Last Updated: December 10, 2024
The College of Family Physicians of Canada (“CFPC” or “we”) is committed to protecting the privacy and security of the personal information that it handles in the course of conducting its business operations and in the provision of its products, programs and services. The CFPC fulfills this commitment by voluntarily complying with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and by adopting the practices set out in this privacy policy (the “Policy”). It includes our practices in respect of the personal information that is collected and used in connection with our corporate website, www.cfpc.ca, and all other websites owned by the CFPC (the “Websites”).
“Personal information” means any information about an identifiable individual, or an individual whose identity may be inferred or determined from the information. Examples include a person’s name when combined with other information about them, such as their date of birth, residential address and phone number, personal (but not business) email address, social insurance and other non-public ID numbers, income, evaluations, opinions, and individual interests and preferences. Even without a name, a record may contain personal information if the individual can be identified. Personal information also includes personal health information about an identifiable individual, such as their physical or mental health, any health services provided to the individual, and information that is collected in the course of determining or providing reasonable accommodations to the individual.
For the purposes of this Policy, personal information does not include information that can be found within the public domain, including, for example, information relating to a physician’s medical licence (e.g. licence number, etc.) or business contact information such as job titles, business email or physical addresses, or phone/fax numbers. Additionally, the granting of the special designation “CCFP” (Certification from the College of Family Physicians of Canada) and any certificates of added competence (“CACs”) that are awarded to members is public information, and the names of individuals who are members of the CFPC and those who have earned such designations is made available on our Websites and is shared with the provincial and territorial Medical Regulatory Authorities (“MRAs”).
This Policy applies to all personal information that we collect, use or disclose in the course of our business operations and in the provision of our products, programs and services (including our provision of membership benefits), and includes the personal information that we handle relating to candidates for employment, members (including non-member Mainpro+® participants), examinations and other certification candidates, Board and committee members, volunteers, and members of the public with whom we may deal (collectively and individually, “you”).
In an effort to protect your privacy, we follow the ten (10) fair information principles under PIPEDA, as set out below.
We are responsible for personal information under our control and have designated a Privacy Officer who is accountable for organizational compliance with this Policy. This Policy and our information-handling practices are reviewed annually, and CFPC staff are regularly informed about this Policy, and they receive training and guidance on the appropriate management of personal information.
We only collect personal information for purposes that are appropriate in the circumstances and only such personal information as is required for the purposes of conducting our operations and/or providing our products, programs and services.
Under no circumstances will we sell, trade, barter, exchange or disclose for consideration any personal information that we obtain from you.
Except where the law authorizes collection, use and disclosure of personal information without consent, and prior to collecting, using and disclosing such information, we will obtain your meaningful consent, as follows:
In circumstances where we require access to your personal information from third parties, the duty to obtain consent rests with the third party at the point of collection, such that additional consent will not be obtained by us.
Since we have an obligation to collect, use and disclose certain personal information to fulfill our quasi-regulatory duties, including to assess and certify family physicians and to confirm compliance status in the Mainpro+ program, you may not refuse or withdraw your consent for the collection, use or disclosure of personal information that relates to these purposes.
You may refuse to consent to, or you may withdraw your consent for, the collection, use or disclosure of personal information not related to our quasi-regulatory functions at any time by providing us with reasonable notice in writing. In certain circumstances, however, your refusal or withdrawal of consent may limit our ability to offer services, products or programs, and may likewise limit your eligibility to participate or benefit from those services, products or programs.
We only collect the amount and type of information that is necessary for the identified purposes of collection, and we will do so by fair and lawful means.
We may collect personal information from you, or we may receive it from third parties (including, for example, from a reference, university program, or one of the provincial or territorial MRAs), with your consent.
We will not use or disclose personal information in our custody or control except as necessary in the course of conducting our business operations and in the provision of our products, programs and services. Moreover, we will only use or disclose your personal information for the purposes for which it was collected, unless you consent to the additional or secondary use, or the disclosure is authorized by law.
Use of Personal Information
In the normal course of business, the personal information we collect may be used to:
In addition to the above, Canadian Family Physician (“CFP”) uses the personal information it collects to:
In some cases, the CFPC (or service providers on its behalf) may use cookies or similar technologies for targeted advertising. For example, a cookie may be placed on your hard drive when you visit the Websites. When you later visit a third-party website, it will recognize the cookie and serve you with a CFPC advertisement. We may also use targeted advertising services provided by social media sites. This typically involves sharing a hashed (or scrambled) version of your email address or telephone number with the social media site. If you have an account with the social media site, the site will identify you as part of a group of individuals to whom CFPC advertisements should be served on its site.
We will not attempt to identify individual visitors to the Websites or associate the technical information we collect with any individual, unless required to do so by law. The information is used only for statistical analysis and administrative purposes and to assist us in making enhancements to the visitors’ experience with the Websites.
Browser software allows the disabling of cookie collection if users wish or may inform users when a cookie is being stored on a user’s hard drive. You may also be able to opt-out of a social media site’s targeted advertising program by adjusting your privacy or account settings.
Use of De-Identified or Aggregated Data
We may use your personal information, without your knowledge or consent, if the information is de-identified or aggregated and used for purposes that include to:
Disclosure of Personal Information
We may disclose the personal information that we have collected about you to third parties at your direction and with your consent, or otherwise in accordance with this Policy, as follows:
For CFPC Examination Administration Purposes
For residents or practitioners sitting the Certification Examination in Family Medicine and/or members sitting the Examination of Added Competence in Emergency Medicine (each, individually, an “Examination”), we will provide the relevant family medicine program directors (“program directors”) with a copy of the summary of Examination results for the purpose of tracking and improving the experience for future Examination candidates.
To the Provincial College of Family Physician Chapters (the “Chapters”)
We may share the personal information of our members with the Chapter in the province or territory in which the member resides and/or practices. This disclosure will only be made in circumstances where the Chapter has entered into a Data Access and Sharing Agreement with us. In such cases, the members’ information will be accessed and used by the Chapters’ authorized users for the purposes of facilitating the Chapters’ ability to communicate with its members regarding Chapter products, services and programs; to survey Chapter members and obtain feedback on Chapter products, services and programs; and for general information and statistical or reporting purposes.
To our Service Providers
We may employ third party service providers (for example, for the delivery and/or processing of Examination services, data analysis, data security monitoring and assessment, member support and management services, benefits providers, fee collection services, consulting services, etc.) and these third parties may be located in Canada and in other locations around the world. Therefore, some of your personal information may be retained in the United States, where privacy laws may offer different levels of protection from those in Canada and your personal information may be subject to access by and disclosure to law enforcement agencies under American legislation such as the USA Patriot Act.
The employees of our service providers who require your personal information to fulfill their duties will have access to your personal information only when and to the extent required for their provision of services. Access to your personal information in these cases will be granted to perform specific tasks on our behalf and is restricted using contractual arrangements that prevent them from disclosing or using your information for any purpose other than those with which we specify.
To Other Professional Associations or Entities
We may share certain information that we hold about our members to the provincial and territorial MRAs or other professional associations or entities to streamline the registration / licensure process, to collaborate on certification practices, and as part of our role to track and record members’ continuing professional development (“CPD”) activities, including to confirm their enrollment in the Mainpro+ program and to provide their compliance status.
Additionally, and upon request, we may provide the MRAs with confirmation of a member’s past membership history, including the dates when they became and/or ceased to be a member and whether and when they were awarded any CFPC designations and certifications, if applicable.
Without Consent
In certain circumstances, we may disclose your personal information without your consent, for example where:
Where obliged or permitted to disclose information without consent, we will not disclose more information than is required.
Disclosure of De-identified or Aggregated Data
We may disclose your personal information without your knowledge or consent if the personal information is de-identified before the disclosure is made; if the disclosure is made for a socially beneficial purpose (as we determine, in accordance with any CFPC policies), including for research purposes where we believe the sharing of information is likely to advance the interests of family physicians or family medicine in Canada; and the disclosure is made under the terms of a properly executed data sharing agreement. We may also disclose aggregated information with third parties for similar purposes or to otherwise fulfill business operations.
By sharing your personal information and/or using our services, you agree that we may de-identify and/or aggregate your personal information for purposes consistent with this Policy.
Retention of Personal Information
We will keep records containing your personal information only as long as it is needed to fulfill the purpose(s) for which the personal information was collected, or as otherwise permitted or required by law or contractual restrictions. Due to the quasi-regulatory nature of the CFPC, this period may extend beyond your relationship with us, and certain member information (e.g. name, licence number, CFPC number, CFPC examination and certification history, membership history, past payment details, and summaries of interactions with the CFPC) will be retained for the life of the member.
When your personal information is no longer required to fulfill the identified purposes, it will be safely and securely destroyed or de-identified.
We strive to ensure all personal information in our possession is as accurate, complete and up-to-date as possible. You are encouraged to promptly update your contact details or otherwise inform us if there are any changes to your personal information. This is necessary so that we can provide you with our products, programs and services, as well as to transmit membership communications and notifications (e.g. newsletters, membership renewal or other notices, notice of member meetings, notice of legal proceedings, etc.). In certain cases, we may contact you to obtain updated information or to confirm the accuracy of our information holdings.
We make every reasonable effort to protect your personal information and have implemented physical, organizational and technological measures to protect the personal information that we collect or retain, in whatever format in which it is held, against loss, theft, unauthorized access, use, copying, disclosure, or modification. This commitment also applies to the disposal or destruction of your personal information.
The forms of security safeguards we have implemented vary depending on the sensitivity of the information, and include:
In cases where we transfer your personal information to a third party for processing, we use contractual or other means to ensure that the third party uses an appropriate level of protection during its processing.
Payment Data
Access to your financial information is restricted to members of our staff or third-party service providers who are responsible for payments, payroll or for the collection and reconciliation of fees only. Credit card information collected by us is submitted in encrypted format to our credit card merchant for payment approval and processing and is never held or retained by us. The CFPC is fully compliant with Payment Card Industry requirements and staff who handle such information are regularly and appropriately trained on safe payment handling practices.
We are dedicated to implementing the principles described in this Policy and to ensuring that our Policy and privacy practices are well known and understood by our staff, volunteers and stakeholders. To that end, this Policy is posted in a conspicuous place on our Website and staff receive periodic training on the Policy.
Changes to this Policy
We may amend this Policy from time to time as circumstances change, in response to legal and legislative changes, as new technologies become available, or as we introduce new features, programs, products or services. When we make changes to the Policy, we will revise the “last updated” date at the top of the Policy and will re-post the Policy on our Website and advise our staff. Policy changes will apply to information collected from the date of the revised Policy, as well as to existing information held by us at the time of the amendment.
Your continued use of our programs, products, services and Website after we make any changes to the Policy signifies your consent to the revised terms of the Policy.
You have a right to access and review the personal information that we hold about you in one of two ways:
If we have the requested information, and failing any reason not to fulfill the request, we will endeavour to provide your information to you within a reasonable time, generally no later than thirty (30) days following our receipt of your request. After reviewing your information, you may challenge the accuracy and completeness of the information we maintain, and request that the information be amended.
In certain cases, applicable law may allow or require us to refuse to provide you with access to some or all of the information we hold about you, or we may have destroyed, erased or de-identified the personal information about you in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reason(s) why. Examples of such situations include, but are not limited to where:
Any questions or complaints about our handling of your personal information, or any requests to access or correct your personal information, should be directed to the CFPC’s Privacy Officer:
Privacy Officer
The College of Family Physicians of Canada
2630 Skymark Avenue
Mississauga, Ontario L4W 5A4
Email: [email protected].
If your concerns are not resolved by us to your complete satisfaction, you are encouraged to contact the Federal Privacy Commissioner.
