Privacy Statement

LLGAMH is a community mental health and addictions service provider operating in the Counties of Lanark, Leeds and Grenville, Ontario. In providing care, we are a health information custodian under Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”) and are responsible for the personal health information in our custody or control.

This statement describes our privacy practices for this internal Staff Portal — the platform staff use to communicate, manage client records, log client interactions, and submit incident reports. It applies to everyone who accesses the portal, including administrators, managers, content managers, front-line workers, and read-only staff.

Through the portal we collect and process:

• Account information— your name, username, work email address, role, profile picture, and encrypted password.
• Personal health information (PHI)— client records, client interaction logs, and incident reports that may identify individuals and relate to their physical or mental health, the care they receive, or services provided to them.
• Operational content— posts, comments, hashtags, images, and other content you create in the portal.
• Activity and technical data— audit logs of actions taken in the portal (who created, edited, or deleted records and when), session information, and aggregate usage analytics used to keep the service secure and reliable.

We collect, use, and disclose personal information and personal health information only for purposes permitted by PHIPA, including:

• providing, coordinating, and documenting client care and services;
• internal communication and operations among authorized staff;
• quality improvement, incident and privacy-breach management, and risk management;
• administering staff accounts and enforcing role-based access; and
• meeting our legal, regulatory, and accreditation obligations.

We do not use personal health information for any purpose that is not permitted or required by law, and we do not sell personal information.

Where required, we collect, use, and disclose personal health information with the consent of the individual (or their substitute decision-maker), or as otherwise permitted or required by PHIPA. An individual may withhold or withdraw consent, subject to legal and care-related limits. Staff must handle client information strictly in accordance with our internal privacy policies and their role.

Access to the portal is restricted to authorized staff and is governed by the “need-to-know” principle. Access is limited by role:

• Read-only staff may view permitted content only.
• Content managers may create, edit, and delete posts.
• Front-line workers and managers may access client records, interaction logs, and incident reporting appropriate to their duties.
• Administrators have full access for the purpose of managing the system.

We disclose personal health information outside LLGAMH only with consent or as permitted or required by law (for example, to other care providers involved in an individual’s care, or where legally mandated).

We use administrative, technical, and physical safeguards to protect information against theft, loss, and unauthorized access, use, or disclosure, including:

• password-protected accounts and encrypted password storage;
• role-based access controls and server-side permission checks;
• encryption of data in transit;
• automatic sign-out after a period of inactivity;
• audit logging of sensitive actions; and
• ongoing staff privacy and security responsibilities.

We retain personal information and personal health information only as long as necessary to fulfil the purposes above and to meet our legal and regulatory retention obligations. When information is no longer required, it is securely destroyed, deleted, or de-identified in accordance with our records-retention policy.

Subject to limited exceptions in the law, individuals have the right to:

• Access their own personal health information in our custody or control;
• Request a correction to their personal health information if it is inaccurate or incomplete;
• Ask questions or raise concerns about our handling of their information; and
• Complain to us or to the Information and Privacy Commissioner of Ontario.

To exercise these rights, contact our Privacy Officer using the details below.

If personal health information is lost, stolen, or accessed, used, or disclosed without authority, we will contain and investigate the incident, notify affected individuals at the first reasonable opportunity where required, and notify the Information and Privacy Commissioner of Ontario as required by PHIPA. Staff must report any suspected privacy breach immediately through the portal’s incident-reporting process.

The portal uses strictly necessary cookies to keep you signed in and to secure your session. We use privacy-conscious, aggregate usage analytics to monitor performance and reliability; these do not track individuals across other websites and are not used for advertising.

We may update this statement from time to time. Material changes will be reflected by a revised effective date at the top of this page. Your continued use of the portal after an update means you acknowledge the current version.