Effective Date: June 9th, 2026

Cleveland Clinic Canada – Toronto Inc. (“Cleveland Clinic Canada”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy (hereinafter “Policy”) explains how we collect, use, disclose, and safeguard your personal information — including personal health information — when you use MyChart (our secure patient portal), visit our clinics, receive virtual care, interact with our websites, or otherwise engage with us.

1. What Personal Information And/Or Personal Health Information Is

Throughout this Policy, we use the terms “personal information” and “personal health information” to define the information we collect about you. It’s important to note that these terms are defined in various Canadian privacy laws and can have different meanings depending on what province you live in and how the laws of your province apply to your information. Generally, these terms are defined as information about an identifiable individual and can include things such as your name, address, birthdate, gender, provincial health card number, medical information, financial information, and employee information.

At Cleveland Clinic Canada, we use the term “personal information” (“PI”) to mean information we collect about you that is not related to healthcare. This information generally falls under the federal privacy law (PIPEDA) unless your province has a specific commercial privacy law.

We use the term “personal health information” (“PHI”) to mean information we collect about you that is related to healthcare. This information generally falls under provincial privacy legislation, unless your province does not have a specific privacy law related to, or covering health activities. In Ontario, we are governed by the Personal Health Information and Protection Act (PHIPA). This law specifically refers to your health information as “personal health information”.

In instances where we collect information about you that is not related to your health care, or where you are in a province where there is no commercial privacy law, we are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). For these purposes, PIPEDA refers to your information as “personal information”.

2. Collection, Use & Disclosure

We collect and use PI and/or PHI when you interact with Cleveland Clinic Canada in the following ways:

Visits On-Site or Virtually

We collect details such as your name, date of birth, health card number, contact information, medical and family history, appointment and referral details, and health care documents. For virtual care leveraging our Express Care® Online platform, we may also collect identity verification details and chat or transcription content from your session to ensure continuity of care. To help mitigate the risk of information being intercepted or unintentionally disclosed during a virtual care session, you should be in a private setting and use your own device.

We may conduct video recording for security purposes in public areas of our clinics. Signs will be posted where recording occurs to notify you.

Bookings & Purchases

We collect appointment details, including visit type, reason for visit, medical history, and emergency contact information. For purchases, we collect payment and insurance details to process transactions securely.

When you contact us, we collect your name, email address, phone number, and the contents of your messages.

Electronic Transactional & Marketing Communications

We use your contact information to send you information about your appointments and to notify you when your test results and health related reports are available. We also use your contact information to send you marketing communications about resources, services, offers, events and promotions tailored to your interests and interactions with Cleveland Clinic Canada, which you are given the opportunity to opt-out of. We do not use sensitive PHI for marketing purposes without your express prior written consent.

Downloads & Job Applications

For downloads, we collect your name, phone number and email address. For job applications, we collect information from your application materials to process and respond to your application.

Contacting for Support

We collect your name, email address, phone number, and details related to your inquiry. This information may be retained for future support, documentation, training and quality assurance.

Operational Purposes

We may use your PHI to provide your care and to run our services safely and effectively. This includes planning and improving our programs and their delivery, preventing fraud, protecting your identity, and making sure we use our resources responsibly. We may also use your information to address and improve the quality of our care, train our staff, process payments and meet our legal obligations.

Biometric Data

We may collect biometric information, body composition measurements, or data from connected devices (including wearables and health-monitoring technology) when you link them to the MyChart portal. This information is used to verify identity, deliver personalized health and wellness services, track progress, and enhance security.

Artificial Intelligence

We use artificial intelligence (“AI”) technologies to support and enhance our service planning and delivery. AI may be used to transcribe voice interactions, support research and analytics, and improve operational efficiency.

Research, Analytics & Reporting

We may use PHI for research and analytics through technologies like AI and machine learning to improve our services and support medical research. We only use or share data that could identify you with your consent or when permitted by law. When otherwise sharing information with third parties, for research, analytics and reporting purposes, we use data that has been de-identified in accordance with the standards set by the Information and Privacy Commissioner of Ontario (“IPC”), without personal details, so you cannot be identified. These de-identified reports help Cleveland Clinic Canada and our partners understand health trends and enhance our offerings.

Minors

If you are under the age of majority, a parent or legal guardian must contract for and consent to services on your behalf. Cleveland Clinic Canada does not knowingly collect personal information directly from children without parental and/or guardian consent. Parents or guardians may request access or correction of a minor’s information as permitted by law.

Special Note Regarding Children 12 years and up (“Mature Minors”): Privacy laws assume that every person is capable of making decisions about their own healthcare unless proven otherwise. The generally accepted practice in Canada (with the exception of Quebec) is that once you are 12 years old, you become capable of making your own healthcare choices. Though we recognize that this does not apply to all, we respect a “Mature Minor’s” capacity to consent, and as such will always ask for their permission before releasing results to someone other than themselves.

3. Sharing of Information

Cleveland Clinic Canada does not sell your PI and/or PHI. We only share it with third parties when you consent, when required or permitted by law, or as described below. When sharing information, we ensure only the minimum necessary data is disclosed and that recipients are subject to appropriate privacy obligations.

Health Care Providers & Facilities

We may share your information with other health care professionals, hospitals, pharmacies, labs, or other services to support your care. This may include using secure electronic systems across Ontario to coordinate timely and effective care.

Managing Consent

We operate on the implied consent model for healthcare purposes. This means that when you receive service from us, we assume that you have consented to our collection, use and sharing of your information as described in this Privacy Policy. You can withdraw your consent at any time, subject to legal, regulatory or contractual restrictions. If you choose to withdraw your consent it may affect the services we provide you.

Withdrawing your consent does not have a retroactive effect and we will not retrieve information that has already been collected, used, or shared with other parties. If you have concerns about how your information has been used or shared, or wish to apply a consent directive where possible, please contact cccprivacy@ccf.org for further guidance.

Employers & Third Parties

When you access Cleveland Clinic Canada services through your employer or another third party, unless you otherwise expressly consent, we may share limited personal details for billing and may provide de-identified, aggregated reports to your employer or the third party for benchmarking and analysis. We work with trusted partners (such as labs, technology vendors, payment processors, and marketing agencies) who only receive the information needed to perform their services and are subject to contractual protections that prohibit them from using that information for their own purposes unrelated to you or Cleveland Clinic Canada.

Benefits Providers & Provincial Health Plans    

We may disclose information to benefits providers and provincial health plans to coordinate payment and billing for services you receive.

Affiliate Clinics

If you are referred to an affiliate clinic, we may share basic details — such as your name, contact information, employer, appointment type and scheduling preferences — to help coordinate your care, including outside of Ontario.

Research Partners & Registries

We may share de-identified data with research partners, or as otherwise permitted by law (for example, with the approval of a research ethics board). We may also share information with prescribed health registries to help improve health care delivery and population health.

Legal & Compliance

We may disclose your information as required for legal reasons, such as responding to court orders, investigating fraud, or complying with applicable laws. For any questions in this regard, please email Canadalegal@ccf.org.

4. Storage & Location of Information

As of the Effective Date of this Policy, when you receive services directly from Cleveland Clinic Canada, your PHI is stored in Canada. In some cases, PHI may be transferred outside Canada (for example, to specialists located outside of Canada for your care). There may also be processing outside Canada by service providers (for example, technical support or cloud services). When information is transferred to another jurisdiction, it will be subject to the laws of that jurisdiction, including access by government authorities in that jurisdiction according to those laws.

5. Information Available Online

We collect technical details like IP addresses, pages visited, browser types, and time spent on our sites to help us improve your experience.

Our websites may link to other sites we do not own or control. These sites have their own privacy policies, and we are not responsible for how they handle your information. We encourage you to review the privacy policy of any site you visit.

6. Safeguards & Retention

Cleveland Clinic Canada takes your privacy seriously. We use administrative, technical, and physical safeguards to protect your PI and/or PHI from theft, loss, and unauthorized access or disclosure, further detailed as follows:

  • Administrative: Designated privacy and security officers responsible for compliance and oversight; role-based access utilizing the “need-to-know” principle; annual staff training & signing of the confidentiality pledge; privacy impact assessments; policies and procedures; regular risk assessments; contracts with third parties and service providers.
  • Technical: Access controls to our systems; strong passwords and multi-factor authentication; automatic session timeout; system logging and monitoring; threat risk assessments; de-identification or anonymization of data where appropriate.
  • Physical: Workstation security; locking filing cabinets for paper records; restricted access to our facilities; asset tracking and control for computers, USB devices, and mobile devices; video surveillance in designated, common areas.

Only Cleveland Clinic Canada employees and service providers who need your information to do their jobs can access it.

We keep PI and/or PHI only as long as needed to fulfill the purposes described in this Policy or to meet legal and business requirements. PHI in your medical record is retained according to provincial and territorial guidelines. In addition, Cleveland Clinic Canada retains data on matters that are likely to give rise to a legal challenge for applicable statutory limitation periods. Cleveland Clinic Canada aims to keep its files current and disposes of PI and/or PHI pursuant to its records retention practices, procedures and policies.

7. Available Options

Marketing Communications

You can unsubscribe from our marketing emails anytime by clicking the link at the bottom of the message, updating your preferences in your MyChart account, or contacting us.

Withdrawing Consent

You can withdraw your consent for us to collect, use, or share your PI and/or PHI at any time (unless restricted by law or contract) by contacting us. Please note, withdrawing consent may mean we cannot provide you with certain services.

Closing Your Account

You can close your MyChart account or request deletion of your profile information by contacting us. Some information, such as your medical record, may be kept as required by law. For details, please see “Safeguards and Retention”.

8. Access To & Updating of Information

You have the right to access, examine, update, and correct your PI and/or PHI in our custody and control, subject to limited exceptions under applicable law.

We offer multiple ways to gain access to your PI and/or PHI:

  • Online: You can access your test results though your MyChart portal when you register for an account. Most test results are available in MyChart, though we may not post results that are sensitive in nature; results that are controlled by regulatory requirements; results sent to a government lab for analysis; or results that are required to be reported directly to the ordering physician.
  • By Phone: You can contact the Health Information Management team to request paper copies of your report to be mailed to you at 416-507-6784.

Please note that if you are requesting paper copies of your results, or those of someone whom you are legally acting on behalf of, we will require you to confirm your identity and if applicable, the identity of the other person and proof of your legal authority to receive that person’s results (i.e. Parent/Guardian, Power of Attorney (ON), Representation Agreement (BC), confirmation of Estate Trustee, valid Will, etc.). Acceptable forms of identification could be a driver’s license, birth certificate, provincial health card, passport. If you choose not to provide this information, please expect a follow-up call from our staff to verify your identity or the identity of the individual you are acting on behalf of. We do not store copies of your identification. All identification is securely disposed of once your request is processed.

There may be a fee associated with receiving paper copies of your results. The fee will be communicated to you prior to results being provided to you. Payment options will be provided to you at the time you are provided the fee estimate.

9. Updates To Our Privacy Policy

We may update this Policy to reflect changes in law, services, or practices. Updates will be posted on our website and/or MyChart, with the effective date indicated. We encourage you to review this Policy periodically.

10. Contact Us

If you have questions, concerns, or requests about this Policy or your PI and/or PHI, please contact:

Privacy Officer
 181 Bay Street, 30th floor
Toronto, ON M5J 2T3
Email: cccprivacy@ccf.org
Tel: 416.678.7859

You may also contact the IPC at http://www.ipc.on.ca/ or the applicable regulatory authority in other Canadian jurisdiction(s) as follows: