Your Privacy – Our Commitment

What is personal/personal health information

Throughout this Policy, we use the terms “personal information” and “personal health information”. These terms are defined in various Canadian privacy laws and have slightly different meanings depending on what province you live in and how the laws of your province apply to your information. Generally, these terms are defined as information about an identifiable individual and can include things such as your name, address, birthdate, gender, provincial health card number, medical information, financial information, and employee information.

In British Columbia, we are governed by the Personal Information Protection Act (PIPA). This law refers to all your information, including your health information, as “personal information”.

In Ontario, we are governed by the Personal Health Information and Protection Act (PHIPA). This law specifically refers to your health information as “personal health information”.

In Saskatchewan, we are governed by the Health Information Protection Act (HIPA). This law specifically refers to your health information as “personal health information”.

In Alberta, we are governed by the Health Information Act (HIA). This law specifically refers to your health information as “health information”.

In instances where we collect information about you that is not related to your health care (specifically in provinces where there is no commercial privacy law), we are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). For these purposes, this act refers to your information as “personal information”.

How we collect and use your personal/personal health information

We collect and use personal/personal health information for specific purposes at LifeLabs. Below are examples of how and when we collect your information:

• When you receive healthcare at any of our Patient Service Centres, via a mobile collection, or through a virtual care interaction with our clinical staff
• When your information and/or samples are provided to us for testing by a third-party (like your health care provider or another healthcare facility)
• When you create an account for one of our electronic tools such as MyCareCompass, MyVisit or LaunchPad
• When you interact with us through one of our Customer Service Centres
• When you book an appointment online to visit one of our Patient Service Centres
• When you participate in a LifeLabs survey
• When you sign up to receive marketing emails or SMS messages
• When you purchase a product or service from us (in-person or online)
• When you consent to participate in research
• When you visit one of our websites
• When you apply for a job with LifeLabs
• When you otherwise interact with us

Healthcare Services

We collect personal/personal health information primarily to enable us to provide you with healthcare services. We also may collect your PI/PHI when it is indirectly provided to us by your health care provider, by one of our government partners, by your insurance company, by your province’s workplace safety regulators (i.e. WSIB, WorkSafe BC) or via an electronic health information exchange (which may include interfaces, secure file transfers, encrypted email, billing portals, etc.).

While the nature of PI/PHI you provide us will be unique to the service you are engaging in and your healthcare needs, in general, we may collect information such as your name, address, gender, birthdate, provincial health card number, phone number, healthcare provider information, personal and family medical history (as required), medical documents such as laboratory requisitions, and any additional information required to provide an accurate laboratory result (e.g. last time you ate).

In addition to providing you with healthcare services, we collect and use your PI/PHI for other lawful purposes as described in the various provincial privacy legislation (and federal privacy legislation as applicable), and may include:

• To verify your identity
• To provide you with quality laboratory services
• To contact you with critical results if your health care provider cannot be reached
• To match your specimens with your test results
• To plan, evaluate and monitor the services we provide to you
• To help detect, monitor or prevent fraud related to our services or any provincially-funded healthcare services
• For risk/error management purposes
• For educating future professionals where LifeLabs employs such professionals
• For research, quality improvement activities (such as sending patient satisfaction surveys), or statistical analysis
• To facilitate our contractual obligations with other healthcare providers who may be using our services to assist with their research that you have consented to be a part of (e.g. clinical trials where we collect samples on their behalf)
• To de-identify and create anonymized or synthetic data sets from information that has been collected through your use of our services. These data sets may be sold to third parties for commercial or health-related research.
• To facilitate transactions on our e-commerce site
• To obtain payment (including monitoring verifying or reimbursing claims) for services provided
• For any other purpose that may be identified to you before or at the time the information is collected
• For any other purposes mandated by law

As part of our delivery of care, we may also allow trusted partners to use your personal/personal health information on our behalf as permitted by law. These partners are required to adhere to strict privacy and security standards, as if they were our staff. These partnerships can include other accredited laboratory facilities within Canada, the United States, and the European Union, and companies which provide diagnostic technologies that assist us with providing you quality lab services.

For more information about referral and partner laboratories for specific lab tests, visit our Lab Test Information Directory and refer to the information provided under the header “Referral Laboratory”.

Electronic Tools

LifeLabs provides electronic tools to allow you to conveniently review your personal/personal health information and book health services. We also have tools which allow healthcare providers to access their patients’ results. These tools have Service-Specific Policies and may collect different information than what is described in this Policy. Refer to Service-Specific Policy for each service to learn more.

• MyCareCompass is our digital health portal that allows you to book appointments, view results, and access insightful information to guide your health journey. Use of this service requires an account that collects your full name, birthdate, email address, provincial health card number, and your Lab Visit Number which is provided to you at time of service. We use this information to create and administer your account, and to verify your identity. You may choose to add additional information to your account profile, though it is not required for the functionality of the product.
• MyVisit is our mobile laboratory specimen collection service that allows you to book appointments for a lab technician to come to you for sample collection. Use of this service requires an account that collects your full name, birthdate, provincial health card number, email address and/or mobile phone number, and a copy of your laboratory requisition provided to you by your healthcare provider. We use this information to provide you healthcare services, to verify your identity, and to monitor the MyVisit service.
• Launchpad is our online results portal for healthcare providers only. Use of this service requires an account that collects your full name, provincial billing number, practice address, phone number, fax number, email address, and the full name of any delegates who will access launchpad on behalf of your practice. This information is generally not subject to privacy laws as it pertains to you in a business capacity.

Contact Us

When you contact us to make an inquiry, provide feedback, or make a request, we may collect information about you such as full name, birthdate, provincial health card number, address, email address, phone and/or mobile phone number, and information regarding your LifeLabs visit history for the purpose of verifying your identity and to facilitate a response to your inquiry. In certain scenarios, we may require additional information to facilitate your request such as a Power of Attorney/Representation Agreement, Will or document showing a valid Estate Trustee, custody agreements, birth certificate or passport (to verify identity of minors under 12 years of age).

You may wish to communicate with us via email, and we will do so with your consent. Email is not considered to be a secure method of communication, so by choosing to communicate with us in this way you are accepting this risk.

Healthcare Services Surveys

From time to time, we may offer you the opportunity to participate in one of our surveys. We may use the information you provide to us to review and identify opportunities for improving our delivery of healthcare, or for any additional purposes which will be described to you prior to your participation in the survey.

Marketing Communications

When you opt-in to receive marketing communications from us, we collect and use your full name, email address and/or mobile phone number to provide you with marketing communications.

If you have opted-in to receive communications from LifeLabs about health information and services that are relevant to you through your MyCareCompass account, we may use certain aspects of your personal health information, such as your age, gender and lab test results to deliver targeted email communications to you. Opting-in to receiving these communications allows us to provide information, resources, and offers that align closely with your health needs and interests, supporting you in managing your health more effectively. By leveraging this information, we aim to enhance the value and relevance of our communications with you

We may reach out to you with marketing emails related to your engagement with our services, including scenarios such as:

• Products, services, and subscriptions from LifeLabs and its partner organizations which may benefit you, including special offers and promotions on these products and services
• Lifestyle management programs and educational content relevant to your specific health conditions
• Reminders related to services initiated but not completed
• Notice of active clinical trials for which you may be a good candidate

At times, these communications may describe services offered by third parties. We will not share your personal health information with third parties without your express consent and you may opt-out of these emails at any time by following the unsubscribe instructions included in each email, or as described below.

• Email – You may unsubscribe from marketing emails at any time by clicking the “unsubscribe” link at the bottom of the email, or by changing your communication preferences though your MyCareCompass or MyVisit account. You may continue to receive transactional or account-related communications even if you unsubscribe, as permitted by law.
• Text Messages – You may unsubscribe from marketing text messages at any time by texting “STOP” to the number you were contacted by. After you send the “STOP” message to us, we will send you a reply text to confirm you have been unsubscribed. Please note that standard text message rates may apply. Please contact your mobile phone provider for details.

Payment

LifeLabs uses an authorized third-party payment processor to facilitate payment. If you purchase a product, service or membership from us, we will collect and share with this authorized third-party your name and payment information (including billing address, credit card number, expiry date, CVV code) in order to process the transaction and enable us to provide you with the service you have purchased. LifeLabs does not collect or retain your payment information.

Research

We conduct and participate in health research initiatives. Depending on the initiative, we may use information such as your name, address, gender, birthdate, provincial health card number, phone number, healthcare provider information, personal and family medical history, medical documents such as laboratory requisitions, and your laboratory results. The use of this data is governed by strict privacy protocols and for purposes permitted by applicable privacy laws. To the extent possible, your data will be de-identified and/or anonymized when used for research purposes.

Education

As part of our commitment to train future professionals, your personal/personal health information may be used for lawful purposes by students to assist in subject-matter specific training within LifeLabs. Training occurs in conjunction with a LifeLabs professional. Students are required to undertake privacy training and sign a confidentiality pledge.

Careers

If you use our website to apply for a job with us, you will be asked to provide personal information about yourself, including your resume, cover letter or other employment-related materials and/or questions. We use this information for the purpose of processing and responding to your application. For more information relating to the collection and use of your personal information for employment-related purposes, please contact careers@lifelabs.com.

Website

When you interact with our website, we may collect personal information about you (including your computer or device) for the purposes of improving the services we offer, delivering personalized features to you, analyzing trends, improving the design of our website, monitoring the success of our marketing activities, and otherwise enhancing our Services. We use technologies like cookies and web beacons to gather information.

• Cookies – Our website collects non-identifiable location information to assist in directing you to the information specific to the province you are viewing from.
• Website Analytics – We use a third-party service to analyze non-identifiable web traffic data.
• Mobile Device – If you use a mobile device to access our Services, we may collect information about your device including information about your device’s hardware, operating system, device name, unique device identifier.

LifeLabs operates an e-commerce platform which is connected to our website. This platform uses third-party software with servers located in the US. In order to process your order, this third-party may be provided your full name, address, birthdate, provincial health card number, email address and/or mobile phone number, and a copy of your laboratory requisition if applicable. LifeLabs requires all third parties to enter into legally binding agreements which impose strict privacy and security controls.

Sharing personal/personal health information

We do not share your personal/personal health information without a valid legal authority to do so. The law permits us, and may require us, to share with certain people and/or organizations and under certain circumstances. We review each request and partnership thoroughly prior to sharing.

Healthcare Providers

We will share your PI/PHI with your healthcare provider(s) who is assisting in your care (often referred to as those in your “circle of care”) for the purpose of facilitating your care.

Service Providers

We may share your information with service providers who are working on our behalf to assist with providing quality services. They are required to strictly adhere to privacy and security standards that we put in place and they are only provided with the information that is required to perform their services and no more. Examples of service providers that we would contract with may include other laboratory service providers located throughout the world; businesses that provide us technology to assist with lab specimen processing, result interpretation, home sample collection kit processing, e-commerce transactions, and payment processors.

Third Parties

We may share your information with third parties such as applicable public health authorities (e.g. BCCDC, PHSA, PHO, PHAC, various municipal public health units), provincial workplace insurance boards (e.g. WSIB, WorkSafeBC), provincial laboratory repositories (e.g. OLIS, PLIS), insurance companies (with consent), law firms (with consent) and other healthcare service organizations. When sharing with third parties, we utilize data minimization principles and techniques, which means that we only provide the minimal amount of information necessary to fulfill the purpose of the request. Unless we are legally required to provide specific information, we use de-identification or anonymization principles. This means that we remove all information that may identify you such as your name, address, provincial health card number, and phone number and any other set of variables that may indirectly identify you. These principles considerably reduce or eliminate the risk that you will be identified and are considered best practice when sharing information. We may receive compensation for sharing de-identified and/or anonymized information for the purposes of health-related research.

Research

We may share your information for research purposes where there is a legal authority to do so.

Required Legal Disclosures

We may share your information with police or other legal entities when presented with a court order, warrant, subpoena, summons, or if it is permitted by law.

Risk of Harm

We may share your information to eliminate or reduce a significant risk of serious bodily harm to yourself or another person or group as permitted by law.

Other

We may share your information for any other purpose that is permitted or prescribed by law.

Storage, location and transfer of personal/personal health information

We conduct our business in Canada and all personal/personal health information in our possession is stored here. There may be times when we partner with third parties who operate outside of Canada and your information may be transferred to these partners. These transfers are only done to assist in your diagnostic testing and are done lawfully. For more information about where your lab samples may be tested, visit our Lab Test Information Directory and refer to the information provided under the header “Referral Laboratory”.

We employ strict safeguards to ensure the safe and confidential transfer and storage of your information and require that all third parties have equivalent or greater privacy protections than you would have in Canada. When your information is stored in another jurisdiction, it may be accessible to their courts, law enforcement and national security authorities. If you do not want your information transferred to, or stored outside of Canada, you should not use our services.

Retention of your personal/personal health information

We retain your information for the duration of time required to meet our legal, accreditation, or business requirements. This varies depending on the type of information and/or the sample collected. When retention is reached, all information is securely destroyed using industry-standard methods.

Safeguards

We take the privacy and security of your information seriously and employ administrative, technical and physical safeguards to protect your information from loss, theft, unauthorized access, use or disclosure. Examples of these controls are listed below:

• Administrative: Role-based access utilizing the “need-to-know” principle; annual staff training & signing of the confidentiality pledge; privacy impact assessments; policies and procedures; contracts with third parties and service providers.
• Technical: Access controls to our systems; strong passwords and multi-factor authentication; use of encryption; system logging and monitoring; firewalls and anti-virus/anti-spyware software; threat risk assessments.
• Physical: Workstation security; locking filing cabinets for paper records; restricted access to our facilities; video surveillance in designated, common areas.

Access of your personal/personal health information

We offer multiple ways to gain access to your personal/personal health information:

• Online: You can access your test results though our MyCareCompass portal when you register for an account. Most test results are available in MyCareCompass, though we may not post results that are sensitive in nature; results that are controlled by regulatory requirements; results sent to a government lab for analysis; or results that are required to be reported directly to the ordering physician.
• In-person: You may request copies of your results to be mailed to you by completing our Access Form and dropping it off at your local Patient Service Centre.
• My Mail: You can mail the Access Form to the most appropriate location as listed on the form.
• By Phone: You can contact the Customer Care team in your province to request paper copies of your report to be mailed to you. British Columbia: 1-800-431-7206; Ontario: 1-877-849-3637

Please note that if you are requesting paper copies of your results, or those of someone whom you are legally acting on behalf of, we will require you to confirm your identity and if applicable, the identity of the other person and proof of your legal authority to receive that person’s results (e.g. Parent/Guardian, Power of Attorney (ON), Representation Agreement (BC), confirmation of Estate Trustee, valid Will, etc.). Acceptable forms of identification could be a driver’s license, birth certificate, provincial health card, passport. If you choose to not provide this information, please expect a follow up call from our Customer Care Team staff to verify your identity or the identity of the individual you are acting on behalf of. We do not store copies of your identification. All identification is securely disposed of once your request is processed.

There may be a fee associated with receiving paper copies of your results. The fee will be communicated to you prior to results being provided to you. Payment options will be provided to you at the time you are provided the fee estimate.

Special Note Regarding Children 12 years and up (“Mature Minors”): Privacy laws assume that every person is capable of making decisions about their own healthcare unless proven otherwise. The generally accepted practice in Canada is that once you are 12 years old, you become capable of making your own healthcare choices. Though we recognize that this does not apply to all, we respect a Mature Minor’s capacity to consent, and as such will always ask for their permission before releasing results to someone other than themselves.

Managing your consent

We operate on the implied consent model for healthcare purposes. This means that when you receive service from us, or we receive a sample for testing that has been provided to us by your healthcare provider, we assume that you have consented to our collection, use and sharing of your information as described in this Privacy Policy. You can withdraw your consent at any time, subject to legal, regulatory or contractual restrictions. If you choose to withdraw your consent it may affect the services we provide you.

Withdrawing your consent does not have a retroactive effect and will not retrieve information that has already been collected, used, or shared with other parties. If you have concerns about how your information has been used or shared, or wish to apply a consent directive where possible, please contact privacy@lifelabs.com for further guidance. Please note that LifeLabs does not have the ability to lock, block, or hide information that has been sent to provincial repositories like OLIS (ON), PLIS (BC), or any of the provincial electronic health records (ClinicalConnect™ [ON], ConnectingGTA [ON], Health Gateway [BC]). To apply a consent directive in any of these systems, please contact them directly.

Accountability and contact information

Every person who collects, uses or discloses personal/personal health information on our behalf is accountable for handling that information in accordance with this Policy. Ultimate accountability for protecting your personal/personal health information at LifeLabs rests with the Chief Executive Officer and Board of Directors, though the Chief Privacy Officer is the lead executive accountable for LifeLabs’ privacy commitments and compliance.

If you have any questions or concerns about LifeLabs’ compliance with this Privacy Policy, you may contact the Privacy Office using your preferred contact method below:

• Telephone: 1-844-783-6677
• Email: privacy@lifelabs.com
• Mail: LifeLabs Privacy Office, 100 International Blvd., Toronto, ON, M9W 6J6

If you have concerns about our handling of your personal/personal health information, you may contact the Privacy Commissioner in your province.

• Ontario: https://www.ipc.on.ca/about-us/contact-us/
• British Columbia: https://www.oipc.bc.ca/about/contact-us/
• Saskatchewan: https://oipc.sk.ca/contact-us/
• Alberta: https://oipc.ab.ca/about-us/contact-us/

Policy updates

We may revise this Policy from time to time. All updates to this Policy will be posted on our website. An updated policy will supersede all previous versions. Your continued use of our services after we have posted the updated Privacy Policy on our website constitutes acceptance of such changes. We may also notify you by email (if we have a valid email address on file) if material changes are made to this Policy or any Service-Specific policies.

Last Updated: January 23, 2024