Excelleris is committed to maintaining the confidentiality of the personal information it is entrusted with, and meeting or exceeding the expectations of its stakeholders and the public. As a service provider responsible for communicating and managing sensitive personal health information from its client laboratories, information protection is recognized as priority accountability to both patients and healthcare providers.

Excelleris strives to achieve the highest level of privacy protection. In addition to complying with applicable privacy legislation and its agreements with clients, Excelleris has adopted the ten fair information principles of the Canadian Standards Association’s (CSA) Model Privacy Code. The CSA Model Privacy Code is the foundation for the majority of privacy legislation and the basis for the Excelleris Privacy Policy.

1. Accountability

Excelleris has a Privacy Officer responsible for ensuring that reasonable and adequate safeguards are in place to protect the personal information in its custody. The Privacy Officer ensures that all Excelleris staff members understand their responsibilities with regard to privacy.

2. Identifying Purposes

Excelleris will distribute and provide access to laboratory test results from its client laboratories to physicians and other authorized healthcare providers solely for the purpose of providing healthcare services to patients. Excelleris will make information available to patients, by its my ehealth service, for the purpose of providing patients with access to their own health information.

The personal information of healthcare providers, and patient subscribers to the my ehealth service, will be collected and used for the purpose of providing services to them.

Personal information related to Excelleris employees will be collected, used and disclosed for the purposes of administration and conforming to legal requirements.

3. Consent

The laboratories which initially collect the personal health information they send to Excelleris are accountable for obtaining the appropriate consent from patients, and notifying them of their legal authority to collect the information, with whom, and for what uses it may be shared.

4. Limiting Collection

Excelleris will collect only the minimum personal information necessary for providing its services.

5. Limiting Use, Disclosure and Retention

Excelleris will only use and disclose patient personal information from its client laboratories in accordance with service agreements and legal requirements. Contact information about physicians and their staff will be used and disclosed only for the purposes of administering day-to-day operations. Excelleris will only use and disclose personal information about its employees to manage administration of their employment or legal requirements.

Personal information will only be used or disclosed by Excelleris for its originally defined purposes, unless consent is obtained, and retained only as long as necessary to provide services, to meet patient’s needs as determined by the client laboratories, and to fulfill legal obligations.

6. Accuracy

Excelleris client laboratories are responsible for the accuracy of patient information. Individuals may exercise their right to request correction to their personal information if they deem the information to be incorrect or inaccurate. Corrections must be made by the originating laboratory that sent the information to Excelleris.

7. Safeguards

Excelleris will implement appropriate and reasonable security safeguards to protect personal information. Security safeguards can be technical, administrative, physical or procedural methods and Excelleris will utilize a combination of these methods. Excelleris will maintain policies and procedures for the safeguarding of personal information in its custody.

Personal information will be safeguarded as set out by applicable privacy legislation and contractual agreements which may specify security precautions.

A Privacy Impact Assessment will be conducted for new systems and upgrades to information systems and technologies to ensure they conform to privacy legislation and employ best practices and standards. Periodically, Excelleris will conduct a Security Threat and Risk Assessment to review its safeguarding practices.

8. Openness

Excelleris will readily make information available about its privacy policies and information protection practices, upon request to the Excelleris Privacy Officer at privacy@excelleris.com. Excelleris may also make information on its policies and practices available on this website.

9. Individual Access

Individuals have the right under legislation to know what personal information about them is stored by Excelleris and who has accessed their personal information. Excelleris will respond accordingly to all such requests.

10. Challenging Compliance

Excelleris will have procedures in place to receive and respond to inquiries or complaints regarding its policies and practices for protecting personal information. All concerns will be investigated and communicated. In addition, complaints can be made to the BC Office of the Privacy Commissioner.

Excelleris reserves the right to modify or supplement this Privacy Policy when appropriate. The revised Privacy
Policy will be posted to this website and, if the changes are significant, Excelleris will provide a more prominent
notice.