1. Context

Imagem Medical Systems Inc. is a provincially regulated, for-profit legal entity that handles personal information as part of its business activities.

This policy aims to ensure the protection of personal information and to govern how IMAGEM collects, uses, discloses, stores, destroys, or otherwise manages it. Furthermore, it aims to inform all interested parties about how IMAGEM processes their personal information. It also addresses the processing of personal information collected by IMAGEM through technological means.

2. Application and definitions

This policy applies to IMAGEM, including its directors, employees, consultants, volunteers, and anyone who otherwise provides services on behalf of IMAGEM. It also applies to the IMAGEM website and all websites controlled and maintained by IMAGEM.

It targets all types of personal information managed by IMAGEM, whether it be information about its clients, potential or current, its consultants, its employees, its members or any other persons (such as visitors to its websites or other).

For the purposes of this document, personal information is information relating to a natural person that allows that person to be identified, directly or indirectly. For example, this could include a person’s name, address, email address, telephone number, gender, banking information, health information, ethnic origin, language, etc.

Sensitive personal information is information about which there is a high degree of reasonable expectation of privacy, e.g. health information, banking information, biometric information, sexual orientation, ethnic origin, political opinions, religious or philosophical beliefs, etc.

Generally, a person’s professional or business contact information does not constitute personal information; for example, a person’s name, title, address, email address, or work telephone number. More specifically, and for the sake of clarity, under the Act respecting the protection of personal information in the private sector of Quebec, and as of September 22, 2023, sections 3 (collection, use, disclosure), 4 (retention and destruction), and 6 (data security) do not apply to a person’s information related to the performance of a function within a company, such as their name, title, position, as well as their work address, email address, and telephone number.

These same paragraphs also do not apply to personal information that is public under the law, from the date this policy comes into effect.

3. Collection, use and communication

Most of the services, including access to our websites, and products we offer require us to collect only a limited amount of data. In such cases, we will ask you to provide your name, a way to contact you (such as a phone number or email address), and, where applicable, a postal address or other form of geolocation data related to the delivery of products or the performance of services.

If you subscribe to one of our newsletters or request to receive marketing materials and information about our products and services, we will need your name, email address, and details about your interests so that we can provide you with relevant information. The same data will be required if you request more information about our products and services at events or in “offline” situations such as trade shows, or if you contact us by telephone.

If you are a current or potential business partner, we collect basic data about the people we communicate with, such as their names, titles, and contact details.

If you apply to IMAGEM, we will collect the data you provide to us through our websites or otherwise, such as your resume and any forms you may fill out.

IMAGEM will also inform the persons concerned, at the time of the collection of personal information, of any other information collected, the purposes for which it is collected and the means of collection, in addition to other information to be provided as required by law.

IMAGEM applies the following general principles regarding the collection, use and disclosure of personal information:

Consent :

Generally, IMAGEM collects personal information directly from the individual concerned and with their consent, unless an exception is provided by law. Consent may be obtained implicitly in certain situations, for example, when the individual decides to provide their personal information after being informed by this policy about its use and disclosure for the purposes indicated herein. Therefore, this policy and the information it contains may be consulted by the individual concerned at the time their personal information is collected.
Normally, IMAGEM must also obtain the consent of the individual concerned before collecting their personal information from third parties, before disclosing it to third parties, or for any secondary use thereof. However, IMAGEM may act without consent in certain cases and under the conditions provided by law. The main situations in which IMAGEM may act without consent are indicated in the relevant sections of this policy.

Collection :

In all cases, IMAGEM only collects information if it has a valid reason to do so. Furthermore, collection will be limited to the information necessary to fulfill the intended purpose.
Please note that IMAGEM’s services and programs are not aimed at minors, and more generally, IMAGEM does not intentionally obtain personal information about minors (in such cases, information cannot be collected from them without the consent of a parent or guardian).
Collection from third parties. IMAGEM may collect personal information from third parties. Unless otherwise provided by law, IMAGEM will request the consent of the individual concerned before collecting personal information about them from a third party. If such information is not collected directly from the individual, but from another organization, the individual concerned may request the source of the information collected from IMAGEM.

In certain situations, IMAGEM may also collect personal information from third parties, without the consent of the person concerned, if it has a serious and legitimate interest in doing so and a) if the collection is in the interest of the person and it is not possible to do so from them in a timely manner, or b) if this collection is necessary to ensure that the information is accurate.

This data collection through third parties may be necessary to access certain products or services, or to otherwise conduct business with IMAGEM. When required, IMAGEM will obtain the individual’s consent at the appropriate time.

Possession and use :

IMAGEM ensures that the information it holds is up-to-date and accurate at the time of its use in making a decision concerning the person concerned.
IMAGEM may only use an individual’s personal information for the reasons stated herein or for any other reasons provided at the time of collection. If IMAGEM wishes to use this information for another reason or purpose, new consent must be obtained from the individual concerned, which must be explicit if the personal information is sensitive. However, in certain cases permitted by law, IMAGEM may use the information for secondary purposes without the individual’s consent, e.g.:
- When this use is clearly to the benefit of that person;
- When necessary to prevent or detect fraud;
- When necessary to assess or improve protection and security measures.
Limited access. IMAGEM must implement measures to limit access to personal information to only those employees and individuals within its organization who are authorized to know it and for whom this information is necessary to perform their duties. IMAGEM will request the individual’s consent before granting access to any other person.

Communication :

Generally, and unless otherwise specified in this policy or required by law, IMAGEM will obtain the consent of the individual concerned before disclosing their personal information to a third party. Furthermore, when consent is required, particularly when sensitive personal information is involved, IMAGEM must obtain the individual’s explicit consent before disclosing the information.
However, the disclosure of personal information to third parties is sometimes necessary. Thus, personal information may be disclosed to third parties without the consent of the person concerned in certain cases, including, but not limited to, the following:
- IMAGEM may disclose personal information, without the consent of the person concerned, to a public body (such as the government) which, through one of its representatives, collects it in the exercise of its powers or the implementation of a program which it manages.
- Personal information may be shared with IMAGEM’s service providers when necessary, without the individual’s consent. Examples include IMAGEM’s subcontractors appointed to perform mandates authorized by IMAGEM and cloud service providers. In these cases, IMAGEM must have written contracts with these providers specifying the measures they must take to ensure the confidentiality of the personal information shared, that the information is used only for the purpose of fulfilling the contract, and that they may not retain the information after its expiration. Furthermore, these contracts must stipulate that the providers must notify IMAGEM’s Privacy Officer (identified in this policy) of any breach or attempted breach of confidentiality obligations regarding the personal information shared and must allow the Privacy Officer to conduct any necessary verification related to this confidentiality.
- If necessary for the purpose of concluding a business transaction, IMAGEM may also disclose personal information, without the consent of the person concerned, to the other party to the transaction and subject to the conditions provided by law.
Communication outside Quebec: It is possible that personal information held by IMAGEM may be disclosed outside Quebec, for example, when IMAGEM uses cloud service providers whose server(s) are located outside Quebec or when IMAGEM does business with subcontractors located outside the province.

Additional information on the technologies used:

Use of connection cookies
Cookies are data files transmitted to a website visitor’s computer by their web browser when they visit that site and can have several uses.

Websites controlled by IMAGEM use cookies, including:

To remember visitor settings and preferences, for example for language selection and to allow tracking of the current session.
For statistical purposes to understand visitor behavior, content viewed, and to enable website improvement.

Websites controlled by IMAGEM use the following types of cookies :

Session cookies: These are temporary cookies that are kept in memory only for the duration of the website visit.
Persistent cookies: They are kept on the computer until they expire and will be retrieved on the next visit to the site.
Use of Google Analytics

Some IMAGEM websites use Google Analytics to enable continuous improvement. Google Analytics allows us to analyze how a visitor interacts with an IMAGEM website. Google Analytics uses cookies to generate statistical reports on visitor behavior and the content viewed on these websites.

Information from Google Analytics will never be shared by IMAGEM with third parties.

Other technological means used

IMAGEM also collects personal information through technological means such as web forms integrated into a website controlled by IMAGEM (for example, its contact form) as well as other form platforms or tools (e.g. Microsoft Forms).

If IMAGEM collects personal information by offering a technological product or service that has privacy settings, IMAGEM must ensure that these settings offer the highest level of privacy by default (this does not apply to cookies).

4. Storage and destruction of personal information

Unless a minimum retention period is required by applicable law or regulation, IMAGEM will only retain personal information for as long as necessary to fulfill the purposes for which it was collected.

The personal information used by IMAGEM to make a decision relating to an individual must be kept for a period of at least one year following the decision in question or even seven years after the end of the fiscal year in which the decision was made if it has tax implications, for example, the circumstances of a termination of employment.

At the end of the retention period or when the personal information is no longer needed, IMAGEM will ensure:

To destroy them; or
To anonymize them (that is to say, they no longer allow, irreversibly, the identification of the person and it is no longer possible to establish a link between the person and the personal information) in order to use them for serious and legitimate purposes.

The destruction of information by IMAGEM must be done securely, in order to ensure the protection of this information.

This section may be supplemented by any policies or procedures adopted by IMAGEM regarding the retention and destruction of personal information, as applicable. Please contact IMAGEM’s Privacy Officer (indicated in this policy) for more information.

5. IMAGEM’s Responsibilities

In general, IMAGEM is responsible for protecting the personal information it holds.

The Information Technology Director is the person responsible for the protection of personal information at IMAGEM. They are generally responsible for ensuring compliance with applicable legislation regarding the protection of personal information. This person must approve the policies and practices governing the management of personal information. More specifically, they are responsible for implementing this policy and ensuring that it is known, understood, and applied. In the absence or inability of this person to act, the Director of Human Resources at IMAGEM will assume the functions of the person responsible for the protection of personal information.

IMAGEM staff members who have access to personal information or are otherwise involved in its management must ensure its protection and comply with this policy.

The roles and responsibilities of IMAGEM employees throughout the lifecycle of personal information may be further specified by any other IMAGEM policy in this regard, if applicable.

6. Data Security

IMAGEM is committed to implementing reasonable security measures to ensure the protection of the personal information it manages. These security measures take into account, among other things, the purpose, quantity, distribution, medium, and sensitivity of the information. This means that information that can be classified as sensitive (see the definition in section 2) will be subject to greater security measures and must be better protected. In particular, and in accordance with the previously mentioned provisions regarding limited access to personal information, IMAGEM must implement the necessary measures to restrict access to its information systems so that only employees who need access are authorized to do so.

7. Rights of access, rectification and withdrawal of consent

To exercise their rights of access, rectification or withdrawal of consent, the person concerned must submit a written request to this effect to the person in charge of the protection of personal information of IMAGEM, at the email address indicated in the following section.

Subject to certain legal restrictions, individuals may request access to their personal information held by IMAGEM and request its correction if it is inaccurate, incomplete, or ambiguous. They may also demand that the dissemination of personal information concerning them cease or that any hyperlink linked to their name that allows access to this information by technological means be de-indexed, when the dissemination of this information contravenes the law or a court order. They may do the same, or demand that the hyperlink providing access to this information be re-indexed, when certain conditions stipulated by law are met.

IMAGEM’s Privacy Officer must respond in writing to these requests within 30 days of receiving them. Any refusal must be justified and accompanied by the legal provision supporting the refusal. In such cases, the response must indicate the available legal remedies and the deadlines for exercising them. The Privacy Officer must assist the requester in understanding the refusal, if necessary.

Subject to applicable legal and contractual restrictions, the persons concerned may withdraw their consent to the communication or use of the information collected.

They can also ask IMAGEM what personal information is collected from them, which categories of people at IMAGEM have access to it and how long it is kept.

8. Complaints Handling Process

Reception

Any person wishing to make a complaint relating to the application of this policy or, more generally, to the protection of their personal information by IMAGEM, must do so in writing by addressing the person responsible for the protection of personal information at IMAGEM, at the email address indicated in the following section.

The individual must provide their name, contact information (including a telephone number), and the subject and reasons for their complaint, giving sufficient detail for IMAGEM to assess it. If the complaint is not sufficiently specific, the Privacy Officer may request any additional information deemed necessary to evaluate the complaint.

Treatment

IMAGEM is committed to treating all complaints received confidentially.

Within 30 days of receiving the complaint or any additional information deemed necessary and required by IMAGEM’s Privacy Officer to process it, the latter must assess the complaint and provide a reasoned written response to the complainant by email. This assessment will determine whether IMAGEM’s processing of personal information complies with this policy, any other policies and practices in place within the organization, and applicable laws and regulations.

If a complaint cannot be processed within this timeframe, the complainant must be informed of the reasons for the extension, the progress of the complaint’s processing, and the reasonable time required to provide a final response. IMAGEM must maintain a separate file for each complaint it receives. Each file contains the complaint, the analysis and supporting documentation, as well as the response sent to the complainant.

9. Approval

This policy is approved by IMAGEM’s Privacy Officer, whose business contact details are as follows:

Person responsible for the protection of personal information:
Jean-Claude Maltais
Chief of staff
930 Jacques-Cartier Street East, Suite A-204, Chicoutimi, Quebec G7H 7K9
E-mail : info@imagemsoft.com

For any requests, questions or comments regarding this policy, please contact the person in charge via email.

10. Publication and amendments

This policy is published on the IMAGEM website, as well as on all websites controlled and maintained by IMAGEM, to which this policy applies with respect to the personal information collected therein. This policy is also disseminated by any means appropriate to reach the individuals concerned.

We reserve the right to update this Policy at any time. The most recent version of the Policy can be viewed by visiting our website. Your use of our website may also be subject to additional terms described in the Terms of Use and elsewhere on the website.

*Notes : Please note that the use of the masculine gender is intended to simplify this policy and make it easier to read.