Privacy and Information Governance Policy

1. Accountability and scope
‍
Clinique Médicale Bina Inc. / Bina Medical Clinic Inc.(“Bina”), NEQ 1181562878, is accountable for information it holds. Address: Suite 101, 6955 Taschereau Boulevard, Brossard, Quebec J4Z 1A7;
Telephone: 514-307-0111;
Website: binamd.ca.
Privacy and health-information officer: Dr Kourosh Lalavi; co-founder and director: confidentialite@binamd.ca.
General complaints: relations@binamd.ca.
‍
This policy explains how Bina manages information about patients, representatives, customers, and visitors. It also serves as Bina’spublic health-information governance policy. It applies Quebec’s Act respecting health and social services information, private-sector privacy legislation, and PIPEDA where applicable. Lumina is a separate entity with its own policy.

2. Information collected
Depending on the service, Bina collects only information reasonably necessary, including:
  
• Identity, contact information, language, representative, RAMQ or other identity evidence when needed;
• Clinical information, history, medication, notes, prescriptions, referrals, images, results and communications;
• Appointments, consents, requests, complaints, communication choices and confirmation of Quebec location;
• Billing, receipts and a payment token; Bina does not receive the full card number;
• Technical information, security logs and, with consent, analytics or marketing cookies;
• Temporary AI-assistedclinical-scribe data, only with separate consent.

3. Sources, purposes and consent
Information comes from you, your representative, professionals, health bodies or authorized providers. Bina uses it to verify identity and eligibility, schedule and deliver care, maintain the record, transmit results, obtain payment, support quality and security, answer requests and comply with law. Consent is requested separately, clearly and in proportion to sensitivity and purpose. Marketing, promotional photographs and the AIscribe are optional and separate from care. You may withdraw consent for the future, subject to legal duties and information needed for a requested service. Consent required to use or disclose health information must be freely given, informed, specific and express. Before age 14, it is given by the person having parental authority or tutor; from age 14, by the minor, unless the law provides otherwise.

4. Internal access and governance
Role-based access is limited to authorized treating professionals and clinical, administrative, billing, privacy and technology personnel. Professionals document care; staff use information only for assigned duties; management and the privacy officer oversee compliance. Bina uses access controls, authentication, encryption where appropriate, backups, confidentiality agreements, and logs that trace access and disclosures. Personnel receive onboarding training and periodic reminders. Access is reviewed when roles change or end. Governance, risks, incidents, training and technology are reviewed at least annually and after a material change. Bina separately publishes its current technology products and services register.

5. Disclosures and service providers
Bina discloses information with consent or when permitted or required by law, including to a professional involved in care, apatient-selected pharmacy, a laboratory or diagnostic partner, an authorized payer, an authority or during an emergency. Providers support the MYLE/MEDFAR record and portal, Square payment and booking, communications, hosting, consented analytics, security and other functions. They receive only what is necessary and are subject to contractual safeguards. Providers specific to an optional test or service are identified before purchase when their role is material. Before information may be processed outside Quebec, Bina assesses privacy factors and implements required safeguards. These assessments do not override the restriction prohibiting physicians from storing their clinical records outside Quebec.

6. Virtual care, portal, email and AI
Bina verifies identity and presence in Quebec for telemedicine. Results are delivered through MYLE by default. On your request, some information may be emailed after risks are explained. Administrative calls are not recorded. Optional clinical capture by an AI scribe is described below. CareWay may temporarily capture a consultation to prepare a draft note. It is used only with express consent; the professional verifies the note, and working material is deleted as soon as possible after validation, subject to applicable professional retention and deletion requirements. Refusal does not prevent access to care. Use remains subject to applicable certification andprivacy-assessment requirements. Consent must cover purposes, risks, limitations, recipients, processing locations and any secondary uses; it may be withdrawn for future uses.

7. Website, cookies and marketing
Strictly necessary cookies may operate without consent. Analytics, advertising and non-essential features, including chat when not necessary, must remain off until you choose them. You can change your choice in cookie settings. Do not send urgent or detailed medical information through a general chat tool. Promotional messages are sent only with required consent and include an unsubscribe method. Care-related and transactional communications remain separate.

8. Retention, security and incidents
Bina retains information only as long as needed for care, stated purposes and legal or professional requirements. Clinical and financial records follow mandatory periods; temporary, marketing and website data are deleted or anonymized under an internal schedule. Destruction is secure. For clinical records governed by physicians’ rules outside institutions, the applicable minimum is 10 years after the last entry or insertion, subject to transitional rules for paper records held on July 11, 2024 and preservation duties. Other professions’ rules apply to the relevant records. You may ask the privacy officer about the retention period applicable to your information.No safeguard eliminates all risk. Bina investigates an incident, limits its effects, records it and notifies affected people and authorities when the legal risk threshold is met.

9. Your rights and complaints
Subject to legal exceptions, you may request access, correction, a copy in a structured technological format where applicable, withdrawal of consent, de-indexing or cessation of dissemination where applicable, and information about an automated decision. Bina does not use a fully automated decision to diagnose or prescribe. For health information, the law also provides rights to restrict access and refuse certain uses or disclosures, including to certain relatives, researchers or for donation solicitations, subject to statutory exceptions. Exercising these rights does not compromise entitlement to services. Access, transcription, copying and transmission are free. You may consult the disclosure register within legal limits. Withdrawal of consent does not allow deletion of information that must be retained. Write to confidentialite@binamd.ca with enough information to verify identity. Bina targets acknowledgement of a complaint within five business days and responds to access or correction requests within 30 days after receipt. You may also contact Quebec’s Commission d’accès à l’information. A refusal of access or correction must be explained in writing with the applicable remedies. You may complain to the privacy officer or contact the Commission directly.

10. Updates
A revised version is published with its effective date. Appropriate notice and renewed consent are sought if a change materially alters a purpose or use of sensitive information.

‍