How we govern personal information.

This policy sets out the rules that MedTechInvest Canada Corp. applies, for itself and on behalf of the manufacturer FixNip Ltd., to personal information it collects through the FixNip Canada website, its professional area and its e-mails, throughout the life cycle of the information: collection, use, communication, retention and destruction. It applies to our staff and to every service provider that processes personal information on our behalf. What we collect and why is described in our privacy policy.

The person with the highest authority within MedTechInvest Canada is responsible for the protection of personal information and may delegate this function in writing. The person exercising it can be reached as follows:

• Privacy Officer, MedTechInvest Canada Corp.
• privacy@fixnip.ca
• 4789 Yonge St., Suite 805, Toronto, ON M2N 0G3, Canada

The Privacy Officer ensures that this policy and the privacy policy are applied, answers requests and complaints, keeps the incident register, takes part in every privacy impact assessment and approves any new use or communication of personal information.

• A new collection of personal information requires a stated purpose and the approval of the Privacy Officer; each form collects only the fields its purpose needs.
• At the time of collection, the form states the purpose, the means of collection, the rights of the person and, where applicable, the possibility of communication outside Quebec, and links to the privacy policy.
• Information is used only for the purposes stated at collection. A new purpose requires new consent unless the law permits it.
• Technological products and services are configured by default with the highest level of confidentiality: no tracking, profiling or location technology is active unless the person has actively agreed to it.
• Personal information is communicated to third parties only as described in the privacy policy and under written agreements.

Each category of information has a retention period, listed in section 12 of the privacy policy. Short periods are applied by an automated daily routine in the database, whose runs are logged; long-term records such as orders are reviewed and deleted in a documented annual review.

At the end of the period, information is deleted from the database or anonymized irreversibly, so that it no longer allows a person to be identified, directly or indirectly. Anonymization follows generally accepted best practices and the criteria of Quebec's Regulation respecting the anonymization of personal information: it is supervised by a competent person, preceded and followed by an analysis of the risk of re-identification, re-assessed periodically and recorded in a register. Backups of the database are kept for at most 12 months and are overwritten in rotation; information deleted from the database therefore remains in a backup only until the copy that contains it is overwritten, at the latest 12 months after deletion. Backups are encrypted and are used solely to restore the service after an incident; we do not use them to bring back information that was deleted at the end of its retention period. Paper documents, if any, are shredded.

We carry out a privacy impact assessment, proportionate to the sensitivity, purpose, quantity, distribution and medium of the information:

• before any project to acquire, develop or overhaul an information system or electronic service delivery that involves personal information;
• before communicating personal information outside Quebec, taking into account the sensitivity of the information, the purposes, the protection measures and the legal framework of the destination;
• before any new use of personal information that was not foreseen at collection.

The Privacy Officer is consulted from the start of every such project.

A confidentiality incident is any access, use or communication of personal information not authorized by law, its loss, or any other breach of its protection.

1. Anyone who notices an incident reports it immediately to the Privacy Officer; service providers report it within 24 hours.
2. We take reasonable measures without delay to reduce the risk of injury and prevent a recurrence.
3. We assess the risk, considering the sensitivity of the information, the anticipated consequences and the likelihood of misuse.
4. If there is a risk of serious injury (Quebec) or a real risk of significant harm (PIPEDA), we notify, as soon as feasible after we determine that the incident has occurred, the persons concerned, the Office of the Privacy Commissioner of Canada and, where their law applies, the Commission d'accès à l'information du Québec or another provincial commissioner, and any organization that can reduce the risk. The report and the notice describe the circumstances and, if known, the cause, when the incident occurred, the information involved, what we have done to reduce the harm, what the person can do, and whom to contact. Communications to third parties made to reduce the risk are recorded by the Privacy Officer.
5. Every incident is recorded in our incident register, whether or not it is notified. For each incident the register records the date, the circumstances, the type of information involved and whether we reported or notified it. The register is kept for at least five years after we become aware of the incident.

1. Every request is forwarded to the Privacy Officer; staff never disclose personal information directly.
2. We disclose without the consent of the person only if the request is a subpoena, warrant or order that compels production, or if a government institution has identified in writing its lawful authority and a purpose set out in PIPEDA (national security, the enforcement or administration of a law, or contacting the next of kin of an injured, ill or deceased person). A simple request without such authority is refused.
3. We disclose only the information the order or authority actually covers, and nothing more.
4. Every request, our assessment and any disclosure are recorded in the access log.
5. We inform the person concerned of the disclosure unless the law prohibits it or the requesting institution objects. If you ask us whether we have disclosed your information to a government institution, the law requires us to notify that institution first and to wait for its answer, for up to 30 days, before we reply.
6. Mandatory reports to Health Canada under the Medical Devices Regulations follow the same principle: only the information the regulations require.

Requests are sent in writing to the Privacy Officer. We confirm the identity of the requester with the least information necessary, help the person formulate the request if needed, and answer in writing within 30 days (in exceptional cases up to 30 more days, with a reasoned notice within the first 30 days). Any refusal is reasoned and states the available recourse. Access is free of charge, except for reasonable costs of transcription, reproduction or transmission, the approximate amount of which is announced in advance and which apply only if the person maintains the request.

1. Send your complaint in writing to the Privacy Officer, by e-mail or by mail (section 2), describing the facts and what you expect.
2. We acknowledge receipt within 5 business days.
3. The Privacy Officer examines the complaint impartially and may ask you for additional information.
4. We send you a written, reasoned answer within 30 days of receipt, including any corrective measure.
5. If you are not satisfied, you may contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada. You may also do so at any time without first contacting us.

Complaints and their outcomes are recorded and reviewed each year to improve our practices.

Staff receive training on this policy before they obtain access to personal information and a refresher each year. Access rights are reviewed when a role changes and removed the same day a person leaves.

This policy is approved by the Privacy Officer, who reviews it at least once a year and after any significant change to our activities or the law. Changes are published on this page with their date.