;
  • approval or decline information; and
  • related audit records.

Authorized Supervisors, department heads or other designated individuals may access this information for leave administration and operational planning.

Where leave information is displayed through a shared calendar, the information displayed should be limited to what is reasonably necessary for scheduling and coordination.

Detailed or sensitive reasons for leave should not be displayed to a group unless necessary, authorized and permitted by applicable law and policy.

ProtologiQ Corp. may process leave information to provide and support the technical functionality but does not make substantive leave decisions unless expressly authorized to do so.

8. Application Information

UHN Protocols may collect information from individuals applying for positions, fellowships, training opportunities or other programs.

Application information may include:

  • name and contact information;
  • education, professional qualifications and experience;
  • curricula vitae;
  • letters of recommendation;
  • statements and supporting documents;
  • application responses;
  • interview or review information;
  • application status;
  • communications; and
  • related administrative and audit records.

Application information may be made available to individuals authorized by the applicable Participating Department or Program to administer or evaluate the application process.

ProtologiQ Corp. processes this information to provide and support the application functionality but does not make substantive selection, fellowship, hiring or appointment decisions unless expressly authorized to do so.

9. Retention of Personal Information

Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, contractual, institutional and records-management requirements.

Retention periods may differ according to the type of information and the Participating Department or Program involved.

For example:

  • information relating to an active application may be retained throughout the application and selection process;
  • unsuccessful application records may be retained for a defined period following the final decision in accordance with the applicable retention policy;
  • records relating to successful applicants may be transferred or retained as necessary for appointment, training, fellowship, credentialing or employment administration;
  • learning records and existing User-created notes may be retained in accordance with applicable educational or institutional requirements;
  • leave records may be retained in accordance with applicable employment, appointment, fellowship, training or program requirements; and
  • audit, security and technical logs may be retained for security, operational, compliance and investigative purposes.

ProtologiQ Corp. and Participating Departments or Programs may have different retention responsibilities depending on the applicable information and their respective roles.

When information is no longer required, it will be securely deleted, anonymized or otherwise disposed of in accordance with applicable requirements.

10. Safeguards

ProtologiQ Corp. uses administrative, technical and physical safeguards appropriate to the nature of the information processed through UHN Protocols.

These measures may include:

  • authentication and access controls;
  • role-based permissions;
  • encryption where appropriate;
  • logging and monitoring;
  • secure development and maintenance practices;
  • backups and recovery measures;
  • system and security updates; and
  • processes for investigating suspected privacy or security incidents.

Participating Departments or Programs are responsible for appropriate management of their own Users, permissions and information within their control.

Users are also responsible for protecting their passwords and devices and for reporting suspected unauthorized activity.

No electronic system can be guaranteed to be completely secure, but reasonable safeguards will be maintained in accordance with applicable requirements.

11. Audit and Activity Information

UHN Protocols may create audit and activity records relating to account and Platform use.

These records may include:

  • login and authentication activity;
  • access to particular functionality;
  • submission and modification timestamps;
  • Content changes;
  • user-access changes;
  • leave-request actions;
  • application activity;
  • administrative actions; and
  • security events.

Audit information may be used for security, support, troubleshooting, accountability, investigation, dispute resolution, compliance and records-management purposes.

For example, timestamp and status information may be used to determine when a leave request was submitted, modified, reviewed, approved or declined.

12. Patient Personal Health Information

UHN Protocols is not intended for the entry, storage or communication of patient personal health information unless a particular function has been expressly designed, approved and authorized for that purpose.

Users must not enter patient-identifying information or patient personal health information into general notes, journals, free-text fields, applications, leave requests or other functionality not expressly designated for that information.

Where appropriate, UHN Protocols may provide field-level warnings reminding Users not to enter patient information.

If patient personal health information is inadvertently entered into UHN Protocols, Users should report the matter promptly through the applicable privacy or support process so that appropriate action can be taken.

13. Service Providers

ProtologiQ Corp. may use service providers to support the operation of UHN Protocols, such as providers of hosting, infrastructure, security, communications, support, payment processing or related services.

Service providers may process personal information only as necessary to provide the applicable services and subject to appropriate contractual and security requirements.

Where payment functionality is offered, payment information may be processed directly by a third-party payment provider. UHN Protocols should identify the relevant payment provider and applicable privacy terms at the point of payment where appropriate.

14. Storage and Processing Locations

Personal information may be stored or processed in locations used by ProtologiQ Corp. or its authorized service providers.

Where information is stored or processed outside Ontario or outside Canada, it may be subject to the laws of the jurisdiction in which it is processed.

ProtologiQ Corp. and Participating Departments or Programs will address storage and processing requirements in accordance with applicable law, contractual commitments and institutional requirements.

15. Access and Correction

Individuals may have rights under applicable law to request access to or correction of personal information about them.

The appropriate contact will depend on the information involved and the respective responsibilities of ProtologiQ Corp. and the applicable Participating Department or Program.

Requests concerning substantive department or program records, including application, leave or educational records, may need to be directed to the applicable Participating Department or Program or its institution.

Requests concerning ProtologiQ Corp. account, technical or operational records may be directed to ProtologiQ Corp. where appropriate.

Identity verification may be required before a request is processed.

Certain information may be exempt from access or correction rights where permitted or required by law.

16. Privacy Questions, Concerns and Incidents

Privacy questions or concerns concerning the activities of a particular Participating Department or Program should generally be directed to that Participating Department or Program or the applicable institutional privacy office.

Questions concerning ProtologiQ Corp’s operation of UHN Protocols, Platform security or ProtologiQ Corp’s handling of personal information may be directed to ProtologiQ Corp.

Suspected unauthorized access, inappropriate disclosure or other privacy or security incidents should be reported promptly through the designated process.

ProtologiQ Corp. and the applicable Participating Department or Program may cooperate in investigating and responding to a privacy or security incident according to their respective responsibilities.

17. Changes to This Privacy Notice

This Privacy Notice may be updated from time to time to reflect changes to UHN Protocols, participating services, privacy practices or applicable requirements.

Where changes are material, reasonable notice may be provided through UHN Protocols, by email or by another appropriate method.

The effective date of the current Privacy Notice should be displayed with the published version.

18. Contact Information

For questions concerning UHN Protocols’s technical operation or ProtologiQ Corp’s privacy practices:

ProtologiQ Corp
Client Support
319-192 Spadina Ave, Toronto, ON M5T 2C2
privacy@protocols.me

For questions about Content, applications, leave information, educational records, access eligibility or other activities administered by a Participating Department or Program, contact the applicable Participating Department or Program or the appropriate privacy office for that organization.