Privacy Policy & Personal Health Information Protection

Our Commitment to Privacy

Test Requisition Portal is committed to protecting the privacy and confidentiality of personal health information (PHI) in accordance with Canadian federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial health information protection acts.

Collection and Use of Personal Health Information

We collect personal health information only for the following purposes:

• Processing test orders and requests
• Delivering test results to authorized healthcare practitioners
• Maintaining accurate medical records as required by law
• Facilitating communication between practitioners and our laboratory services

Consent

By submitting patient information through this portal, healthcare practitioners confirm that they have obtained express consent from the patient to collect, use, and disclose their personal health information for the purposes of testing and result delivery. Practitioners are responsible for ensuring proper consent has been obtained before entering any patient data.

Data Security and Safeguards

We implement comprehensive technical, physical, and organizational safeguards to protect personal health information:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls limiting data access to authorized personnel only
• Comprehensive audit logging of all data access and modifications
• Secure storage infrastructure located in Canada (ca-central-1 region)
• Regular security assessments and compliance reviews

Data Retention and Disposal

Personal health information is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and regulations. We maintain secure deletion procedures to ensure that data is permanently removed when no longer needed.

Individual Rights

Individuals have the right to:

• Access their personal health information
• Request corrections to inaccurate information
• Withdraw consent (subject to legal and contractual limitations)
• File a complaint regarding our privacy practices

To exercise these rights, please contact our Privacy Officer using the contact information provided below.

Cross-Border Data Transfers

All personal health information is stored and processed within Canada. We do not transfer patient data outside of Canada without explicit consent and appropriate safeguards. Our infrastructure is located in the Canadian AWS region (ca-central-1) to ensure data remains within Canadian jurisdiction.

Third-Party Service Providers

We may engage third-party service providers to assist with our operations. All service providers are contractually obligated to maintain the same level of privacy protection and security standards as required by Canadian privacy laws.

Breach Notification

In the event of a privacy breach involving personal health information, we will notify affected individuals and relevant regulatory authorities as required by law, typically within the timeframe specified by applicable privacy legislation.

Contact Information

For questions, concerns, or requests regarding our privacy practices or your personal health information, please contact:

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.