TELUS CHR Patient Privacy and Consent Information

Last updated: May 4, 2022

PLEASE READ THIS TELUS CHR PATIENT PRIVACY AND CONSENT INFORMATION CAREFULLY BEFORE ACCESSING OR USING ANY OF THE LISTED TELUS CHR APPS AND PRODUCTS. BY CLICKING THE “SIGN UP” BUTTON BEFORE USING ANY OF THE LISTED CHR APPS AND PRODUCTS AND PROVIDING YOUR PERSONAL INFORMATION, YOU CONSENT TO THE PROCESSING OF YOUR PERSONAL INFORMATION AS SET OUT IN THIS DOCUMENT AND MORE SPECIFICALLY, IN YOUR HEALTHCARE PROVIDER’S PRIVACY POLICY, STATEMENT OR SIMILAR DOCUMENT.

TELUS CHR APPS AND PRODUCTS

TELUS CHR Apps and Products. TELUS Health Solutions Inc. (“TELUS”) offers numerous apps and products you can use to

• register at your Healthcare Provider;

• request, confirm, reschedule or cancel your appointments;

• complete any healthcare-related questionnaires;

• receive from and send messages to your Healthcare Provider;

• conduct virtual visits with your Healthcare Provider;

• pay for healthcare services and

• provide your Personal Information and Personal Health Information from your third-party health apps.

Currently, such apps and products include the TELUS Collaborative Health Record electronic medical record solution (“CHR”) eBooking, Patient Portal, Virtual Visit, Intake, UpPatient and CHR Connect (together referred to as “CHR Apps and Products”).

In this document, “we”, “our” and “us” refer to TELUS. “You” and “yours” refer to an individual customer, client or patient of a Healthcare Provider to whom healthcare is provided and whose Personal Information and Health Record are Processed within the CHR Apps and Products.

DEFINITIONS

The following definitions apply to this document.

Healthcare Provider - Your individual healthcare provider, clinic or healthcare organization that provide or assist in the provision of healthcare.

Health Record - A record of your Personal Health Information. This may include but is not limited to:

• the name(s) of Healthcare Provider(s);

• patient identification information (e.g. name, address, phone number, personal healthcare number, contact person in case of emergencies, substitute decision-maker);

• health and medical history, including family health and medical history;

• clinical notes for each patient encounter;

• records of examinations carried out by Healthcare Providers;

• reports of the results of laboratory, pathology, consultations, diagnostic imaging examinations or tests and investigative procedures;

• diagnoses, care and treatment information;

• any photos you upload for use by your Healthcare Provider;

• requisitions for treatment or investigation;

• consents to treatment obtained in writing; and

• a record of missed and/or canceled appointments.

Personal Health Information - Any Personal Information regulated under Privacy Requirements in the provinces and territories in which your Healthcare Provider operates, including information that relates to an individual’s physical or mental health and healthcare, including health history, the provision of healthcare to the individual, payments or eligibility for healthcare, healthcare provider, substitute decision-maker, health card number or other healthcare-related personal identification numbers, or any other information that is collected in the course of providing healthcare services to the individual, including information contained in your Health Record.

Personal Information - Any information about an identifiable individual, other than business contact information used to contact the individual in their business or professional capacity. Personal Information includes your Personal Health Information.

Privacy Incident - Any incident of actual or suspected unauthorized or unlawful Processing, leading to the loss of or unauthorized access, use, modification, disclosure, acquisition or destruction of Personal Information.

Privacy Requirements - All applicable Canadian federal and provincial laws and professional regulations relating to the Processing, protection, or privacy of Personal Information.

Processing, Processes or Process - Any activity, any operation or set of operations that is performed on Personal Information whether or not by automated means, or that the relevant Privacy Requirements may otherwise include in the definition of collection, use or disclosure, including, but not limited to, collecting, using, disclosing, accessing, sharing, transferring, otherwise making available, recording, retrieving, retaining, maintaining, organizing, structuring, combining, analyzing, modifying, storing, erasing and destroying.

YOUR HEALTHCARE PROVIDER’S AND TELUS’ ROLES AND RESPONSIBILITIES

Your Healthcare Provider retains control of your Personal Information as the health information custodian or trustee of your Personal Information Processed within the CHR Apps and Products. Your Healthcare Provider remains overall responsible for protecting the privacy of your Health Record and other Personal Information and its compliance obligations under the applicable Privacy Requirements, including, but not limited to, providing any required notices to and obtaining any required consents from you, as their patient, and for the instructions it gives to TELUS with respect to the Processing of Personal Information.

TELUS provides the CHR Apps and Products to your Healthcare Provider as their service provider, agent, information manager or information management services provider in accordance with the applicable Privacy Requirements and contract to enable your Healthcare Provider to Process your Personal Information. TELUS does not have any legal relationship with you as the service provider of the CHR Apps and Products. TELUS is NOT a party to the relationship between you and your Healthcare Provider.

PURPOSES OF PROCESSING OF YOUR PERSONAL INFORMATION

The CHR Apps and Products Process your Personal Information as part of your Healthcare Provider’s TELUS CHR for healthcare-related communication, recording, sharing and payment purposes on behalf of your Healthcare Provider as more specifically set out in their privacy policy, statement or similar document.

TELUS will only Process your Personal Information to the extent, and in such a manner, as is necessary for the provision of the TELUS CHR Apps and Products and the related services and in accordance with your Healthcare Provider’s instructions and the applicable Privacy Requirements that apply to TELUS as a service provider.

YOUR PRIVACY CONSENT

By clicking the “Sign Up” button before using any of the CHR Apps and Products and providing your Personal Information, you consent to the Processing of your Personal Information that you provide for the purposes set out in this document and more specifically, in your Healthcare Provider’s privacy policy, statement or similar document. If you do not accept or agree with your Healthcare Provider’s privacy policy, please do not use any of the CHR Apps and Products.

You may withdraw your privacy consent at any time, subject to legal and other restrictions set out in your Healthcare Provider’s privacy policy and the Privacy Requirements. If you are interested in withdrawing consent at any time in the future, please speak with a staff member of your Healthcare Provider.

PROTECTING YOUR PERSONAL INFORMATION

Your Healthcare Provider is responsible for the protection of your Personal Information. TELUS has implemented appropriate technical and organizational measures designed to protect your Personal Information against Privacy Incidents.

TELUS will notify your Healthcare Provider of any Privacy Incident in accordance with the applicable Privacy Requirements and contract. Your Healthcare Provider has the sole right to determine whether to provide any applicable Privacy Incident notification to you, regulators, law enforcement agencies or others, as required by the Privacy Requirements or at their discretion.

YOUR HEALTHCARE PROVIDER’S COMPLIANCE

Your Healthcare Provider is responsible for complying with all Privacy Requirements that apply to the Processing of your Personal Information while using the CHR Apps and Products.

The types and Processing of your Personal Information and your related rights are governed by and set out in your Healthcare Provider’s privacy policy, statement or similar document. Please reach out to your Healthcare Provider to obtain a copy of and learn about their privacy policy and practices.

MINORS

You must be at least 16 years of age to access and use any of the CHR Apps and Products. If you are between 16 and the age of majority in your jurisdiction of residence, you must have the permission of a parent or guardian, and they must review this document on your behalf before accessing and using any of the CHR Apps and Products. The CHR Apps and Products may also be available for use by children, but the actual user of them for all patients under the age of 16 must be the patient’s parent or legal guardian. If you access and use any of the CHR Apps and Products as the parent or legal guardian on behalf of a minor, you are fully responsible for reviewing this document.

CONTACT

If you have any questions or complaints regarding the Processing of your Personal Information or wish to submit an access or correction request, please speak with your Healthcare Provider.

CHANGES

This document is subject to change by TELUS, at any time, at TELUS’ sole discretion. Upon any change to this document, TELUS will publish the amended version within the CHR Apps and Products. Such changes will be effective immediately upon your acceptance of the amended version or your first use of any of the CHR Apps and Products after the publication of the amended version.