Privacy Policy

Mitogen Dx Privacy Policy (External)

 

  1. Our Commitment

Mitogen Diagnostics Corporation (“MitogenDx”) is committed to maintaining the accuracy, confidentiality, security, and appropriate use of personal information and health information entrusted to us. This Privacy Policy explains what information we may collect or receive, why we use it, when it may be disclosed, how it is protected, and how privacy questions or concerns may be raised.

MitogenDx handles information in accordance with applicable Canadian federal and provincial privacy legislation, including applicable Alberta privacy and health-information requirements, as well as contractual, regulatory, and laboratory accreditation requirements.

  1. Who This Policy Applies To

This Policy describes MitogenDx’s privacy practices in relation to patients, clients, healthcare providers, referring and ordering laboratories, suppliers, website users, research participants where applicable, and other external parties with whom MitogenDx interacts in Canada.

This Policy is not an employee privacy or workforce procedure. MitogenDx employees, contractors, trainees, consultants, and affiliates are subject to separate confidentiality and information-security obligations, including the MitogenDx Confidentiality, Privacy, and Information Security Agreement and required privacy and security training.

  1. What We Mean by Personal and Health Information

Personal Information

Personal information is information about an identifiable individual, subject to the definitions, exclusions, and qualifications contained in applicable law.

Health Information / Personal Health Information

Health information may include identifying information relating to an individual’s health or healthcare, diagnostic testing, requisitions, specimens, laboratory results, medications, reasons for testing, billing, healthcare identifiers, and healthcare-provider information.

  1. Information We Collect or Receive

The information MitogenDx collects or receives depends on the service being provided and the nature of the relationship. It may include:

  • name, date of birth, sex or gender information where required for testing or identification, address, telephone number, and email address;
  • provincial or other healthcare identifiers and other information required to correctly identify and match a patient, specimen, requisition, and laboratory result;
  • ordering or referring healthcare-provider and laboratory information;
  • clinical and health-related information relevant to requested testing, including medications, reason for testing, specimen information, requested tests, and laboratory results;
  • billing, payment, account, and service information where applicable;
  • communications and records relating to services provided by MitogenDx; and
  • information required for quality assurance, accreditation, incident management, legal, regulatory, contractual, or legitimate business purposes.

MitogenDx may receive information directly from an individual or from authorized third parties, including healthcare providers, hospitals, referral laboratories, service providers, and other organizations involved in requesting, performing, supporting, or paying for laboratory services.

  1. Why We Collect, Use, and Disclose Information

MitogenDx collects, uses, and discloses personal information and health information only for legitimate purposes connected with its laboratory services and business operations, as permitted or required by law. These purposes may include:

  • receiving, identifying, processing, testing, and reporting specimens and diagnostic results;
  • communicating with ordering or referring laboratories, healthcare providers, patients, clients, suppliers, and service providers as necessary;
  • establishing, administering, and maintaining service and business relationships;
  • billing, payment processing, accounting, and records administration;
  • quality assurance, validation, accreditation, audit, record integrity, security, and laboratory operations;
  • monitoring, investigating, and responding to privacy, security, service, quality, or other incidents and complaints;
  • protecting against error, fraud, unauthorized access, theft, loss, misuse, or damage;
  • meeting legal, regulatory, accreditation, contractual, and reporting obligations;
  • improving MitogenDx services and operations using anonymized, de-identified, or aggregated information where appropriate; and
  • other purposes for which consent has been obtained or that are otherwise permitted or required by law.
  1. Consent and Other Legal Authority

MitogenDx obtains consent where consent is required by applicable law. The form of consent may vary depending on the sensitivity of the information, the circumstances, the service being provided, and the legal authority under which the information is collected, used, or disclosed.

In some circumstances, MitogenDx may collect, use, or disclose information without an individual’s knowledge or consent where permitted or required by applicable law, regulation, court order, contractual arrangement, or applicable healthcare process.

  1. When We Disclose Information

MitogenDx does not disclose personal information or health information except as necessary for the purposes described in this Policy, with consent where required, or as otherwise permitted or required by law.

Depending on the circumstances, information may be disclosed to:

  • the healthcare provider, laboratory, organization, or other authorized party that ordered, referred, or is otherwise entitled to receive the laboratory service or result;
  • authorized MitogenDx personnel who require the information to perform their duties;
  • third-party service providers that support MitogenDx operations, such as information-technology, data-processing, payment-processing, communications, professional, or other service providers;
  • regulators, accreditation bodies, governmental authorities, law-enforcement bodies, courts, or other parties where disclosure is permitted or required by law; and
  • other parties where the individual has consented or where another lawful authority permits the disclosure.
  1. How We Protect Information

MitogenDx uses administrative, technical, and physical safeguards appropriate to the sensitivity of the information and the nature of its operations. These safeguards include, as applicable:

  • role-based and need-to-know access controls;
  • unique user accounts, authentication requirements, and controlled system access;
  • confidentiality obligations for personnel with access to confidential or health information;
  • privacy, confidentiality, cybersecurity, and information-security training;
  • electronic audit trails and access logging designed to support accountability and detection of inappropriate access;
  • secure handling, storage, transmission, retention, and disposal practices; and
  • privacy and security incident-response processes.

MitogenDx’s confidentiality requirements prohibit personnel from accessing personal or health information unless access is required for an authorized work purpose. Access to applicable electronic systems may be logged, audited, and reviewed.

  1. Service Providers and Processing Outside Alberta or Canada

MitogenDx may use third-party service providers to support its operations. Depending on the service, personal information may be processed or stored outside Alberta or outside Canada where permitted by applicable law and contractual requirements.

Information processed in another jurisdiction may be subject to the laws of that jurisdiction. MitogenDx uses reasonable contractual, administrative, and technical measures to protect information entrusted to service providers.

  1. Accuracy and Retention

MitogenDx takes reasonable steps to maintain personal information and health information that is accurate, complete, and up to date as necessary for the purposes for which it is used.

Information is retained for as long as required for clinical, operational, legal, contractual, accreditation, or regulatory purposes. When information is no longer required, MitogenDx will securely destroy, delete, anonymize, or otherwise dispose of it in accordance with applicable requirements and MitogenDx procedures.

  1. Privacy and Security Incidents

MitogenDx maintains processes for identifying, reporting, assessing, containing, investigating, and responding to suspected or actual privacy and information-security incidents.

Where an incident involves personal information or health information, MitogenDx will take appropriate steps based on the circumstances and will provide notifications to affected clients, individuals, regulators, or other parties where required by law or applicable agreements.

  1. Our Website

When an individual visits the MitogenDx website, technical information may be collected, such as IP address, browser or device information, referring pages, pages viewed, and website usage information. MitogenDx may use this information to operate, secure, measure, maintain, and improve the website and its services. The website may use cookies or similar technologies. Users may be able to control cookies through their browser settings, although restricting cookies may affect some website functions.

MitogenDx may use third-party website or analytics service providers. The technologies and providers used by the website may change over time. Where required, MitogenDx will provide or update appropriate notices concerning those technologies.

The MitogenDx website may contain links to independent third-party websites. MitogenDx is not responsible for the privacy practices of those third parties, and users should review their privacy notices before providing personal information.

  1. Access, Correction, and Privacy Requests

Subject to applicable law and permitted exceptions, individuals may have rights to request access to personal information about themselves, request correction of inaccurate information, withdraw consent where consent is the applicable legal basis, or raise a concern about MitogenDx’s privacy practices.

MitogenDx frequently performs laboratory testing at the request of healthcare providers and referral laboratories. Depending on the circumstances and applicable legal requirements, a request concerning a clinical record or laboratory result may need to be made through the healthcare provider, laboratory, or organization that ordered the testing.

MitogenDx will respond to privacy requests in accordance with applicable law and its contractual obligations.

  1. Accountability

MitogenDx is accountable for personal information and health information under its control. Privacy and security requirements are incorporated into MitogenDx’s confidentiality obligations, access-management controls, training, information systems, incident-response processes, quality systems, and accreditation-related controls.

Personnel with access to confidential information or health information are required to comply with the MitogenDx Confidentiality, Privacy, and Information Security Agreement and related training requirements.

  1. Changes to This Policy

MitogenDx may update this Policy from time to time to reflect changes in applicable law, services, systems, information practices, contractual obligations, or privacy and security requirements. The current version will be made available through MitogenDx.

  1. Contact Us

Questions, concerns, or requests relating to privacy may be directed to:

Privacy Officer
Mitogen Diagnostics Corporation
3415C – 3 Avenue NW
Calgary, Alberta  T2N 0M4
Canada
Telephone: 403-800-8851
Email: admin@mitogendx.com