1. Accountability Custom Group Services is responsible for maintaining and protecting personal information in its possession or control, including information that has been transferred to a third party for processing.

 

2. Identifying Purposes The purposes for which personal information is collected will be identified at or before the time the information is collected. This will generally be done through application or claim forms.

 

3. Consent The knowledge and consent of the individual are required for the collection, use or disclosure of personal information except where required or permitted by law.

 

4. Limiting Collection The collection of personal information will be limited to that which is reasonably necessary for the purposes identified by Custom Group Services.

 

5. Limiting Use, Disclosure, and Retention Personal information will only be used or disclosed for the purpose for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained only if necessary for the fulfillment of those purposes. Custom Group Services will provide information concerning a client’s contract to a new broker if that client’s existing broker is no longer willing or able to provide service to the client, and the client has provided written consent.

 

6. Accuracy We will maintain personal information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. It remains the responsibility of the contract-holder and covered member to inform Custom Group Services of changes to personal information which may affect coverage.

7. Safeguarding Client and Member Information Personal information will be protected by security safeguards appropriate to the sensitivity of the information. This principle is significant because Custom Group Services deals with highly sensitive information concerning the health of our clients. The security safeguards will protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. The methods of protection will include:

 

• physical measures (eg. building access cards for employees, off-site backups, archiving);

• organizational measures (eg. limiting access on a “need-to-know” basis); and

• technological measures (eg. the use of passwords).

​

​

8. Openness We will make available to individuals and corporate members specific information about our policies and practices relating to the management of personal information.

​

​

9. Individual Access Upon request, an individual will be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended as appropriate. In certain situations, Custom Group Services may not be able to provide access to all the personal information it holds about an individual. Exceptions to the access requirement will be limited and specific, and the reasons for denying access will be provided to the individual upon request. Exceptions may include information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege.

​​

​

10. Challenging Compliance An individual may address a challenge concerning compliance with this policy to Custom Group Services privacy officer.