Confidentiality policy
This policy sets out the rules applied by the Institut national de santé publique du Québec (INSPQ) to protect personal information in compliance with the Act respecting access to documents held by public bodies and the protection of personal information.
Websites covered by the confidentiality policy:
Collection and use of personal information
The INSPQ collects and uses only the personal information required to fulfill its mission. It takes the steps required to protect this information, in accordance with the law.
“Personal information” is any information concerning a natural person that directly or indirectly allows that person to be identified (for example, by associating it with other information).
Means of collecting personal information
Personal information can be collected by various means: directly from individuals, through an intermediary or by technological means.
Directly from individuals
When you contact the INSPQ by telephone, email or mail or when you visit the INSPQ’s websites, for example, to:
- Fill out a form
- Take a survey
- Apply for a job at the INSPQ
- Make a request concerning your personal information or a file that concerns you
- Send comments or file a complaint
Through third parties
The INSPQ may collect personal information from an intermediary, such as a health professional, service provider or other public organization.
Use of cookies
The INSPQ uses cookies to optimize your experience on its websites. Cookies are small files that are stored on your device. They are used to store information and facilitate your browsing and do not allow you to be identified directly.
Some of these cookies are essential to the proper operation of websites, while others are used for statistical purposes and to improve services. With the exception of those necessary for the proper operation of the website, you can decide what types of cookies you accept when you arrive on the website.
Essential cookies (mandatory)
Some cookies are essential to the optimal organization and display of web pages. These essential cookies help make a website usable and secure by enabling basic functions such as forms. Websites cannot function properly without these cookies. They are therefore mandatory.
Performance cookies
Performance cookies, such as those used by Google Analytics, are used to identify problems and gather information and statistics on web content usage patterns. This anonymous data is analyzed to improve the operation of websites.
Automatic exchange of information
When you access an INSPQ website, information is exchanged automatically between your device and the INSPQ server. The following information is exchanged:
- Internet domain name (examples: “xcompany.com” if you are using a private internet access account, or “university.edu” if you are accessing the site through a university)
- IP address used to access our website (an IP address is an identification number automatically assigned to your device by your internet service provider)
- Types of equipment and configuration used to access our website: browser (examples: Edge or Google Chrome), operating system (examples: Microsoft or iOS), etc.
- Date and time you access the site
- Pages visited
- Address of referring site, if you arrive at our website via another website
Disclosure of personal information to third parties
The INSPQ may communicate certain personal information to third parties, in accordance with the Act respecting access to documents held by public bodies and the protection of personal information.
The type of information communicated depends on the situation. For example, the INSPQ may transmit personal information to public authorities or to a company as part of the performance of a service contract. It may also communicate certain personal information to third parties for the purposes of studies, research and statistical production in the field of public health.
Disclosure of personal information outside Québec
The INSPQ may occasionally disclose personal information when collaborating with another provincial or a federal organization.
Before disclosing personal information, the INSPQ conducts a privacy impact assessment to consider all factors that may have an impact on privacy, and assesses whether the information will be adequately protected. A contract or agreement with the organizations to which the information is disclosed includes appropriate security measures.
Protection of personal information
Access to personal information
Personal information is accessible only to employees who are duly authorized to use it and who require it to perform their duties.
Security measures
Various measures have been put in place to adequately protect personal information against loss, theft and any unauthorized access, use or disclosure:
- Physical measures (control of access to buildings, workspaces and filing areas, etc.);
- Technological measures (firewalls, encryption, multi-factor authentication, etc.);
- Organizational measures (privacy and information security governance framework, contractual clauses, etc.).
Retention and destruction of personal information
Personal information is retained only as long as necessary for the fulfillment of the purposes for which it is held by the INSPQ, and as prescribed by the retention schedule approved by the Bibliothèque et Archives nationales du Québec. It is then destroyed in a secure and confidential manner.
Rights of individuals respecting their personal information
The rights of persons whose personal information is held by the INSPQ are:
- The right to access their personal information;
- The right to have their personal information corrected or updated;
- The right to file a complaint.
To exercise these rights, the person concerned must contact the person responsible for access to documents and the protection of personal information.
Updating of the privacy policy
This privacy policy may be amended from time to time to maintain compliance with the law and to reflect any changes to the personal information collection process. Prior notice will be given of any changes to the policy, specifying the general purpose of the changes and the date they take effect.