What is the scope of this Policy?
What do we mean by ‘Personal Information’?
Throughout this policy, we use the phrase “personal information”. “Personal information” is information that reveals a distinctive trait about yourself and helps others identify you. Some personal information such as your business address may be found in the public domain by accessing publications like telephone or professional directories. The focus of this policy is personal information collected, used and disclosed by us that is NOT in the public domain.
What types of personal information do we collect and use?
Primarily, we collect and use personal information about our members. We also have personal information about individuals who purchase our products and services, attend our events, conferences, seminars and/or participate in our task forces/committees/working groups, and submit manuscripts to our publications.
We assign a personal identifier to each member or customer so that you can use this number when contacting us, ordering our products and services and publications or registering for an event on our Web site. This identifier is also used by CMA’s subsidiaries e.g., Joule Inc. and MDFMI.
We collect personal information directly from individuals, or receive it from one of the provincial or territorial medical associations (“PTMAs”) or subsidiaries, the CMA group of subsidiary companies, including our financial services company, MDFMI, and/or our knowledge and innovation business, Joule Inc.
- If you are a CMA member, you may provide personal information like your home address, date of birth and gender to the CMA, or a PTMA or a CMA subsidiary which is then shared with CMA, on, for examples an application form, signing up for an App, participating in a community of interest, registering for a course or publication subscription.
- If you are both a client of one or more of CMA’s financial subsidiaries and a CMA member, the fact of your client status, will be known to us but not detailed financial information is identified. A circumscribed and limited number of our employees, all of whom receive enhanced privacy training and sign specific undertakings, will have access to more detailed MDFMI information such as frequency of meetings about your MD client status (but not any specific financial transactional details) in order to perform statistical analysis and facilitate referrals between CMA and its subsidiaries.
- If you have attended an event organized through our Meetings Department, you might have provided us with credit card data as well as information about certain travel preferences and food sensitivities.
- If you have purchased a service such as classified advertising or attended one of our seminars (e.g., Physician Leadership Institute), or used our e-commerce registration system you provided us with personal contact information such as your name, address and credit card information.
- If you have submitted a manuscript for publication by CMAJ, you provided us with contact information, financial disclosure and competing interests data and the manuscript itself.
- If you participate in one of our surveys, panels, committees, communities of interest, task forces and/or working groups, you might provide us with personal contact information such as your name, email address, address and/or telephone number.
Why do we collect and use personal information?
We collect and use only the personal information necessary to achieve the following objectives or one consistent with one or more of these objectives:
- to determine an individual’s eligibility for membership in the CMA or to serve as a potential contributor to a publication;
- to determine an individual’s eligibility to benefit from the services of one of CMA’s subsidiaries or its preferred third-party suppliers;
- for registration and participation in cma.ca, member forums, publications, courses, and community of interest;
- to communicate information about CMA member benefits and provide CMA Member services, such as the delivery of publications, clinical resources, financial services, travel reservations, e-panels, etc.);
- to gain insight, to develop and market products and services tailored to the interests of CMA members and the purchasers of our products and services;
- to update information in our contact database;
- to provide individuals with the opportunity to benefit from supporting our foundation;
- to assist the CMA, Joule, MDFMI and PTMAs with the maintenance of all of our membership databases and client contact information;
- to conduct surveys and studies of physicians, patients and the public to gain perspectives on topics impacting health care in Canada (see separate Survey Policy: https://www.cma.ca/Assets/assets-library/document/en/advocacy/corporate-policy-covering-surveys-english.pdf);
- to engage members, physicians, the public and patients in CMA’s policy development process and advocacy work; and/or
- to broadcast urgent health alerts of national significance.
When and to whom do we disclose personal information?
If you are both a CMA member and a client of Joule or MDFMI when you inform us of an address change, with your permission, this information will be changed for all three organizations.
We might also disclose personal information to third party service providers or to organizations or companies that are not CMA-affiliated companies or Divisions if these organizations have contracted or partnered with us to help in the provision of products, services or do research. For example, we might utilize a software survey platform of a third party or we might out-source the mailing function for one of our publications. In these instances, we take measures to ensure that personal information is managed appropriately and consistent with our policy.
We may, in certain instances, contract with a third party service provider located in other countries. Your information may be processed and stored in other countries and the governments, courts or law enforcement or regulatory agencies may be able to obtain disclosure of your information under a lawful order made in that country. If you would like more information about the jurisdictions in which our service providers may operate please contact us as noted in the Addressing Your Concerns section of this Policy.
Within the CMA family of companies, your personal information in the form of interactions with the CMA, Joule and/or MDFMI may be shared amongst CMA, Joule and MDFMI. This will enable us to have a better understanding of your interests and activities such that we might tailor our product and service offerings to your interests. If a CMA member objects, a note will be entered in the database.
What if I object to any collection, use or disclosure of personal information?
We aim at all times to respect and honour your privacy and communication preferences. For instance, if you indicate to us that you do not wish to receive certain publications, participate in surveys or receive information about new or specific benefits and services such as communications from CMA or its subsidiaries, your preference will be noted and you will no longer receive correspondence from us on these issues. Our emails have an “unsubscribe” link, please use this to no longer receive information from us on certain topics. You may also contact the CMA Member Service Centre at 888 855 2555.
You may also at any time, subject to restrictions required by law, object to our collection, use or disclosure of personal information under this Policy. You need only provide us with reasonable notice in writing of your intention and the details of your objection.
Please note, however, that any such objection to the collection, use or disclosure of personal information may mean that we are unable to provide you with some or all of our products or services including CMA Member benefits. For example, if you object to the sharing of your CMA membership status with CMA’s subsidiaries, then you may not be eligible to benefit from their products or services. MDFMI has to confirm your CMA membership status in order to offer CMA members financial services.
It is your responsibility to contact us in order to determine how an objection to the collection, use and disclosure of personal information might affect the services supplied.
How accurate is the personal information held by us?
We make every reasonable effort to ensure the accuracy and currency of your personal information so that we might fulfill the purposes for which it was first collected. Please therefore advise us accordingly of any relevant changes so that we might better meet your needs.
How do I access the personal information held by you?
You may send a written request to the attention of the Chief Privacy Officer, CMA at 1867 Alta Vista Drive, Ottawa, Ontario, K1G 5W8 or to privacy@CMA.ca to obtain a report on the personal information held about you by the CMA and/or Joule. Within a reasonable time frame, the Chief Privacy Officer will then advise you in writing whether it has such personal information and the nature of this information unless there is the rare occurrence that the release of such information is legally prohibited. If we cannot release the personal information, we will provide you with the reasons for denying access.
You may challenge the accuracy and completeness of the personal information that is maintained by the CMA. The CMA will amend personal information when an individual successfully demonstrates inaccuracy or incompleteness.
How secure is my personal information?
We make every reasonable effort to protect your personal information by implementing security safeguards against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. We use physical, organizational and technological measures as methods of protection. For instance, only a limited number of staff have access to sensitive information, such as credit card numbers. Moreover, we ensure that employees are aware of the importance of maintaining the confidentiality of personal information.
How long do we retain personal information?
We keep personal information as long as it is needed to fulfill the purposes identified above. When personal information is no longer required to fulfill the identified purposes, it will be safely and securely destroyed. Moreover, we will retain personal information that is the subject of an access request for as long as is necessary to allow an individual to exhaust any legal remedy that is provided for in applicable federal or provincial/territorial legislation.
For more information about your personal privacy rights, you might contact the Privacy Commissioner of Canada at https://www.priv.gc.ca/en or the applicable privacy commissioner in your province or territory.