Privacy Policy

1. Introduction

Lakeshore Medical & Wellness Clinic (“Lakeshore Clinic,” “the Clinic,” “we,” “our,” or “us”) is committed to protecting the privacy, confidentiality, and security of personal information and personal health information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit our website at https://thelakeshoreclinic.com/, book an appointment, register for our services, participate in a telemedicine consultation, or otherwise interact with the Clinic.

We handle personal health information in accordance with applicable privacy laws, including Manitoba's Personal Health Information Act (PHIA), where applicable, and other applicable Canadian privacy legislation.

This policy applies to patients, prospective patients, website visitors, and individuals who communicate with the Clinic. Healthcare providers who register to offer services through the Clinic may also be subject to separate privacy notices, provider agreements, and professional confidentiality obligations.

This Privacy Policy should be read alongside our Patient Terms of Service & Telemedicine Informed Consent, our applicable Cancellation and Refund Policy, and any additional consent forms required in connection with healthcare services.

Where consent is required by law, we will obtain it before collecting, using, or disclosing information for the relevant purpose. Accessing our website does not, by itself, constitute consent to every use or disclosure described in this policy.

2. Information We Collect

The information we collect depends on the services you use and your interactions with the Clinic.

2.1 Personal Information

We may collect identifying and contact information, including:

• Full name and preferred name.
• Email address and telephone number.
• Date of birth and gender, where required for care or administration.
• Residential or mailing address.
• Emergency contact information, where applicable.
• Account registration details and communication preferences.

2.2 Personal Health Information

When you seek or receive healthcare services, we may collect personal health information necessary to provide and manage your care, including:

• Medical history and relevant family health history.
• Symptoms, diagnoses, clinical assessments, and treatment information.
• Prescriptions, medications, and allergies.
• Consultation notes and communications with healthcare professionals.
• Laboratory results, referrals, medical reports, and uploaded documents.
• Information relating to appointments, follow-up care, and treatment outcomes.
• Personal Health Information Numbers (PHINs) and other health identifiers, where required and permitted by law.

We collect information reasonably necessary for the identified purpose, subject to applicable legal requirements.

2.3 Insurance and Billing Information

Where applicable, we may collect insurance details, coverage information, policy identifiers, billing records, invoices, and information required to process eligible claims or payments.

2.4 Payment Information

Where online payments are offered, payment transactions may be processed through third-party payment service providers, including Stripe if used by the Clinic.

We may receive transaction confirmations, payment status, billing details, and limited payment-related information. Payment card details may be collected and processed directly by the relevant payment provider.

The Clinic's handling of payment card information depends on the payment integration in use. We will not represent that card information is never stored by any system unless this has been verified.

2.5 Technical and Website Usage Information

When you access our website or online services, certain technical information may be collected, including:

• Internet Protocol (IP) address.
• Browser type, operating system, and device information.
• Pages visited and interactions with website features.
• Dates, times, and duration of website access.
• Diagnostic, performance, and security logs.
• Cookie identifiers and similar technical data, where applicable.

2.6 Information Provided by Other Sources

Where permitted by law and necessary for your care, we may receive information from authorized healthcare providers, laboratories, insurers, referral sources, or individuals legally authorized to act on your behalf.

3. How We Use Your Information

We may use your information for the following purposes, where permitted or required by law.

3.1 Healthcare Delivery

• Assess your health concerns and provide appropriate healthcare services.
• Conduct in-person and telemedicine consultations.
• Maintain patient records and support continuity of care.
• Coordinate referrals, investigations, prescriptions, and follow-up care.
• Communicate clinically relevant information to authorized healthcare professionals involved in your care.

3.2 Appointment and Account Management

• Schedule, confirm, reschedule, and manage appointments.
• Create and administer patient accounts, where applicable.
• Send appointment reminders and service notifications.
• Respond to enquiries and provide administrative support.
• Verify identity when necessary to protect patient information.

3.3 Payments and Administration

• Process payments, invoices, and eligible insurance-related requests.
• Maintain accounting and administrative records.
• Manage service-related complaints and enquiries.

3.4 Website Operations and Security

• Operate, maintain, and improve our website and digital services.
• Diagnose technical issues and monitor system performance.
• Detect and investigate unauthorized access, fraud, and security incidents.
• Maintain appropriate system and access logs.

3.5 Legal and Regulatory Obligations

• Comply with applicable privacy, healthcare, professional, tax, and recordkeeping requirements.
• Respond to lawful court orders, regulatory requests, and other legally authorized demands.
• Exercise or defend legal claims where permitted by law.

We will not use personal health information for unrelated purposes unless permitted or required by applicable law or supported by valid consent where consent is required.

4. Consent and Your Choices

We recognize that patients have rights concerning their personal information and personal health information.

Where consent is required, we will seek consent in accordance with applicable law. Depending on the circumstances, consent may be obtained through written forms, electronic processes, or other legally recognized methods.

You may withdraw consent for certain uses or disclosures where consent is the legal basis for the activity and withdrawal is permitted. Withdrawal does not invalidate processing already carried out lawfully, and it may not affect uses or disclosures that are independently authorized or required by law.

Withdrawing consent may affect our ability to provide particular services. We will explain relevant limitations where appropriate.

You may also opt out of non-essential communications where applicable. Essential communications concerning appointments, treatment, billing, security, or legal obligations may continue when necessary.

Acknowledging this Privacy Policy does not automatically constitute consent to every possible use or disclosure of personal health information. Where separate consent is legally required, we will seek it separately.

5. Data Sharing and Disclosure

We do not sell personal information or personal health information.

We may disclose information in the following circumstances, subject to applicable legal requirements.

5.1 Healthcare Professionals

Information may be shared with authorized physicians, nurses, specialists, and other healthcare professionals involved in providing or coordinating your care, where permitted by law and necessary for the relevant purpose.

5.2 Service Providers and Information Managers

We may engage third-party organizations to support the Clinic's operations, including:

• Website hosting and cloud infrastructure providers.
• Electronic medical record and practice management providers.
• Appointment scheduling and telemedicine platforms.
• Email, messaging, and communications providers.
• Payment processors.
• Information technology, cybersecurity, and technical support providers.

These providers may access or process information only as authorized and necessary to perform their contracted functions. Where required, we will establish appropriate contractual, confidentiality, and security safeguards.

We will take reasonable steps to ensure that third parties handling information on our behalf protect it appropriately and use it only for authorized purposes.

5.3 Legal and Regulatory Disclosures

We may disclose information where required or authorized by law, including to courts, regulators, law enforcement authorities, or other authorized recipients.

5.4 Other Permitted Disclosures

Information may also be disclosed where permitted by applicable healthcare privacy legislation, including in circumstances involving authorized representatives, continuity of care, public health, or the protection of individuals, where the relevant legal conditions are satisfied.

We assess disclosures of personal health information in accordance with applicable law. We do not assume that information can be shared merely because a third party requests it.

6. Data Storage and International Processing

The Clinic may use third-party systems to store, transmit, or process information in support of its operations.

Depending on the providers and systems used, information may be processed or stored in Canada or other jurisdictions. Where information is handled outside Manitoba or Canada, it may be subject to the laws of the relevant jurisdiction.

We will assess applicable privacy and contractual requirements when selecting and using third-party providers. We will not claim that all patient information is stored exclusively in Canada unless the Clinic has verified that this is the case.

For questions about the systems used to handle your information, please contact the Clinic using the details in Section 12.

7. Data Security and Access Controls

We use administrative, technical, and physical safeguards designed to protect personal information and personal health information against unauthorized access, collection, use, disclosure, alteration, loss, and destruction.

Depending on the systems and services involved, safeguards may include:

• Access restrictions based on authorized duties and legitimate need.
• Authentication and account security measures.
• Encryption and secure communication channels where supported and appropriately configured.
• Security monitoring and logging.
• Staff confidentiality obligations and privacy procedures.
• Security assessments, incident response procedures, and appropriate staff training.
• Secure disposal of records when eligible for destruction.

Access to personal health information is restricted to authorized individuals who require access for legitimate purposes.

No electronic transmission or storage system can be guaranteed to be completely secure. Although we take reasonable steps to safeguard information, we cannot guarantee absolute security.

Patients should also take reasonable precautions to protect their accounts, devices, passwords, and communications.

8. Privacy Breaches and Security Incidents

The Clinic maintains procedures for identifying, assessing, investigating, and responding to suspected or confirmed privacy breaches and security incidents involving personal information or personal health information.

Where a breach occurs, we will take appropriate steps to contain the incident, assess potential harm, investigate its cause, and implement measures to reduce the likelihood of recurrence.

Where required by applicable law, including Manitoba's PHIA where applicable, we will notify affected individuals and the relevant oversight authority within the applicable timeframe and in the required manner.

A privacy breach may include unauthorized access to, use, disclosure, alteration, loss, or destruction of personal health information.

Patients who believe their information has been disclosed or accessed without authorization should contact the Clinic promptly using the contact information in Section 12.

9. Data Retention and Secure Destruction

We retain personal information and personal health information for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory, professional, and operational requirements.

Healthcare records may be subject to mandatory retention periods. Accordingly, requests to delete information cannot always be granted.

When information is no longer required and may lawfully be destroyed, we will take appropriate steps to ensure that it is securely destroyed or disposed of in accordance with applicable requirements and the Clinic's record-retention and destruction procedures.

Where information must be retained by law, we will continue to protect it in accordance with applicable privacy obligations.

10. Your Privacy Rights

Subject to applicable law and relevant exceptions, you may have the right to:

• Request access to your personal information and personal health information held by the Clinic.
• Request corrections to information that you believe is inaccurate or incomplete.
• Ask how your information is collected, used, disclosed, and protected.
• Request information about the purposes for which your personal health information is collected.
• Withdraw consent for certain activities where permitted.
• Raise concerns or submit a complaint about the handling of your information.

Access and correction requests will be handled in accordance with applicable legal requirements, including any relevant procedures, timelines, exceptions, and permitted fees.

Requests for deletion are subject to legal and professional record-retention obligations.

To protect patient confidentiality, we may need to verify your identity or the authority of a representative before responding to a request.

10.1 Making a Privacy Complaint

If you have a concern about how the Clinic handles your personal information, we encourage you to contact us first so that we can review and respond to the matter.

You may also have the right to submit a complaint to the Manitoba Ombudsman concerning access to or the privacy of personal health information.

Official information about personal health information rights is available at: Manitoba Ombudsman — Personal Health Information Rights .

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support website functionality, maintain user preferences, understand website usage, and improve performance and security.

Cookies may be categorized as essential or non-essential depending on their purpose.

You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the availability or functionality of some website features.

Where required by applicable law, we will provide appropriate notice and obtain consent before using non-essential cookies or tracking technologies.

The specific cookies and tracking technologies used will depend on the website's configuration and the third-party services integrated into it.

12. Contact Us

For questions about this Privacy Policy, requests to access or correct your information, or concerns about how your information is handled, please contact:

Please avoid sending sensitive medical information through ordinary email unless the Clinic has confirmed that the communication method is appropriate for that information.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, information-handling practices, technology, or legal obligations.

Any revised version will be published on our website with an updated revision date. Where required by law, we will provide additional notice or obtain consent for material changes.

We encourage you to review this policy periodically to remain informed about how the Clinic protects your information.