Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to personal information, personal health information where applicable, employment information, service records, billing information, communications, uploaded documents and other records handled by EverCaring in connection with home-care services and business operations.

EverCaring follows applicable Ontario and Canadian privacy requirements. Where personal health information is subject to Ontario's Personal Health Information Protection Act, 2004, EverCaring will handle that information in accordance with the requirements that apply to its role and activities.

2. Information We May Collect

• Name, address, telephone number, email address and emergency contact information.
• Date of birth, preferred name, communication needs and accessibility requirements.
• Care instructions, service plans, health-related information and safety information needed to provide authorized services.
• Information about substitute decision-makers, powers of attorney or authorized representatives where applicable.
• Visit schedules, attendance records, service notes and incident records.
• Billing, invoice and payment status information.
• Employment applications, references, screening results, credentials, training records, payroll records and performance documentation.
• Communications sent through approved email, telephone, portal or other authorized systems.
• Technical information reasonably required to operate and secure EverCaring systems.

3. Why We Use Information

• Assessing service needs and developing or updating service plans.
• Scheduling, coordinating and delivering authorized home-care services.
• Protecting client and worker health, safety and security.
• Communicating with clients, authorized representatives and approved care providers.
• Billing, payment processing, accounting and financial recordkeeping.
• Recruiting, screening, training, scheduling, supervising and paying staff.
• Investigating complaints, incidents, privacy concerns, safety concerns or suspected misconduct.
• Maintaining required business, employment, insurance, tax and operational records.
• Meeting legal, regulatory, contractual and court-ordered obligations where applicable.
• Protecting EverCaring, its clients, staff and systems against fraud, misuse, unauthorized access or other security threats.

4. Consent and Authorized Use

EverCaring obtains consent where consent is required. Information is not used for unrelated purposes simply because EverCaring possesses it. Where a client has an authorized substitute decision-maker or representative, EverCaring will take reasonable steps to confirm that person's authority before relying on instructions or disclosing protected information.

A person may withdraw consent where the law permits. Withdrawal does not invalidate actions already lawfully taken and may affect EverCaring's ability to provide certain services.

5. Client Confidentiality

Client information is confidential. Staff, contractors and other authorized persons must access client information only when it is required for assigned duties. Looking at a client record out of curiosity, discussing a client in public, sharing information with family or friends, or using client information for personal purposes is prohibited.

Confidentiality obligations continue after an employee, contractor or service relationship ends.

6. Staff and Employment Confidentiality

Staff files and employment records are also treated as confidential. Access is restricted to authorized management, payroll, human resources, legal, insurance or administrative personnel who require the information for legitimate business purposes.

Employment records are not to be shared with clients, other employees, unrelated businesses or outside parties unless the disclosure is authorized, required for a legitimate purpose or permitted or required by law.

7. Sharing Information With Other Businesses or Service Providers

EverCaring does not sell client or staff information. Information is not shared with another business merely because that business requests it.

Information may be shared with an outside organization, professional, contractor, technology provider, payment processor, insurer, accountant, legal adviser or other service provider only when there is a legitimate business or care purpose and appropriate authority to do so.

Where practical, EverCaring limits disclosures to the minimum information reasonably necessary for the intended purpose and expects service providers handling confidential information to protect it appropriately.

8. Family Members and Other Third Parties

A family relationship alone does not automatically authorize access to a client's private information. EverCaring will confirm consent, legal authority or another lawful basis before disclosing confidential client information to a family member, friend, neighbour or other third party.

9. Payment Information

Card payments are processed through an approved secure payment processor. EverCaring does not intentionally store raw credit card numbers, debit card numbers, card security codes or CVV values in ordinary EverCaring records.

EverCaring may retain transaction identifiers, payment status, invoice information, receipts and other records reasonably required for accounting, reconciliation, dispute handling and legal obligations.

10. Electronic Communications

EverCaring may communicate through approved email, telephone, SMS or portal systems when appropriate. Clients and staff should not send highly sensitive information through unapproved channels.

Ordinary email and SMS may carry privacy risks. EverCaring will use reasonable safeguards and more secure methods where the sensitivity of the information or circumstances requires them.

11. Photographs, Video and Audio

Staff must not photograph, record, livestream or publish a client, a client's home, client documents, medication, equipment or other confidential information for EverCaring purposes without an authorized business purpose and appropriate permission.

Client information, images or stories must never be posted to personal social media accounts.

12. Website and Online Systems

EverCaring may collect limited technical information necessary to operate, protect and improve its website and online systems. This may include browser type, device information, security events or server logs where reasonably required for security and administration.

EverCaring does not use website access as permission to expose private client, employee or financial files publicly.

13. Security Safeguards

• Role-based and need-to-know access.
• Unique accounts and password controls.
• Protected server locations and restricted file access.
• Session and authentication controls.
• Secure transmission methods where appropriate.
• Audit trails, logging and monitoring where supported.
• Backup and recovery controls.
• Staff confidentiality obligations and privacy training.
• Prompt removal of access when employment or authorization ends.

14. Privacy and Security Incidents

Suspected unauthorized access, loss, theft, misdirected communication, improper disclosure, compromised account, malware event or other privacy or security incident must be reported promptly to EverCaring management.

EverCaring will assess the incident, take reasonable steps to contain it, preserve relevant records, reduce further risk and complete any notification or reporting required by applicable law.

15. Record Retention and Secure Destruction

EverCaring retains records for periods appropriate to their legal, tax, employment, insurance, contractual, care, safety and operational purposes. Records subject to a complaint, investigation, claim, audit or legal hold may be retained longer where required.

When records are authorized for destruction, EverCaring uses methods appropriate to the sensitivity and format of the information so that the information cannot reasonably be reconstructed or accessed without authorization.

16. Access and Correction Requests

Individuals may contact EverCaring to request access to or correction of information about themselves where applicable. EverCaring may need to verify identity and authority before releasing or changing protected information.

Some records may be subject to lawful restrictions, retention requirements or exceptions that prevent immediate deletion, alteration or disclosure.

17. Accuracy

EverCaring takes reasonable steps to keep information accurate, complete and current where the information is important to service delivery, safety, billing, payroll or legal obligations. Clients and staff are expected to notify EverCaring when important information changes.

18. Professional Boundaries and Privacy

Privacy is part of professional conduct. Staff must maintain appropriate boundaries with clients and must not use private information to obtain personal, financial, social or other advantage. Access to confidential information is a responsibility, not a personal privilege.

19. Complaints and Privacy Concerns

EverCaring takes privacy complaints seriously. A person who raises a good-faith privacy concern will not be retaliated against for making the complaint.

Privacy concerns will be documented, reviewed and addressed according to the nature and seriousness of the issue.

20. Changes to this Policy

EverCaring may update this Privacy Policy when services, technology, legal requirements or operational practices change. The current version posted by EverCaring will identify its effective date.

21. Contact EverCaring