Privacy

Carleton University respects your privacy. Personal information you provide, including personal health information, collected through this system will be used and disclosed by Carleton University in accordance with Part III of the Freedom of Information and Protection of Privacy Act, and Part IV of the Personal Health Information Protection Act. Our authority to collect your personal information is derived from the following legislation;

• Carleton University Act;
• Health Protection and Promotion Act; and,
• Occupational Health and Safety Act.

The purpose of this processing is;

1. To assist with ensuring the health and safety of the community;
2. To use the self-assessment status and vaccination status information before permitting entry to facilities and activities;
3. To be used to start contact-tracing rapidly where appropriate and comply with Ontario public health guidance and requirements for screening,
4. To enable the university to rapidly collect information required to assist Ottawa Public Health with contact tracing, should it be required,
5. To rapidly identify any areas where decontamination protocols might need to be deployed, and
6. To enable the university to check in with the individual as needed including to follow up, offer supports and comply with reporting requirements.

At all times personal information will be protected, consistent with the privacy requirements set out in the Freedom of Information and Protection of Privacy Act and University policies. Your personal information is protected through a variety of controls and enforcement of data protection policies. All data provided or received through the platform is encrypted and your personal information is stored within Canada. Screening Self-Assessment data will be kept for one year and then permanently deleted from Thrive Health.

If you have any questions about the processing of personal information, please contact the Manager, Privacy & Access to Information, by phone at 613-520-2600 ext. 2047 or by e-mail via University_Privacy_Office@carleton.ca.

Personal information, including personal health information, collected through this form will be used and disclosed by Carleton University in accordance with Part III of the Freedom of Information and Protection of Privacy Act, and Part IV of the Personal Health Information Protection Act. Our authority to collect your personal information is derived from the following legislation;

• Carleton University Act;
• Health Protection and Promotion Act; and,
• Occupational Health and Safety Act.

The purpose of this processing is;

1. To be used to start contact-tracing rapidly where appropriate,
2. To enable the university to rapidly collect information required to assist Ottawa Public Health with contact tracing, should it be required,
3. To rapidly identify any areas where decontamination protocols might need to be deployed, and
4. To enable the university to check in with the individual.

Symptom Reporting data will be kept for one year and then permanently deleted from Thrive Health.

If you have any questions about the processing of personal information, please contact the Manager, Privacy & Access to Information, by phone at 613-520-2600 ext. 2047 or by e-mail via University_Privacy_Office@carleton.ca.

User Account Migration, Deactivation, and Removal

In the case that a user’s affiliation with Carleton University is ending (e.g. graduates, ends their employment, this agreement is terminated, etc.), each user has the option to create a personal account with Thrive Health that is not associated with Carleton University, or to have their account and associated information automatically removed from the Thrive Health platform.

Migration is optional, and subject to explicit, opt-in consent via the following procedures:

At a single instance during first use:

• Users will be informed of the feature- and time-limited scope of Carleton University’s use of the Thrive Health platform;
• Users are offered the choice to:

1. 1. Provide optional consent to receive services from Thrive Health after affiliation with Carleton University ends by providing a non-Carleton University email address; or
   2. Withhold consent and have their account and associated information automatically removed from the Thrive Health platform within 30 days after affiliation with Carleton University has ended.

When a user’s affiliation with Carleton University ends:

• Carleton University will mark that user for removal via a mutually agreed process between the University and Thrive Health.
  • The specific procedure for marking users for removal will be mutually agreed, may differ depending on the user’s role (e.g. staff, faculty, student), and may change over time.
  • Carleton University will make efforts to mark users for removal in advance of deactivation of their Carleton University email address.
• Upon being marked for removal:

1. 1. If the user has provided consent for continuation of services via a personal account:
      • The user will be notified of personal account creation via their provided non-Carleton University email address and provided an option to change their consent
   2. If the user has not provided consent for continuation of services via a personal account but has provided consent for direct email communications from Thrive Health:
      • The user will be notified via email to their provided non-Carleton University email address, which provides the user the choice to:
        • Provide optional, positive consent to create a personal Thrive Health account by creating new log-in credentials using a non-Carleton University email address; or
        • Withhold consent and have their account and associated information automatically removed from the Thrive Health platform within 30 days.
   3. If the user has not provided consent for continuation of services via a personal account and has not provided consent for direct email communications from Thrive Health:
      • The user’s account and associated information will be automatically removed from the Thrive Health platform within 30 days.

Carleton University respects your privacy. Personal information you provide, including personal health information, collected through the Paper-Based Self-Assessment and Location Log will be used and disclosed by Carleton University in accordance with Part III of the Freedom of Information and Protection of Privacy Act, and Part IV of the Personal Health Information Protection Act. Our authority to collect your personal information is derived from the following legislation;

• Carleton University Act;
• Health Protection and Promotion Act; and,
• Occupational Health and Safety Act.

The purpose of this processing is;

1. To assist with ensuring the health and safety of the community;
2. To use the self-assessment status and vaccination status information before permitting entry to facilities and activities;
3. To be used to start contact-tracing rapidly where appropriate and comply with Ontario public health guidance and requirements for screening,
4. To enable the university to rapidly collect information required to assist Ottawa Public Health with contact tracing, should it be required,
5. To rapidly identify any areas where decontamination protocols might need to be deployed, and
6. To enable the university to check in with the individual as needed including to follow up, offer supports and comply with reporting requirements.

At all times personal information will be protected, consistent with the privacy requirements set out in the Freedom of Information and Protection of Privacy Act and University policies. Your personal information is protected through a variety of controls and enforcement of data protection policies.

If you have any questions about the processing of personal information, please contact the Manager, Privacy & Access to Information, by phone at 613-520-2600 ext. 2047 or by e-mail via University_Privacy_Office@carleton.ca.

cuScreen has been developed in partnership with Thrive Health Inc., a leading Canadian healthcare technology company with expertise in protecting personal health information and an integrator of healthcare information. Outside of Carleton’s customized cuScreen module, or care network, the Thrive solution is built to allow a user to consolidate all of their care networks into one application and provide a seamless connection across all patient journeys. As a result, their privacy notice includes references to collecting standard personal information related to health care management (e.g., birthdate, age, medical history). For the purposes of the cuScreen implementation, this information is not collected from the user, nor is it shared with Thrive by our system integration. The only personal information that has been shared is name, Carleton ID and email address. Phone number is also collected in the case of symptom reporting to facilitate follow up by university health and occupational safety personnel. Birthdate does appear on the government-issued vaccination receipts in order for our personnel to validate the records.  This information is not used for any other purposes.

Users have the option, however, to create a personal Thrive account and link that with other care networks, if they so choose, and as such, the data collection notice is required to account for those situations. If, at a time when the user is no longer part of the Carleton network or if the university is no longer required to collect screening and vaccination attestations, the user will have the choice to continue as a Thrive client with a personal account.

Thrive Health Inc. is a Vancouver-based company working with thousands of organizations within Canada, including Health Canada, BC Health, University of Toronto and the University of Calgary. All data provided or received through the platform is encrypted and the limited personal information is stored within Canada. Thrive Health Inc. follows data security and privacy standards that align with federal and provincial laws and guidelines such as PHIPA, FIPPA, PIPEDA and NIST. Carleton University’s Privacy Office and the ITS Security Governance team completed an assessment which confirmed its compliance with applicable privacy standards and university data policies.

Disclosure of information to third parties in the event of an acquisition or merger is standard business practice and is found in all applications.  The university requires all suppliers to notify us in the event of an acquisition, and the terms of our agreement would legally allow us to discontinue the relationship, if undue risk or implementation practices contrary to the original terms of our agreement were to form part of the merger or acquisition.