Privacy Policy

Introduction
At AboutFace, we are committed to maintaining the accuracy, confidentiality, and security of all Personal Information we receive, including Personal Health Information (“PHI”). This policy (the “Privacy Policy”) describes the information that AboutFace collects, how we use it, how we manage it, as well as to whom and under what circumstances we disclose it.

AboutFace is committed to protecting the privacy of all its stakeholders, including, our community members and their families, donors, social workers, health professionals, volunteers, and our employees. During the course of AboutFace’s various programs and services, Personal Information and PHI may be gathered, stored, used, and disclosed to help facilitate our work.

Definitions
“Personal Information” means any information about an identifiable individual or relating to an identifiable individual, such as, their date of birth, gender, home address, telephone number, email address, amounts donated, and income information.

“Personal Health Information”, or PHI, means any health information about an identifiable individual, such as physical or mental health information, information relating to facial differences, and family medical history.

Consent and Openness
AboutFace is open about the ways in which Personal Information and PHI is collected and used. When an individual provides Personal Information or PHI to AboutFace, they are providing consent for the collection, storage, use, and disclosure of such information in accordance with this Privacy Policy and applicable legislation.

Individuals may withdraw consent at any time, with reasonable notice to AboutFace. Consent can be withdrawn by emailing our Privacy Officer, Executive Director, Danielle Griffin: danielle@aboutface.ca.

Please note, failure to provide Personal Information or PHI may prevent AboutFace from being able to provide an individual with programs and services.

Policy of Compliance
This Privacy Policy is subject to the applicable laws of the jurisdictions in which we operate. It is AboutFace’s policy to comply with the privacy legislation in each of these jurisdictions. Specific privacy practices may be adopted to address the specific privacy requirements of particular jurisdictions. If you are unsure if or how the Privacy Policy applies to you, please contact our Privacy Officer for more information

The Nature of Personal Information and PHI Collected
AboutFace collects and maintains different types of Personal Information and PHI. Examples of the type of Personal Information and PHI collected by AboutFace include your:
age and date of birth;
-gender;
-home address;
-telephone number or email address;
-donation information, including amounts donated;
-income and financial information, including credit card information;
-physical or mental health information, including information relating to facial differences; and
-family medical history.
The above is not a complete list of all of the kinds of Personal Information or PHI that may be collected, stored, used, or disclosed by AboutFace. In addition to the examples listed above, we will collect, store, use, and disclose any other information that is reasonably needed to carrying out our services and operations. AboutFace also collects information related to the usage of its website, including all information submitted to the website as well as website usage data and analytics. The collection of Personal Information and PHI shall be limited to that which is necessary for the purposes identified by AboutFace.

Whenever possible, AboutFace will receive Personal Information or PHI directly from an individual or their parent or guardian. At times, with consent from an individual and/or their parent or guardian, such information may be obtained from a third-party. This information may be collected electronically, in printed format, via telephone call, or via email. Where Personal Information or PHI is obtained from a third-party, we will take reasonable steps to ensure that such third parties have represented to us that they will comply with applicable privacy laws, and have the right to disclose your Personal Information or PHI to us.

The Use of Personal Information and PHI
The purposes for which AboutFace may collect Personal Information or PHI include:
-ensuring program or service registration and delivery;
-determining program, service, employment or volunteer eligibility;
-assessing participant needs;
-establishing and maintaining responsible relationships with our participants, members, donors, parents/guardians, staff, and volunteers;
-facilitating staff and volunteer recruitment;
-facilitating gift and donation processing, as per Canada Revenue Agency guidelines;
-engaging in outreach, awareness, and advocacy work, including fundraising initiatives and conducting public education;
-collecting data for statistical purposes;
-administering, managing, planning, researching, and allocating resources within AboutFace; and
-meeting any legal or regulatory requirements.

The above is not a complete list of all of the purposes for which Personal Information or PHI that may be used by AboutFace. In addition to the examples listed above, the information that we collect may used in any other way that is reasonably necessary for the carrying out of our services and operations.

If you provide us with your postal address, email address, or telephone number, you may receive periodic communication regarding AboutFace’s programs and services or upcoming events or responding to any request you have made.

Disclosure of Personal Information and PHI
Under no circumstances does AboutFace sell, rent, or lease Personal Information or PHI to third parties. Personal Information and PHI will be disclosed only to those AboutFace staff members, volunteers, and third-party partners that need to know such information for the purposes of their work or official duties. Disclosures of Personal Information or PHI may happen verbally or via electronic means, such as through fax or through the internet, as part of the requirements of donation processing and programs facilitation.

Under certain exceptional circumstances, AboutFace may have a legal duty or right to disclose Personal Information or PHI without the individual’s knowledge or consent and this duty or right may be acted upon by AboutFace.

Personal Information or PHI is kept for a period of time as defined by best practices and legal requirements, and may extend beyond a person’s relationship with AboutFace.

Storage of Personal Information and PHI
Personal Information or PHI shall be protected by reasonable security safeguards appropriate to the sensitivity of the information. AboutFace’s safeguards are intended to protect against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification, regardless of the format in which the information is held. Measures of protection include training staff and volunteers, physical measures, and technological measures. AboutFace cannot and does not guarantee that these measures will be successful.

AboutFace uses online application forms and electronically stores confidential information related to donations and program participants, including Personal Information and PHI. When you make a donation to AboutFace online, a secure connection is established and information is encrypted to prevent interception during the transaction.

AboutFace makes reasonable efforts to ensure all information is kept securely and under password. AboutFace does not warrant that services and the data stored through the use of online platforms are secure or that they are not susceptible to intrusion, attack, or computer virus infection.

AboutFace ensures employees and volunteers are aware of the importance of maintaining the confidentiality of Personal Information and PHI. All employees and volunteers are required to sign a confidentiality waiver. Third party consultants are expected to safeguard Personal Information and PHI entrusted to them in a manner consistent with the policies of AboutFace and applicable privacy legislation, and are required to sign a confidentiality agreement as part of all contracts.

Data Processing and Storage Outside of Canada
As mentioned, AboutFace may utilize digital data storage technologies and, at times, we may also engage third parties to perform services on our behalf. In doing so, data may be stored, processed, and transferred to servers located outside of Canada in jurisdictions whose data protection laws may differ from those of Canada, such as the United States of America. As a result, Personal Information and PHI may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to the laws of those jurisdictions. For example, information may be shared in response to valid demands or requests from government authorities, courts, and law enforcement officials in those countries. Subject to applicable laws in such other jurisdictions, we will use reasonable efforts to ensure that appropriate protections are in place to require third parties to maintain protections on Personal Information and PHI that are equivalent to those that apply in Canada.

Accuracy
Every effort is made to ensure that all Personal Information and PHI collected is as accurate and as current as possible. AboutFace relies on individuals to disclose all relevant information at the time of collection as well as subsequently when updates are required. Individuals are requested to notify AboutFace of any change in Personal Information or PHI.

Individual Access and Correction
Upon request, with limited exceptions, an individual shall be informed of the existence, use, and disclosure of his or her Personal Information or PHI and shall be given access to that information. Individuals can request updates of their information and are able to challenge the accuracy or completeness of the information.

Such requests must be made in writing and be addressed to AboutFace’s Privacy Officer.
Privacy and Our Website

Cookies: When an individual visitor accesses the AboutFace website, we may use a browser feature called a ‘cookie’ to collect information such as the type of Internet browser and operating system the visitor uses, the domain name of the website from which the visitor came, date and duration of the visit, number of visits, average time spent on our website, pages viewed and number of cookies accumulated. A cookie is a small text file containing a unique identification number that identifies the visitor’s browser, but not necessarily the visitor, to our computers each time our website is visited. Unless a visitor specifically informs us (e.g. by registering for an event or sending us correspondence from the website), we will not know who the individual visitors are. In addition to the identified purposes described in our Privacy Policy, we may use this website information and share it with other organizations with whom we have a relationship to measure the use of our website, to improve the functionality and content of the website and to facilitate usage by a visitor. Visitors can reset their browsers either to notify them when they have received a cookie or refuse to accept cookies. However, if a visitor refuses to accept cookies, he or she may not be able to use some of the features available on our website.

Links: Our website may contain links to other websites which are provided as a convenience only. Visitors are advised that other third party websites may have different privacy policies and practices than AboutFace, and AboutFace has no responsibility for such third party websites.

Changes to the Privacy Policy
AboutFace reserves the right to modify or supplement this Privacy Policy at any time. Please check back from time to time to ensure that you are aware of any updates or changes to this Privacy Policy. We will post the most current version on our website and we will indicate the date this Privacy Policy was last revised at the top of the page. Your continued access or use of this website after any such changes constitutes your acceptance of the Privacy Policy as revised. AboutFace will obtain the necessary consents required under applicable privacy laws if it seeks to collect, use, store, or disclose your Personal Information or PHI for purposes other than those to which consent has been obtained unless otherwise required or permitted by law.

Accountability and Compliance Concerns
AboutFace has designated its Executive Director as its Privacy Officer responsible for ensuring compliance with this Privacy Policy.

Questions, concerns, or complaints relating to this Privacy Policy or the treatment of Personal Information or PHI should be e-mailed to AboutFace’s Co-Executive Directors Adriana and/or Namrit at: info@aboutface.ca or 416-597-2229. You can also write to us at:

Privacy Officer
AboutFace
51 Wolseley St.
Toronto, ON M5T 1A4

Further information on privacy and your rights in regard to your Personal Information may be found on the website of the Privacy Commissioner of Canada at www.priv.gc.ca.

The Privacy Policy was last revised: August 5th, 2020