STI Privacy Policy

STI Technologies Limited (STI) believes that the protection of personal privacy is a fundamental value.  This is particularly true of sensitive personal health and medical information.  STI complies with all Federal and Provincial laws respecting privacy, including the Personal Information Privacy and Electronic Document Act of Canada (PIPEDA).  A basic principle of STI’s privacy policy is that STI does not actively collect personal information about patients unless it has obtained the explicit, informed consent of those patients.  STI does not use or disclose the personal information of any patient except as permitted by PIPEDA.  (See “exceptional circumstances,” below.)

STI’s Business  STI provides pharmaceutical marketing solutions that benefit patients and providers.  Patients are individuals who receive medication or medical devices free or at a reduced cost.  Providers are doctors and other health-care professionals, including pharmacists.

Definitions  STI uses the following definitions in its privacy policy:

Anonymous information  is factual or subjective information which cannot reasonably or easily be connected to an identifiable individual.  Examples of anonymous information include age or gender when they cannot be associated with any particular individual;  prescribing habits of physicians in aggregate; and the location of a pharmacy where an STI payment card was redeemed.

Collect or Collection is the gathering of information, especially personal information.

Consent means that the individual gives permission for STI to collect, retain, use, or disclose personal information.  Express consent occurs when individuals explicitly give permission, orally or in writing.  Implied consent occurs when individuals can reasonably be thought by their actions (or inaction, in appropriate circumstances) to give permission.

Disclose or Disclosure means sharing information collected or retained by STI with people or organizations outside of STI.

Exceptional circumstances means those circumstances in which PIPEDA permits the collection, use, or disclosure of personal information without the permission of the individual.  PIPEDA provides that in certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated.

Personal information  is factual or subjective information regarding an identifiable individual.  Examples include the age, gender, medical records, or address of an identifiable individual.  It does not include the age, gender or other information that cannot reasonably be associated with an identifiable individual (see anonymous information, above).

Patient means a person who receives one or more Smart Cards from a prescriber.

Prescriber means a health care professional or provider who can sign a Smart Card and give it to a patient.

Provider means a health-care professional involved in the distribution or redemption of a Smart Card and includes prescribers.

Retention means storing or holding information whether by physical means such as documents or electronic means such as computer databases or other files.

Smart Card means an STI payment card or coupon which may be redeemed by a Patient for medication or a medical device free or at a reduced cost.

Use means handling or treating information internally within STI.  Examples of use of personal information include using an individual’s address, telephone number, or e-mail address to communicate with him or her; and providing information about an individual’s activities to employees of STI for the purpose of helping that individual to use STI’s products or services.

STI and the personal information of patients

Collection  STI does not actively collect personal information.  When a patient presents STI’s Smart Card to a pharmacy, STI makes no effort to collect patient-identifying information unless the patient has explicitly consented.  STI merely asks the pharmacist to provide it with the unique card number on the Smart Card and with anonymous information about the birth-date and gender of the patient.  In other words, while the birth-date and gender of the patient submitting the Smart Card is collected, STI does not seek any information which would identify the individual patient. If STI inadvertently receives a patient’s personal information, it immediately takes steps to make that information anonymous.

Retention  STI does not retain any patient’s personal information without the explicit consent of the patient.

Use  Except in situations in which the patient has explicitly consented to the collection of his or her personal information, STI does not make use of patient personal information.  In cases where patients have consented to the use of their information, STI only uses the information in the way to which the patients have consented

Disclosure  STI only discloses personal information to third parties in cases where the patients have explicitly consented to such disclosure.

Consent  Whenever STI intends to collect, retain, use or disclose patient personal information, it obtains the patient’s informed and explicit consent.  This means that STI makes sure that the patient has been told the precise and limited purpose for which the personal information is collected, retained, used, or disclosed and that the patient has explicitly consented to that collection, retention, use, or disclosure.

NOTE re STI’s adjudicator:  STI, in common with almost all pharmacies and medical insurance plans uses an electronic services provider, called an adjudicator, to process the redemption of Smart Cards.  If a pharmacy inadvertently sends the adjudicator personal information for STI, the adjudicator retains the personal information.  If STI receives any of that personal information from the adjudicator, STI renders the information anonymous prior to retaining it.  STI will not ask the adjudicator to reveal that personal information to STI unless STI is required to do so by law or when a medical emergency arises and the information is necessary for the health and safety of individuals.  For example, in the case of a medication recall, STI may need to identify which individuals have received that medication.  STI will ask its adjudicator only for such personal information as is absolutely necessary for such purposes.

How does STI use the information it collects?  STI uses the anonymous information about age and gender together with information about the medication and where and when it was dispensed to provide reports to the pharmaceutical company who provided that free medication or medical device.  So, for example, STI might provide a report informing the reader about the average age of people using a particular medication or how many of those people are male or female.  But STI never discloses the age or gender of an identifiable person without that person’s explicit consent.

STI and the personal information of Prescribers

The information that STI collects through the redemption of Smart Cards does not include any personal information of prescribers.  No prescriber’s name, address, or any other personal information is submitted to STI through the pharmaceutical adjudication process described above.

STI and anonymous information

STI uses anonymous information it has collected for its own internal analyses of the distribution and use of medical samples.

STI also prepares reports to disclose to third parties, including government, pharmaceutical companies, and others involved in health care.  Those reports are based on anonymous information, usually in aggregate form, and do not disclose any personal information without consent.  For example, STI may provide to its pharmaceutical and other clients reports about the timing and geographic distribution of the redemption of Smart Cards at pharmacies.  Those reports may also include information about the gender and age range of patients redeeming Smart Cards.  Because it is not possible to associate the age range or gender with any particular individual, such information is anonymous, not personal, information.  For example, it may be reported that a Smart Card for medication X was redeemed at a particular pharmacy on a particular date by some unknown person who is male and is in the age range 10-20.  STI may also provide reports which show how many samples were redeemed in a certain geographic area, defined by postal forward sorting areas (the first three characters of a postal code), by one or more patients with a particular birth-date and gender.  Because such information does not reveal any patient’s name or place of residence or other identifying information, such information is anonymous.

Web site privacy policy.

STI does not collect personal information about visitors to its web sites without their express consent.  If you provide personal information in an e-mail STI to ask a question or make a comment, STI will provide that personal information only to STI employees who are involved in answering your question or processing your comment and need to know that information for those purposes.  To the extent possible, the individual to whom your e-mail is assigned will try to obtain an answer or process your comment in a way which does not reveal your personal information to other STI employees.  The personal information you provide will not be disclosed to third parties unless STI has obtained your express consent or STI is required by law to reveal it.  (STI might be required to reveal if ordered to do so by a court, for example, or in response to a valid subpoena or warrant.)