Privacy and data protection policy

The Montreal Clinical Research Institute Foundation (IRCM Foundation) is a philanthropic organization dedicated to raising funds to support basic and clinical health research conducted by the Montreal Clinical Research Institute (IRCM). In carrying out our mission, we process personal information relevant to activities such as soliciting donations or contributions of various kinds and fundraising events (such as galas, golf tournaments and auctions). The processing of personal information collected by the IRCM Foundation, including that obtained through third-party platforms, is governed by the Act respecting the protection of personal information in the private sector.

This Privacy and Data Protection Policy (the “Policy”) sets out our practices for collecting, using, disclosing and retaining personal information. By providing us with your personal information (see “How does the IRCM Foundation collect your personal information?”), you consent to the processing of your personal information in accordance with this Policy and the law and authorize the IRCM Foundation, its third-party partners and service providers to process your personal information for the purposes set out below.

This Policy does not apply to third-party websites that may be accessed through a link on our website. When you click on third-party links on our website, you will be directed to websites with separate and independent privacy policies. We encourage you to carefully review the privacy policy of any organization before submitting your personal information. 

In addition, please note that our website collects basic technical information related to Internet browsing. For more details, see “Website Terms of Use.”

What personal information does the IRCM Foundation collect?

We may collect and process various types of personal information that is relevant to our activities, including:

• Relevant personal contact information such as first names, last names, addresses, email, date of birth and telephone number;
• Biographical and professional details such as job title, employer, professional and personal background, networks, social participation, professional and personal affiliations, as well as your affiliation with IRCM clinics, if applicable;
• Comments and answers to surveys;
• Information relating to participation in IRCM Foundation events, as well as related information such as food preferences, photos and video or audio content;
• Financial information such as contribution history, billing or payment data;
• Information obtained during recruiting activities such as CVs, educational and employment background, professional affiliations and other information that may be relevant to the IRCM Foundation’s recruitment processes;
• Information about your philanthropic preferences, such as the types of orientations supported by your donations and community investments, your contributions, the recipient organizations and their focus or mission, any recognition, the decision-making process and the people involved in the organization and this process; 
• Proof of consent given to us (date, time, means) for the processing of personal information when required;
• Any other personal information provided. 

If you provide us with personal information about other individuals (such as your customers, directors, officers, shareholders or beneficial owners), you must ensure that you have duly notified them that you are providing us with their information and confirm that you have obtained their consent to such disclosure.

We do not knowingly collect information from minors. If you are a minor, please do not provide us with any personal information without the express consent of a parent or guardian/tutor. If you are a parent or guardian/tutor and you know that minors under your responsibility have provided us with personal information, please contact us. If we become aware that we have collected personal information from minors without obtaining parental consent, we will delete that information from our servers.

How does the IRCM Foundation collect your personal information?

We collect the personal information you provide during your interactions with us:

• When you register for events or use our communication tools, such as newsletters, surveys and telephone follow-ups;
• When you make a donation to our organization, regardless of the type of donation;
• When you apply for a job or become a volunteer in our organization;
• When you complete forms on our website;
• During events organized by us that you attend.

We also collect publicly available information, particularly on public and social media platforms.

How does the IRCM Foundation use your personal information?

We may use personal information in any way set out below, with your consent or where permitted by law. In each case, we indicate the purposes for which we use your personal information:

• To carry out, administer and perform our philanthropic activities, including fulfilling our obligations under any agreement between you and us;
• To facilitate the use of our websites and to ensure that content is relevant and presented in the most effective manner for you and your device;
• For philanthropic solicitation, information sharing about developments in our organization and the IRCM and invitations to events with individuals who have elected to receive such information;
• For volunteer or employee recruitment purposes, to assess whether an individual meets the requirements of the IRCM Foundation;
• To prevent fraud or conduct other background checks which may be required at any time by applicable law, regulation or best practices (if the information provided is false or inaccurate or fraud is detected or suspected, information may be passed to fraud prevention agencies and recorded by us or such agencies);
• To comply with our legal or regulatory obligations, including reporting requirements, or to protect the rights of third parties;
• To promote our activities by publishing visual or audio content on third-party sites and social networks such as LinkedIn and Facebook.

We will use personal information only to achieve the primary purpose and applicable legitimate purpose for which it was collected or for purposes consistent with that primary purpose.

With whom does the IRCM Foundation share personal information?

The personal information we collect may be shared with certain third-party service providers, partners and volunteers of the IRCM Foundation to be processed as follows:

• To recruit staff and volunteers and solicit financial or other contributions;
• To solicit donations, database and website analysis, application development, hosting, maintenance, event organization and related services;
• For government authorities and law enforcement agencies where required by applicable law. More specifically, we may disclose personal and other information if we are required to do so by tax or other laws or if we believe in good faith that such disclosure is necessary to comply with applicable laws, respond to a court order or subpoena or a government search warrant, or otherwise cooperate with such government authorities and law enforcement agencies.

We limit the information we provide to third-party service providers, partners and volunteers to what is reasonably necessary for them to perform their duties, and all such parties are required under a contract or legal obligation to protect and maintain the confidentiality of such information. Third parties must destroy such information when it is no longer relevant to the services unless there are legislative requirements concerning retention periods.

For how long and where does the IRCM Foundation retain personal information?

We will retain personal information only as long as necessary for the purposes set out in this Policy and to comply with our statutory and regulatory obligations.

Personal information is kept by the IRCM Foundation in its computer records on the IRCM network or on the servers of its information technology vendors, which are located in the province of Quebec.

How does the IRCM Foundation protect personal information?

We ensure that our practices are aligned with generally accepted industry standards to fulfill our obligations to protect personal information. We maintain administrative, physical and technological safeguards to protect the personal information we process and meet our obligations under applicable privacy laws. We also ensure that access to your personal information is restricted to those who need the information to fulfill their duties.

Despite our precautions, incidents occur, and we cannot guarantee the security of the information you knowingly provide. Members of our community and third-party partners are invited to report confidentiality incidents of which they become aware in accordance with our confidentiality incident management procedure. In the event of a confidentiality incident presenting a risk of serious injury related to your personal information, we will notify you and the Commission d’accès à l’information promptly, as soon as we become aware of the incident, as per the applicable law. We will take reasonable steps to reduce the risk of injury and prevent further incidents of a similar nature.

If you have reason to believe that your personal information has been compromised, please get in touch with us as indicated in the “Contact Us” section.

What rights do individuals have concerning their personal information?

In certain circumstances and under applicable data protection and privacy laws, individuals have the following rights concerning their personal information:

• Right of access: individuals have a right to access personal information about themselves and to receive a written or electronic copy of such information;
• Right to rectification: individuals are entitled to request correction of their personal information where they believe there is an error or omission;
• Right to be informed if a decision is based exclusively on the automated processing of their personal information;
• Right to withdraw consent to the use and disclosure of personal information.

To exercise any of these rights, please get in touch with us as indicated in the “Contact Us” section.

Finally, you may file a complaint with a data protection supervisory authority in the country, province/territory or state in which you reside (in Quebec, the Commission d’accès à l’information) or where we are located or in which an alleged breach of data protection laws has occurred.

How do we use cookies and similar technologies?

For detailed information about the cookies we use, please refer to our Website Terms of Use, which form part of this Policy.

Contact Us

To submit a request or report under this Policy regarding your personal information, please get in touch with our Data Protection Officer, Secretary General:

donnees.personnelles@ircm.qc.ca

Updates

This policy may be updated from time to time in keeping with changes in applicable legislation and practices relating to protecting personal information.

This policy was last updated on May 30, 2023.