Privacy Policy for XO OPTIX
Privacy Policy for XO OPTIX
At XO OPTIX, we are committed to providing our patients and customers with exceptional service. As providing this service involves the collection, use and disclosure of some personal information about our patients and customers, protecting their personal information is one of our highest priorities.
While we have always respected our patients’ and customers’ privacy and safeguarded their personal information, we have strengthened our commitment to protecting personal information as a result of British Columbia’s Personal Information Protection Act (PIPA). PIPA, which came into effect on January 1, 2004, sets out the ground rules for how B.C. businesses and not-for-profit organizations may collect, use and disclose personal information.
The purpose of this Personal Information Protection Policy is to inform our patients and customers of why and how we collect, use and disclose their personal information, obtain their consent where required, and only handle their personal information in a manner that a reasonable person would consider appropriate in the circumstances.
This Personal Information Protection Policy, in compliance with PIPA, outlines the principles and practices we will follow in protecting patients’ and customers’ personal information. Our privacy commitment includes ensuring the accuracy, confidentiality, and security of our patients’ and customers’ personal information and allowing our patients and customers to request access to, and correction of, their personal information.
Definitions
The information we collect from our patients and customers falls into two categories: Personally identifiable information (“Personal Information”) and non-personally identifiable information (i.e., information that cannot be used to identify who our patients and customers are) (“Non-Personal Information”).
Personal Information – means information about an identifiable individual. Personal information does not include Contact Information (described below).
Personal Information we may collect from our patients and customers includes:
Name, username, email address, and password
Any eyewear prescription data they provide to us
Information from Third Party Services that our patients and customers explicitly give us access to
Our patients’ and customers’ contact information, such as our patients’ and customers’ phone number, social media handle, or email (depending on how our patients and customers contact us)
Our patients’ and customers’ credit card information (although we use a third party payment processor, as described below), billing address and shipping address, if our patients and customers make purchases through the Services
Live chats and customer service phone calls, text messages or online messages
Sales history
Insurance benefits claims history
Government benefits history
Survey responses to the extent our patients and customers include Personal Information
We may also collect some of the following Non-Personal Information from our patients and customers:
The name of our patients’ and customers’ internet service provider
The IP address of the computer our patients and customers use to access our Services
The type of browser software our patients and customers are using
The operating system our patients and customers are using
The date and time our patients and customers access our Services
The website address, if any, that linked our patients and customers to our Site
The website address, if any, our patients and customers leave our website and travel to
our patients’ and customers’ home page customization preferences
Search engine search terms and advertising clicks/actions
Weblogs and other clickstream data
Survey responses to the extent our patients and customers do not include Personal Information
Other non-personally identifiable traffic data
Contact information – means information that would enable an individual to be contacted at a place of business and includes name, position name or title, business telephone number, business address, business email or business fax number. Contact information is not covered by this policy or PIPA.
Privacy Officer – means the individual designated responsibility for ensuring that XO OPTIX complies with this policy and PIPA.
Policy 1 - Collecting Personal Information
1.1 Unless the purposes for collecting personal information are obvious and the patient and customer voluntarily provides his or her personal information for those purposes, we will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection.
1.2 We may also collect your information in the following ways:
When Our Patients and Customers Provide Us With Information to Make a Purchase.
We make products we like in hopes our patients and customers will find something our patients and customers like, too. If our patients and customers use our Services to make a purchase, we may request certain Personal Information from our patients and customers to facilitate the transaction and get our patients and customers the goods. Our patients and customers may also provide us with Personal Information when our patients and customers use certain parts of our Services. This may include (i) contact information such as your name, email address, and shipping address, and (ii) prescription information, including any images of prescriptions our patients and customers may provide to us or any information our patients and customers give us through the pupillary distance measurement function of the Services. We, or companies that provide services on our behalf, may also collect certain financial information from our patients and customers, such as your payment method (this may include valid credit card number, type, expiration date or other financial information). We store only a very limited portion of your credit card information, in a manner that is generally permitted by credit card issuers. Our payment processor, that credit card issuers require to have sufficient security, stores and processes your credit card or other payment information using industry-standard security measures. By making a purchase through the Services, our patients and customers give us consent to use and provide your financial information as we consider necessary to process the transaction.
Communications Our Patients and Customers Initiate with Us
We do everything possible to make sure our patients and customers have an amazing shopping experience. If our patients and customers contact us in person, by phone, email, instant message, live chat, social media, or by some other means (either through our Services or through Third Party Services), we may keep a record of your contact information and correspondence for later reference (to help improve our service!). When we send our patients and customers emails, we may track whether our patients and customers open them to figure out how to deliver more delightful and helpful emails and improve our Services.
Third Party Services & Advertising Partners
Our customers are active in many different communities, both offline and online, and we like facilitating that wherever we can. Some parts of our Services can be linked up with other accounts our patients and customers have, such as your Facebook, Pinterest, Twitter, Instagram, or Google+ account ("Third Party Accounts"). If our patients and customers link to Third Party Accounts from our Services, we may collect some information about your use of the Third Party Account. We will only be able to collect the information if our patients and customers have authorized the Third Party Service to provide us with that information or if our patients and customers have made the information public. Additionally, if our patients and customers mention us through your Third Party Account, we may collect information and content related to your comment that is publicly available. If our patients and customers wish to limit the information available to us, our patients and customers should be sure to manage the privacy settings of your Third Party Accounts. One thing we won't ever store is your Third Party Account password.
If our patients and customers link your account on the Services with a Third Party Account, we may also collect and store publicly available information about your contacts and friends from the linked Third Party Account. This information may include their photo, name, email address, birthday, interests or other content our patients and customers can see when our patients and customers access such profiles on those Third Party Services. We may also collect and store information if our patients and customers invite other users to the Services by providing us with their Personal Information.
Third-party ad servers or ad networks use technologies like cookies, JavaScript, or Web Beacons that are used in their respective advertisements and links that appear on xooptix.ca, which are sent directly to users' browsers. They automatically receive your IP address when this occurs. These technologies are used to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content that you see on websites that you visit.
Note that xooptix.ca has no access to or control over these cookies that are used by third-party advertisers.
Log Files
xooptix.ca follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services' analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users' movement on the website, and gathering demographic information.
Cookies and Web Beacons
Like any other website, xooptix.ca uses 'cookies'. These cookies are used to store information including visitors' preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users' experience by customizing our web page content based on visitors' browser type and/or other information.
For more general information on cookies, please read "What Are Cookies".
Google DoubleClick DART Cookie
Google is one of a third-party vendor on our site. It also uses cookies, known as DART cookies, to serve ads to our site visitors based upon their visit to www.website.com and other sites on the internet. However, visitors may choose to decline the use of DART cookies by visiting the Google ad and content network Privacy Policy at the following URL – https://policies.google.com/technologies/ads
Information We Automatically Collect
Like most websites, our Services may incorporate technology such as "pixel tags", "web beacons", and "cookies" that allow us or third parties to track the actions of users of our Services and gather information about how such users navigate to, through and from our Services. Pixel tags, web beacons and cookies generally collect Non-Personal Information, except in some cases, they may collect IP addresses. Pixel tags or web beacons are tracking devices on websites or in e-mails that can monitor the behavior of the user visiting the website or sending the e-mail. Cookies (not to be confused with the sugary morsel) are small files that web servers may place on your computer when our patients and customers visit a website. Our patients and customers may be able to set your web browser to reject cookies entirely or require that it request permission from our patients and customers before accepting each new cookie. Our patients and customers can also delete cookies from your hard drive once our patients and customers leave a website.
1.3 We may collect patient and customer information that is necessary to fulfill the following purposes:
To verify identity;
To verify creditworthiness;
To identify patient and customer preferences;
To understand the financial and visual/vision needs of our patients and customers;
To open and manage an account;
To deliver requested products and services;
To process a newsletter or e-newsletter subscription;
To provide medical, vision, and eyewear-related counselling services;
To enrol the patient or customer in a program, or redeem a voucher/coupon;
To contact our patients and customers for fundraising, events, or promotions;
To ensure a high standard of service to our patients and customers;
To meet regulatory requirements;
To collect and process payments from the patient and customer or from third-party organizations or insurance companies on behalf of the patient and customer;
To fulfil the above purposes, we may collect name, home address, home telephone number, cellphone number, personal health number, insurance identification number, insurance policy number, insurance benefits history, and birth date.
Policy 2 - Consent
2.1 We will obtain patient and customer consent to collect, use or disclose personal information (except where, as noted below, we are authorized to do so without consent).
2.2 Consent can be provided orally, in writing, electronically, through an authorized representative or it can be implied where the purpose for collecting using or disclosing the personal information would be considered obvious and the patient and customer voluntarily provides personal information for that purpose.
2.3 Consent may also be implied where a patient and customer is given notice and a reasonable opportunity to opt-out of his or her personal information being used for mail-outs, the marketing of new services or products, fundraising and the patient and customer does not opt-out.
2.4 Subject to certain exceptions (e.g., the personal information is necessary to provide the service or product, or the withdrawal of consent would frustrate the performance of a legal obligation), patients and customers can withhold or withdraw their consent for XO OPTIX to use their personal information in certain ways. A patient’s and customer’s decision to withhold or withdraw their consent to certain uses of personal information may restrict our ability to provide a particular service or product. If so, we will explain the situation to assist the patient and customer in making the decision.
2.5 We may collect, use or disclose personal information without the patient’s and customer’s knowledge or consent in the following limited circumstances:
When the collection, use or disclosure of personal information is permitted or required by law;
In an emergency that threatens an individual's life, health, or personal security;
When the personal information is available from a public source (e.g., a telephone directory);
When we require legal advice from a lawyer;
For the purposes of collecting a debt;
To protect ourselves from fraud;
To investigate an anticipated breach of an agreement or a contravention of law;
2.6 Children's Information: Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity. xooptix.ca does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.
Policy 3 - Using and Disclosing Personal Information
3.1 We will only use or disclose patient and customer personal information where necessary to fulfill the purposes identified at the time of collection or for a purpose reasonably related to those purposes. Except if we sell all or a portion of our business, as described below, we do not rent or sell our patients’ and customers’ Personal Information to anyone, period. If we share our patients’ and customers’ Personal Information, we do so only as described below:
To enhance the products and services we provide to our patients and customers and their experience with XO OPTIX.
To conduct patient and customer surveys in order to enhance the provision of our services;
To contact our patients and customers directly about products and services that may be of interest;
3.2 We may use our patient’s and customer’s personal information to provide services to them. Some ways we may internally use such personal information include:
To facilitate the sale and delivery of our patients’ and customers’ purchases
To contact our patients and customers when necessary
To respond to our patients’ and customers’ comments or questions
To provide our patients and customers with additional information according to our patients’ and customers’ preferences
To customize and personalize our patients’ and customers’ experience with the Services
To generate anonymous statistics to help us improve the customer experience
To make the Services easier and more convenient for our patients and customers (such as by prepopulating forms when our patients and customers have already provided identical information)
To provide recommendations to our patients and customers
To send our patients and customers information and marketing materials about services and products available through our Services
To train our team members
For our other internal business purposes
3.3 We will not use or disclose patient and customer personal information for any additional purpose unless we obtain consent to do so.
Policy 4 - Retaining Personal Information
4.1 If we use patient and customer personal information to make a decision that directly affects the patient and customer, we will retain that personal information for at least one year so that the patient and customer has a reasonable opportunity to request access to it.
4.2 Subject to policy 4.1, we will retain patient and customer personal information only as long as necessary to fulfill the identified purposes or a legal or business purpose.
Policy 5 - Ensuring Accuracy of Personal Information
5.1 We will make reasonable efforts to ensure that patient and customer personal information is accurate and complete where it may be used to make a decision about the patient and customer or disclosed to another organization.
5.2 Patients and customers may request correction to their personal information in order to ensure its accuracy and completeness. A request to correct personal information must be made in writing, in person, or through email or electronic messaging, and provide sufficient detail to identify the personal information and the correction being sought.
5.3 If the personal information is demonstrated to be inaccurate or incomplete, we will correct the information as required and send the corrected information to any organization to which we disclosed the personal information in the previous year. If the correction is not made, we will note the patients’ and customers’ correction request in the file.
Policy 6 - Securing Personal Information
6.1 We are committed to ensuring the security of patient and customer personal information in order to protect it from unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.
6.2 The following security measures will be followed to ensure that patient and customer personal information is appropriately protected:
The use of locked filing cabinets; physically securing offices where personal information is held; the use of user IDs, passwords, encryption, firewalls; restricting employee access to personal information as appropriate (i.e., only those that need to know will have access, and third parties who have agreed to follow confidentiality obligations we give them. We only allow parties to access your Personal Information for permitted business purposes.
6.3 We will use appropriate security measures when destroying patient’s and customer’s personal information such as shredding documents, and permanently deleting electronically stored information.
6.4 We will continually review and update our security policies and controls as technology changes to ensure ongoing personal information security.
6.5 Unfortunately, even though we use commercially reasonable efforts to protect your Personal Information, we cannot guarantee complete security. Any information that you provide to us is done so entirely at your own risk.
Children's Information
Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.
xooptix.ca does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.
Policy 7 – Providing Our Patients and Customers Access to Personal Information
7.1 Patients and customers have a right to access their personal information, subject to limited exceptions.
A full listing of the exceptions to access can be found in section 23 of PIPA. Some examples include: solicitor-client privilege, disclosure would reveal personal information about another individual, health and safety concerns.
7.2 A request to access personal information must be made in writing and provide sufficient detail to identify the personal information being sought. A request to access personal information should be forwarded to the employee working on premise who has the rights and access to patients’ and customers’ personal information.
7.3 Upon request, we will also tell patients and customers how we use their personal information and to whom it has been disclosed if applicable.
7.4 We will make the requested information available within 30 business days, or provide written notice of an extension where additional time is required to fulfill the request.
7.5 A minimal fee may be charged for providing access to personal information. Where a fee may apply, we will inform the patient and customer of the cost and request further direction from the patient and customer on whether or not we should proceed with the request.
7.6 If a request is refused in full or in part, we will notify the patient and customer in writing, providing the reasons for refusal and the recourse available to the patient and customer.
Policy 8 – The Role of the Privacy Officer
8.1 The Privacy Officer is responsible for ensuring XO OPTIX’s compliance with this policy and the Personal Information Protection Act.
8.2 Patients and customers should direct any complaints, concerns or questions regarding XO OPTIX’s compliance in writing to the Privacy Officer. If the Privacy Officer is unable to resolve the concern, the patient and customer may also write to the Information and Privacy Commissioner of British Columbia.
Contact information for XO OPTIX’s Privacy Officer:
604-941-5686
xo.optix@gmail.com
Policy 9 - The Right to Update and Revise this Privacy Policy at Any Time
9.1 We occasionally review this Privacy Policy to make sure it complies with applicable law and conforms to changes in our business. We may need to update this Privacy Policy, and we reserve the right to do so at any time. If we do revise this Privacy Policy, we will update the "Effective Date" at the top of this page so that you can tell if it has changed since your last visit. Please review this Privacy Policy regularly to ensure that you are aware of its terms. Your use of our Services constitutes your acceptance of the terms of the Privacy Policy as amended or revised by us from time to time.