Privacy Policy
The Mental Health Society of Greater Victoria (MHS) is committed to protecting the privacy and security of personal information in its care. This Privacy Policy is designed to assure all individuals interacting with MHS—whether as clients, donors, volunteers, event attendees, or others who have shown an interest in our organization—that our practices comply with the British Columbia Personal Information Protection Act (PIPA), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada’s Anti-Spam Legislation (CASL). This policy outlines how we collect, use, disclose, and safeguard personal information.
Definitions
MHS: The Mental Health Society of Greater Victoria.
MHS Services: Any offering provided by MHS, its affiliates, volunteers, or employees.
Collect (in relation to personal information): The act of gathering, receiving, or obtaining personal information from any source outside MHS, by any means.
Client: An individual who inquires about, applies for, or uses MHS products or services.
Disclose (in relation to personal information): The act of making personal information known or revealing it by any means.
Donor: An individual who has made or may make donations to MHS.
Personal Information: Any information that identifies an individual, including but not limited to name, age, gender, date of birth, language preferences, billing address, mailing address, phone number, email address, donation history, or other financial information.
Personal information also includes demographic data, health-related information, services accessed, supports received, and meetings with support staff.
Publicly available information about an individual in their capacity as an employee or volunteer (e.g., name, job title, work email address) is not considered personal information.
Services: Any offerings provided by MHS, its affiliates, volunteers, or employees.
Third Party: Any person, organization, or entity other than MHS, its employees, or its volunteers.
Use (in relation to personal information): Reviewing, accessing, employing, or applying personal information for any purpose within MHS.
Accountability
MHS is responsible for all personal information under its control. The Board of Directors is accountable for ensuring MHS’s compliance with the principles outlined in this Privacy Policy.
For inquiries regarding this Privacy Policy, contact:
The Mental Health Society of Greater Victoria
Attention: Shawn Chand
722 Cormorant Street 1st and 3rd Floors,
Victoria, BC
V8W 1P8
Email: privacy@mhsvictoria.org
MHS’s accountability extends to personal information in its physical or digital custody, as well as information transferred to third parties for processing. Contracts, agreements, or correspondence with third parties will require them to provide an appropriate level of protection for personal information while it is being processed.
Scope of the Privacy Policy
This Privacy Policy explains:
The types of information MHS may collect.
How MHS uses and discloses personal information.
How individuals may review or amend their personal information.
The steps MHS takes to safeguard personal information.
How updates to this Privacy Policy will be communicated.
This policy applies to all users of MHS platforms and services, including MHS websites, mobile applications, and other services. By accessing or using these platforms or providing information in connection with MHS services, individuals agree to the terms and conditions outlined in the most recent version of this Privacy Policy.
Use of Personal Information
The purposes to collect personal information will be identified in general terms and expanded upon if a more specific use case is presented to a client or donor.
When you use our online properties, we do not collect your email address unless you specifically provide it to us.
Our sites use “cookies” (small computer files transferred to your computer to track site visits) in a session-limited way. These temporary files enhance your use of our sites and do not typically remain on your computer after the session ends. You may block or delete cookies at your expense and responsibility. However, disabling cookies may limit access to certain features of the site.
We may use third-party website analytics services that do not collect personal information you do not voluntarily provide. These services do not track your browsing habits across unrelated websites. Information collected is used solely to improve site usability. Recordings from these services are anonymized.
Additionally, we may collect:
Information you directly provide: First and last name, phone number, age, pronouns, language preferences, geographic location, address, health information, insurance coverage, demographics, and any other information you voluntarily share.
Information provided on your behalf: Personal details shared by a referring individual, including your name, contact information, and health information.
Information from using our services: When you engage with our services (e.g., mobile app, peer support calls), complete forms, or contact us via email, phone, or web forms, we may collect details such as your name, address, communication details, and actions taken in response to your inquiry.
Device and usage information: Data such as hardware model, IP address, unique device identifiers, browser type, operating system, and usage patterns of our websites or mobile applications.
We use or disclose personal information for the following purposes:
Providing Services: To deliver services and fulfill the purpose for which you shared your personal information (e.g., responding to inquiries or providing location-specific services).
Administrative Purposes: To support MHS’s operations, including improving content, maintaining security, conducting research, and analyzing service usage.
Communications and Marketing: To send updates about our services, new offerings, upcoming events, surveys, and other announcements. You may opt-out of email marketing by using the "unsubscribe" function.
Legal Compliance: To meet municipal, provincial, federal, and regulatory requirements, including employment and risk management obligations.
Consent
The knowledge and consent of the individual, express or implied, are required for the collection, use, or disclosure of personal information by MHS, except where inappropriate.
MHS collects, uses, or discloses personal information with the individual’s permission. The method of seeking consent may vary depending on the sensitivity of the information and the reasonable expectations of the individual. Permission may be expressed in writing, implied, or provided verbally or electronically.
Individuals may withdraw their consent at any time, subject to legal or contractual restrictions and reasonable notice. MHS respects the right of individuals to opt out of further communication. Individuals may contact privacy@mhsvictoria.org to request removal from mailing lists or withdrawal of consent. MHS personnel will inform individuals of the implications of withdrawing their consent.
MHS ensures that staff involved in obtaining consent are appropriately trained in this Privacy Policy.
MHS may transfer personal information to third parties for processing. In such cases, MHS ensures that these third parties provide a comparable level of protection during processing.
MHS may lawfully collect, use, or disclose personal information without the individual’s knowledge or consent under certain circumstances, including:
When the collection is clearly in the individual’s interests and consent cannot be obtained in a timely manner.
When obtaining consent could compromise the availability or accuracy of the information and the collection is reasonable for purposes of an investigation or legal proceeding.
When the information is publicly available as specified in applicable regulations.
When collection is required or authorized by law.
MHS may disclose personal information without consent if such disclosure:
Is required or permitted by a treaty made under an Act or Regulation of British Columbia or Canada.
Is necessary to comply with a subpoena, warrant, or court order.
Assists a public body or law enforcement agency in Canada with an investigation of an offence.
Responds to an emergency threatening an individual’s health or safety, with notification to the individual where possible.
Facilitates contact with next of kin or a friend of an injured, ill, or deceased individual.
Is to a lawyer representing MHS.
Is for research or archival purposes, provided it is reasonable to do so.
Where permissible, MHS will notify individuals of subpoenas, warrants, or court orders for their personal information, using telephone or mail to the individual’s last known address.
Limiting Collection
MHS limits the collection of personal information to what is necessary for the purposes identified by the Board of Directors. Personal information is collected primarily from the individuals concerned. With consent, MHS may also collect personal information from third parties or partner organizations. If personal information is collected from a third party, MHS will document their identity unless prohibited by law.
MHS does not knowingly collect personal information about children under the age of 13. If such information is discovered, MHS will take steps to delete or de-identify it. Parents or guardians must provide express written authorization for the collection of information about youth aged 13 or older. If you believe a child under 13 has provided personal information, contact us as outlined in the “Accountability” section.
Limiting Use, Disclosure, and Retention
MHS will use or disclose personal information only for the purposes stated at the time of collection, except with the individual’s consent or as required or permitted by law. Personal information will be retained only as long as necessary to fulfill these purposes. Retention practices adhere to industry standards and extend for the duration of services provided to the individual by MHS.
MHS ensures the secure destruction, return, or anonymization of personal information no longer required for its purposes or legal obligations.
Accuracy
MHS will make reasonable efforts to ensure that personal information is accurate, complete, and up-to-date as necessary for the purposes for which it was collected.
MHS relies on individuals to provide updated information, such as changes to addresses and other contact details, at regular intervals. Upon receiving updates, MHS will revise personal information to reflect the original purposes for which it was collected.
Individuals are entitled to request corrections to their personal information if they believe it to be inaccurate or incomplete.
Safeguards
MHS employs reasonable security arrangements to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, modification, or disposal. These measures apply to all formats in which personal information is held.
The nature of MHS’s safeguards varies based on the sensitivity of the information, the amount, distribution, and format of the information, and the storage methods used. Sensitive personal information receives a higher level of protection.
Methods of protection include:
Physical measures: Locked filing cabinets and restricted access to offices.
Organizational measures: Security clearances and limiting access on a “need-to-know” basis.
Technological measures: Passwords, multi factor authentication, and encryption.
All staff and volunteers must adhere to MHS’s policies and procedures concerning personal information security.
When disclosing personal information to third parties, MHS ensures these parties have sufficient safeguards in place that meet MHS policies and comply with PIPA.
While MHS employs commercially reasonable measures to protect personal information, no data transmission over online communications is guaranteed to be 100% secure. Information shared with MHS is protected to the best of our ability using the platforms and services available. Authorized MHS personnel accessing personal information must adhere to security, privacy, and confidentiality agreements or policies.
If you believe your interaction with MHS is no longer secure, contact us immediately using the details provided in the “Accountability” section.
Openness
MHS is committed to transparency about its policies and procedures for managing personal information. Individuals may request information about MHS’s privacy practices without unreasonable effort. Such information will be provided in an understandable format.
The information made available includes:
The name and contact details of MHS’s Data and Security Lead.
The means by which individuals may access their personal information held by MHS and the types of information accessible.
For a PDF copy of this Privacy Policy, visit our website or contact the Data and Security Lead at privacy@mhsvictoria.org.
Individual Access
Upon a request in writing, MHS will confirm the requestor’s identity and inform the individual of the existence, use, and disclosure of their personal information. Individuals will be notified about whether they will be granted access to all or part of their personal information, as well as where, when, and how access will be provided, except where the law requires or permits MHS to deny access.
Requests for access must be made in writing to ensure records of the request are maintained. MHS will assist individuals requiring help to prepare written requests.
MHS may require sufficient information from the individual to locate the requested personal information. The information provided by the individual will be used solely for this purpose.
MHS will typically respond to a request within 30 days of receipt. If additional time is required, MHS may extend the time limit for up to 45 days in addition to the original 30 days under the following circumstances:
Meeting the initial time limit would unreasonably interfere with MHS’s activities.
Consultations necessary to respond to the request cannot be completed within the time limit.
The individual has not provided enough information to locate the requested information.
In such cases, MHS will notify the individual within 30 days, explaining the reasons for the extension and the new time limit.
If MHS denies access to personal information, the individual will be informed in writing of the refusal and the reasons for the decision. The individual may challenge MHS’s decision as outlined in this Privacy Policy.
MHS may deny access to personal information for reasons specified in PIPA and PIPEDA. Where access is denied and the information can be severed from other data, MHS will provide access to the remaining information.
Challenging Compliance
Individuals may direct challenges concerning compliance with this Privacy Policy to the designated Data and Security Lead.
The Data and Security Lead is accountable for ensuring MHS’s compliance with privacy guidelines. MHS will investigate all written complaints. If a complaint is found to be justified, MHS will take appropriate measures, including amending its policies and practices if necessary.
For questions or concerns about privacy at MHS or compliance with this policy, contact the Data and Security Lead at privacy@mhsvictoria.org.
Downloadable files