Privacy Policy
Our Commitment to Privacy
Privacy is highly important to us. This Privacy Policy (this “Policy”) sets out the key elements of how we address the privacy and security of information entrusted to us by our customers through their access and use of the PointClickCare electronic health record platform (the “Services”), as well as the privacy of information entrusted to us by business partners, prospects and others who seek information and/or contact us through www.pointclickcare.com, blog.pointclickcare.com, and summit.pointclickcare.com (individually, collectively, and including any subdomains, the “Site”). The Site can be used and accessed by the public as a source of general information about PointClickCare. Our customers and business partners also can access the Services via the Site.
As privacy laws and practices evolve, we will amend this Policy from time to time. While we will endeavor to give reasonable notice of such changes, we do reserve the right, where necessary, to do so without prior notice.
What is considered private?
Information that is used by a government authority, financial institution or insurance carrier to distinguish a person from other individuals ( e.g., social security number, social insurance number, credit card information, or insurance policy number) is private. Such information can be used to identify an individual (e.g., a person who works at a healthcare facility, or a resident or patient in a healthcare facility). Certain information may be used to contact a person directly (e.g., an email address, home mailing address or telephone number). Depending on the jurisdiction, the above identifiers are considered to be Personal Information (“PI”), Personally Identifiable Information (“PII”), Sensitive Personal Information (“SPI”) or a similar term, and it is private. An individual’s business contact information and business title generally are exempt from privacy laws. Information about an individual’s health, including insurance and billing information, is also considered – depending on the jurisdiction – to be PI, Protected Health Information (“PHI”), Personal Health Information (also known as “PHI”), Individually Identifiable Health Information (“IIHI”) or a similar term, and it also is private. In Canada and the United States, the laws that primarily govern how we deal with the PI, PII, SPI, PHI and IIHI which you provide to us in relation to the Services are listed in Table 1.
For the remainder of this Policy, we will refer to all PI, PII, SPI, PHI, IIHI, and “Health Information” as “Personal Information” unless we specifically note otherwise. If we wish to refer only to information about a specific individual’s health but not to other forms of Personal Information, we will refer to “PHI.”
This Policy also will apply to non-personal information if such information can be used in combination with other Personal Information or non-personal information to identify an individual.
Please be aware that this Policy only covers information manually submitted to, or automatically collected by, us through use of the Site and/or the Services. If you contact or exchange information with another PointClickCare customer or business partner in person or through a means other than through the Site or Services, such activity is not covered by this Policy. Additionally, if you are not a customer or a business partner of PointClickCare by way of written agreement, and are contacting us out of interest in the Services, a business partnership or a job opportunity, please be aware that the information that you share with us is not covered by this Policy, unless required by law.
Personal Information Collected by the Services
There are two ways Personal Information can be submitted to us. The first is through direct submission or what we call ‘Manual Submission’ and the second is by way of ‘Automatic Submission’ triggered by any interaction with the Site through a computer, Point of Care station, mobile device or tablet.
Manual Submission
Personal Information can be submitted to us directly when you communicate with us offline (in person or by telephone), via email or via the Site (by entering data or uploading files) or when you authorize PointClickCare to access, retrieve and/or import Personal Information from another user or third party on your behalf. Additionally, if you become a customer of PointClickCare, you will be required to register by submitting Personal Information via the Services, email or offline. This could include name, email address, mailing address, telephone number(s) and other contact and billing information.
Automatic Submission
Whenever your computer, mobile device or tablet visits, logs in or otherwise interacts with the Site, we gather data from your device and the operating software of your device transmits a ‘request’ to us. That request includes non-personal information that is necessary to identify and route the information your device is requesting. This communication is necessary for all website and Internet services.
We also use cookies (sometimes referred to as “web beacons” or “server logs”). Cookies are files that web browsers place on a computer’s hard drive that tell us whether customers or visitors have been to the Site previously, and they often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit www.allaboutcookies.org. Data collected using cookies can include:
- Date and time a ‘request’ is transmitted through the Site
- The model of the device making the request
- The type and version of the operating software running on the device
- The web browser used on the device and making the request
- IP addressGeographic location
- Time zone
- Search terms used
- URLs visited
- Information about some of the cookies that are installed on your computer, mobile device or tablet
- Internet service provider
- Previous activity on the Site
Additionally, we use Google Analytics to track and analyze page usage behavior to improve performance in the use of the Services and the Site. We use this to track only what page you are clicking on, and do not use it to track any Personal Information. You can read more about how Google uses your Personal Information here. You can also opt-out of Google Analytics here.
Please note that we do not alter our Site’s data collection and use practices when we see a Do Not Track signal from your browser. For greater clarification, while our data collection practices won’t be altered, they also won’t be applied in situations where you have prevented the tracking from occurring.
Purpose
PointClickCare is a cloud-based Software-as-a-Service (SaaS) platform designed to help long-term, post-acute care providers manage both clinical and financial aspects of residents and patients in their care and to connect PointClickCare customers with a variety of related healthcare networks and service providers. We primarily collect Personal Information as necessary to communicate with you and/or to provide the Services. Some Personal Information (but not PHI) also may be collected for marketing and sales purposes (e.g., if you complete a form to register for a webinar or download content, or if you visit a part of our Site where we deploy cookies from LinkedIn, Facebook, Twitter, etc. [in which case, their privacy policies will apply]).
Personal Information and non-personal information may be used for the following reasons:
- to register customer accounts
- to contact customers to discuss their experience with the Services, current and future needs as a customer, or to communicate future
- promotions or special events which might benefit them
- to contact a prospective customer
- to provide our cloud-hosted SaaS Services
- to operate, maintain, manage and administer the Services, including processing registrations and payments, and diagnosing technical problems
- to respond to questions and communications
- to make service or administrative announcements to customers about unscheduled downtime or new features, services, products, functionality, terms, or other aspects of the Services
- to perform audits, research, measurements and analyses in an effort to maintain, administer, support, enhance and protect the Services, including determining usage trends and patterns and measuring the effectiveness of content, advertising, features or services
- to create new features, products or services
- to contribute to certain health and medical research (only non-personal information will be used)*
- to provide benchmarking and performance tracking solutions*
* We may track and analyze non-identifying, aggregate usage, and volume statistical information from our visitors and customers and may provide such information to third parties. We are committed to ensuring privacy and protecting Personal Information. We also are committed to providing valuable insights and analytics to enable better performance and quality.
Personal Information and non-personal information may be used for the following reasons:
- saving user preferences
- preserving session settings and activities
- providing limited auto-fill functionality for those who use the Services frequently
- analyzing various features and content of the Services
Cookies
PointClickCare uses a persistent cookie to help save and retrieve org codes for a user who has accessed the Services. We issue a session cookie [1] only to record encrypted authentication information for the duration of a specific session. The session cookie does not include the username or password of a customer. For user convenience, in relation to touchscreen logins, we also use a non-session-based cookie to store a user’s ID; however, this is configurable. We do not store passwords in session cookies, persistent cookies or headers. If a cookie is rejected, access to and usage of the Services will be denied. The Site uses cookies and other tracking technology to give you the best user experience. For information on how to turn your cookies off, please click here. For information on the types of cookies we use, please access Marketo’s privacy policy and Google’s privacy policy.
We will never sell your Personal Information (or non-personal information if it can be used in any way to identify you).
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for operational, statutory/regulatory or other legal reasons.
Support, Education Services and Purchase Orders
Personal Information collected through the Site may be accessed and used by PointClickCare to respond to customer requests for support, to provide education or consulting services and/or to confirm customer compliance with the terms of its purchase (as set forth in signed orders). This may include testing and applying new product or system versions, patches, updates and upgrades; monitoring and testing system usage and performance; and, resolving bugs and other issues which a customer reports to PointClickCare.
Personal Information collected for these purposes is only used for time periods relevant to fulfill such purposes.
PointClickCare Annual SUMMIT, Community Forums and Surveys
Many PointClickCare customers share their experiences of the Services, either at our annual SUMMIT or online via customer-driven Community Forums. During our annual SUMMIT, we may solicit testimonies of the Services or your relationship with PointClickCare, either as a customer or business partner. We will never use any such testimony, or video or audio footage, in conjunction with information that identifies you (or the organization you represent) without your express consent.
Community Forums are public and allow customers to communicate between each other and, possibly, with the general public. Any information posted within Community Forums is public and we recommend against any disclosure of Personal Information or other sensitive information that could be traced, directly or indirectly, to an individual.
From time to time, we may ask customers to complete surveys or ratings about the provision of the Services or of their own health care practices and operations. You should assume that the content of any Personal Information you provide would not be maintained in confidence. We will, however, tell you why we are collecting your responses and how they will be used. In completing such surveys, be mindful of what Personal Information is disclosed. We recommend against sharing any PI, PHI or other sensitive information that could be traced, directly or indirectly, to any individual.
Consent and Authorization
By visiting the Site, you are consenting to the use of your Personal Information for the aforementioned purposes. On occasion, we may request additional consent in connection with the use or sharing of Personal Information for a purpose not stated in this Policy or because the law requires such consent.
If you are a customer or business partner of PointClickCare, we will never use your Personal Information in a manner not otherwise provided for in our written contracts with you, authorization forms you provide to us, or this Policy.
Protecting Health Information
As a provider of hosted, electronic health record solutions, PointClickCare customers are health care providers and subject to laws and regulations governing the use and disclosure of PHI. In the United States, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health of 2009 (“HITECH”), along with the regulations adopted under those statutes, and similar state laws (where those laws are more stringent than HIPAA) govern the handling of PHI. In Canada, provincial laws govern the handling of PHI. See Table 1: Privacy Laws Applicable to the Services. Other laws may apply with respect to specific customers, as set forth in our contracts with those customers. Health care providers are considered to be Covered Entities under HIPAA and are subject to its rules regarding PHI. If a provider delegates some of its work to a third party, and that party must access PHI in order to perform the work, then such party is considered by HIPAA to be a Business Associate and is subject to the same rules regarding the protection of PHI as the Covered Entity. To enforce protection, HIPAA requires Covered Entities to execute a “Business Associate Agreement” or ”BAA” with each of its Business Associates. Our U.S.-based customers are required to sign a BAA with us. As a Business Associate, we are required to use reasonable and appropriate measures to safeguard the confidentiality, integrity and accessibility of PHI that is stored and processed on behalf of Covered Entities. Similarly, Alberta’s Health Information Act requires that our Alberta customers enter into an Information Manager Agreement (“IMA”) with us and, from time to time, we may enter into similar contracts with other Canadian customers, related to each party’s obligations to comply with applicable provincial privacy laws. From time to time, the terms of PointClickCare’s standard BAA, IMA and/or similar agreements may be posted on the Site.
HINP Notice (Ontario)
PointClickCare is a health information network provider (HINP) in Ontario. Health information custodians and individuals can read more about PointClickCare’s role and obligations as a HINP in this HINP Notice.
Sharing Your Personal Information
Third-Party Websites, Software and Services
Our Site contains links to third-party websites, software and services. Customers and visitors who access a linked website via the Site may be disclosing Personal Information. It is the responsibility of the user to keep Personal Information private and confidential. Additionally, we allow third-parties to offer services to our customers through integration with the PointClickCare cloud-based healthcare software provider (“Connected Services”). Customers’ use of Connected Services is optional. Customers that choose to use a Connected Service acknowledge and authorize the transmission of Personal Information to a third party. We are not responsible for, nor can we control, the privacy practices of third parties. A third party’s use, storage and sharing of your Personal Information is subject to its own privacy policies and not this Policy.
Business Reorganizations or New Management
There are two situations where we will need to share your Personal Information with a third party as a result of a business reorganization. The first situation concerns the acquisition of PointClickCare by a third party, and the second concerns the acquisition of our customers. A reorganization involves a sale, merger, transfer, exchange or other disposition of all or part of a business. If such a transaction occurs, be aware that your Personal Information may be made available to the acquiring party. If the reorganization concerns one of our customers, PointClickCare requires the parties participating in the sale to show written evidence of the completed transaction, or some alternate form of written authorization (by both the buyer and the seller), to transfer Personal Information hosted by the Services from the seller to the buyer. A change in management of a customer facility could involve similar authorization requirements, if data must be transferred from the prior management company to the new management company (or to the owner). We will not disclose your Personal Information to a party without sufficient and proper authorization from you, unless required by law.
Legal Procedures
We may need to preserve, use or disclose your Personal Information in response to a court order, subpoena, search warrant, judicial proceeding or other legal process, if we have a good faith belief that the law requires us to do so, or to otherwise protect our rights. Some legal procedures may prohibit or prevent us from notifying users, other individuals or entities identified in such procedures or may compel us to take measures otherwise in violation of this Policy or a written agreement you have with us.
Personal Information preserved as a result of legal procedures can be maintained for an indefinite period of time and for as long as we have a good faith belief that it is necessary and appropriate under the circumstances. These procedures may also involve your information; for example, if your contractual relationship with us has been terminated or disabled.
Security, Threats and Breach Notification
Our Services have physical, administrative and technical security measures in place to protect against the loss, misuse, unauthorized access and alteration of data and Personal Information under our direct control. When the Services are accessed using current browser technology, Secure Socket Layer (“SSL”) technology protects information using both server authentication and data encryption to help ensure that data is safe, secure, and available only to you. PointClickCare also implements an advanced security methodology based on dynamic data and encoded session identifications, and hosts the Services in a secure server environment which uses a firewall and other advanced technology to prevent interference or access from outside intruders. Unique user names and passwords also are required and must be entered each time a customer logs into the Services.
We are committed to educating our staff about the protection of Personal Information, and the importance of compliance with relevant privacy legislation and company policies. Employees and contractors are required to sign confidentiality agreements.
These safeguards help prevent unauthorized access, maintain data accuracy, and ensure the appropriate use of Personal Information; however, it is important to remember that no system can guarantee 100% security at all times. In the event that we detect a threat to security or a security vulnerability, we may attempt to contact you to recommend protective measures. Additionally, incidents of suspected or actual unauthorized handling of Personal Information are always directed to PointClickCare’s Legal & Compliance team, which is responsible for determining escalation and response procedures, depending on the severity and nature of the incident. Incidents involving unauthorized handling of PHI will be governed by relevant legislation and, where applicable, the provisions of a BAA, IMA or similar agreement with a customer. If PointClickCare determines that Personal Information has been misappropriated or otherwise wrongly acquired, PointClickCare will report such misappropriation or acquisition to you promptly.
For customers who purchase Connected Services, it is important to note that the third-party vendors that provide Connected Services to you may have different procedures in place to protect your Personal Information than the standards PointClickCare has implemented. We cannot be responsible for their policies or their compliance with them, regardless of whether we have integrated their solutions with our Services and/or made them available to you.
Openness, Transparency and Access to Personal Information
Upon written request by an authorized individual, PointClickCare will allow access to any PHI collected and stored about such individual, unless providing access could reasonably be expected to interfere with the administration or enforcement of the law or it is impracticable or impossible for PointClickCare to retrieve the PHI. However, PointClickCare will first direct the individual to the applicable customer with the request that the customer provide such access to the individual as the majority of our contracts make the customer the appropriate party to respond to access requests. When provided with reliable evidence of an error in PHI data, PointClickCare will correct any inaccurate PHI, unless to do so would interfere with the administration or enforcement of the law. However, where such a request comes from an individual whose PHI allegedly contains an error, PointClickCare will first direct the individual to the applicable customer, with the request that the customer review the request and inform PointClickCare whether there is, in fact, any clinical merit to the claim that an error exists (and, if so, will require the customer’s written authorization and instruction to correct such error). Unless otherwise prohibited or restricted by the applicable customer, PointClickCare may transmit any corrected PHI to third parties that have had access to the erroneous PHI. Please note that any deletions performed by PointClickCare to correct an error in PHI will only be “soft” deletes (i.e., the data will no longer be viewable from the front end of the platform). In order to be able to address any concerns about fraud which may be raised in the future by, for example, a resident or a government agency, we will retain evidence of: (i) the deletion; (ii) your authorization to make the deletion; and, (iii) the prior version of the data.
If customers or their users need to update or change their Personal Information stored by us, they may do so by editing the organization or user record via the Services.
If you are a European resident, please note that we may process your information in order to fulfill a contract with a customer in whose facility you are a resident. Also note that your information will be stored and accessed outside of Europe, which may include Canada and/or the United States.
Retention and Deletion
PointClickCare will retain Personal Information: as necessary for the purposes outlined in this Policy; for as long as a customer account remains active; as required to manage and administer the Services; as required to carry out legal responsibilities (e.g., legal holds and other legal procedures); to resolve a dispute (including enforcement of a contract); or, as communicated to you at the time of collection. After all applicable retention periods have expired, we will delete or destroy your Personal Information in a manner designed to ensure that it cannot be reconstructed or read. If, at any time, it is not feasible for us to delete or destroy your Personal Information, we will continue using the same safeguards of protection and security outlined in this Policy and related subordinate policies, for as long as it cannot be destroyed.
Cross-Border Transfers
Unless otherwise specified, PointClickCare provides the Services from its headquarters in Mississauga, Ontario, Canada and hosts customer’s production database in the customer’s country of residence. In the case of American customers, PointClickCare may access a customer’s data from Canada for purposes of, for example: responding to support requests; fixing software issues; or, providing services to a customer on the back end of the platform (e.g., correcting errors in a resident record [subject to the conditions set forth in Section 8 of this policy], adding/removing a facility’s data to/from a customer’s database in the event of a purchase/sale/change in management, or performing simulation testing of our disaster recovery plan).
In the event of a disaster affecting PointClickCare’s American data center, we will host American customers’ data in Canada until the disaster is addressed.
In the case of Canadian customers, backup data may be hosted in the United States in encrypted form, and within an encrypted environment.
Opt-Out Policy
We offer visitors to the Site and our customers using the Services a means to choose how we may use the information they provide to us. If, at any time, you change your mind about:
- our use of Personal Information submitted to the Site;
- our use of Personal Information submitted via the Services;
- receiving notices from us (including automatic notifications about updates to the Services and the frequency with which we send you such messages); or
- receiving marketing or sales notices from us, including special offers, product enhancement details, event information, etc.;
- sharing your non-personal information with third parties (as described in this Policy), send us a request specifying your choice or change of permission by contacting us.
Please note that, if you choose to impose certain restrictions on our use of your Personal Information – e.g., if we may no longer access your database to perform any necessary quality testing or disaster recovery testing – you may no longer be able to use the Services. Similarly, if you choose to unsubscribe from receiving notifications or messages from us, your customer experience in using the Services may be compromised. If complying with your request would result in termination of the Services, we will make that clear to you and confirm that this is what you want before proceeding.
Changes
We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, statutory/regulatory or other legal reasons.
Your California Privacy Rights
If you are a California resident, California law may provide you with additional rights regarding our use of your personal information. To learn more about your California privacy rights, visit the Supplemental Information for California Residents.
Contact Us
Do not include any PHI in your message to us.
If you believe your Personal Information has been used in a way that is inconsistent with this Policy or your specified preferences, or if you have further questions related to our privacy practices, please contact us electronically here, or by mail at the address below:
PointClickCare Technologies Inc.
5570 Explorer Drive
Mississauga, Ontario
Canada
L4W 0C4
The PointClickCare Marketplace
The PointClickCare Marketplace (the “Marketplace”) is a directory of products and services that are integrated with PointClickCare services. PointClickCare customers may use the Marketplace to browse, locate, or request information for integrated products and services. These products and services are offered by third parties not affiliated with PointClickCare. While PointClickCare may integrate third-party products and services into PointClickCare services, you understand and agree that PointClickCare in no way controls or is responsible for any third-party product or service on the Marketplace. PointClickCare will not be liable for your interactions with any organizations or individuals found on the Marketplace. You will need to contract separately for the integrated products and services offered by those third parties, and those dealings are solely between you and such organizations or individuals. Your use of any third-party product or service will not affect your relationship with PointClickCare. PointClickCare will require further consent or authorization prior to sending any of your or your employer’s or patients’ information or data to any third party with which you contract.
Table 1: Privacy Laws Applicable to the Services
| Applicable Law
(includes any amendments and implementing regulations) |
Type of Personal Information Governed by the Law | Jurisdiction |
| Health Insurance Portability and Accountability Act of 1996, P.L. 104-191 * | Protected Health Information | United States |
| Health Information Technology for Economic and Clinical Health Act of 2009, P.L. 111-5, Title XIII (amends HIPAA) | Health Information and Individually Identifiable Health Information | United States |
| Personal Information Protection Act, SBD 2003, c. 63 | Personal Information (including that relating to the mental or physical health of individuals) | British Columbia |
| Health Information Act, RSA 200, c. H-5 | Health Information | Alberta |
| Health Information Protection Act, SS 1999, c. H-0.021 | Personal Health Information | Saskatchewan |
| Personal Health Information Act, CCSM, c. P33.5 | Personal Health Information | Manitoba |
| Personal Health Information Protection Act, SO 2004, c. 3, Sch. A | Personal Health Information | Ontario |
| Personal Health Information Act, SNL 2008, c. P-7.01 | Personal Health Information | Newfoundland and Labrador |
| Health Information Act, RSPEI 1988, c. H-1.41 | Personal Health Information | Prince Edward Island |
| Personal Health Information Act, SNS 2010, c. 41 | Personal Health Information | Nova Scotia |
| Health Information Privacy and Management Act, SY 2013, c. 16 | Personal Health Information | Yukon |
| Personal Information Protection and Electronic Documents Act, SC 2000, c. 5 | “An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions….”
Note that Personal Health Information is expressly excluded from Part 1 (“Protection of Personal Information in the Private Sector”). |
Canada |
| Digital Privacy Act, SC 2015, c. 32 (amends PIPEDA) | Personal Information | Canada |
| Canada’s Anti-Spam Legislation S.C. 2010, c. 23 | “An act to promote… the economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities….”
Requires express or implied consent to send commercial electronic messages (e.g., emails, texts and instant messages). |
Canada |
* Note: HIPAA is a federal law and is the default law that applies in each state. A state can choose to make stricter laws about one or more aspects of protecting PHI. In that case, the state law will apply. Where it is less protective, HIPAA will apply.