This policy explains what personal information this website collects, why, who it is shared with, and what you can do about it. It also explains how medical records and other health information are handled, because that is the most sensitive material this practice deals with.
This policy applies to paulcahill.ca and to personal information collected through it. It does not govern the handling of client files, which is subject to the additional professional obligations described in clause 5.
The applicable federal statute is the Personal Information Protection and Electronic Documents Act ("PIPEDA"), which governs organisations that collect, use or disclose personal information in the course of commercial activity. Ontario has no general private-sector privacy statute, so PIPEDA is the operative law here. Where this policy refers to legal requirements, it refers to PIPEDA and to the professional obligations imposed by the Law Society of Ontario.
This website is published by Paul Cahill, a lawyer and partner at Davidson Cahill Morrison LLP. References to "I", "me" and "my" mean Paul Cahill; references to "the firm" mean Davidson Cahill Morrison LLP.
I am the individual accountable for personal information collected through this website. My contact details are in clause 12.
Information you provide. The contact form on this site collects your name, email address, telephone number, and whatever you write in the message field, together with your answers to the form's other questions. Nothing on this site requires you to create an account, and no payment information is collected anywhere on the site.
Information collected automatically with the form. When a form is submitted, the form software also records the page you submitted it from, the page title, the referring page, and an approximate geographic location derived from your IP address. That location is derived by the form provider's geolocation service and is approximate, not precise.
Technical information. The web server and the content delivery network record standard log data, including your IP address, browser type and version, operating system, the pages you request, and the date and time of each request. This is used to operate the site, diagnose faults and protect against abuse.
Usage information. Analytics and advertising technologies collect information about how the site is used. Clause 6 describes these in detail.
I do not sell, rent or trade personal information, and I do not disclose it to third parties for their own marketing purposes.
Please do not send confidential or sensitive information through this website until we have spoken and a retainer has been signed. Describe your situation in general terms only.
Contacting me does not create a solicitor-client relationship, and information sent before a retainer is in place is not protected by solicitor-client privilege.
There is a practical reason for this, beyond privacy. I may already act for, or may later be asked to act for, another party involved in your matter. Receiving detailed information from you can create a conflict that prevents me from acting for you, or that requires me to decline your matter altogether. Limiting what you send at the outset protects your position as well as mine.
That said, information you do send is treated as confidential in accordance with my professional obligations to prospective clients under the Law Society of Ontario's Rules of Professional Conduct, whether or not I go on to act for you. Enquiries are used to assess whether I can assist, to run a conflicts check, and to reply to you. The terms of use address this as well.
This is a medical malpractice practice, so it handles medical records, hospital charts, diagnostic imaging and other health information, both from clients and from hospitals, physicians and other providers in the course of litigation.
Health information is treated as highly sensitive and is protected accordingly. It is never used for analytics, advertising or marketing, and it is never disclosed for any purpose other than advancing the matter it was obtained for, or as required by law or by court order.
A note on which rules apply, because this is commonly misunderstood. Ontario's Personal Health Information Protection Act, 2004 ("PHIPA") governs health information custodians: hospitals, physicians, laboratories, pharmacies and similar providers. A law firm is not a health information custodian, and this firm does not hold itself out as one. Where the firm receives health information from a custodian, PHIPA restricts what it may do with that information, and the firm complies with that restriction. Beyond that, the protections that apply to health information in the firm's hands come from PIPEDA, from a lawyer's professional duty of confidentiality, and from solicitor-client and litigation privilege. Those professional duties are broader and stricter than any privacy statute.
Records obtained for litigation purposes may be privileged, and privilege is not waived by a request for access under privacy legislation. See clause 11.
A cookie is a small file a website asks your browser to store. This site and its service providers use cookies and similar technologies for the following purposes:
You can control this. Browsers can be configured to refuse or delete cookies, though disabling them may affect how parts of the site work. You can opt out of personalised Google advertising through Google's own ad settings, and out of interest-based advertising from participating companies through the industry opt-out programmes operated by the Digital Advertising Alliance of Canada and the Network Advertising Initiative. Most browsers also offer a "do not track" setting, although not all services honour it.
Analytics and advertising technologies are used on the basis of your implied consent, consistent with guidance issued by the Office of the Privacy Commissioner of Canada, which requires that you be told clearly what is happening and given a workable way to opt out. That is the purpose of this clause.
The site relies on third-party providers to operate. Each receives only what it needs for its function, and each is bound by its own terms and privacy practices. As at the date of this policy they are:
This list is kept current. If a provider is added or removed, this clause is updated.
Several of the providers named in clause 7 are based in the United States or process information there. This means personal information collected through this website may be stored or processed outside Canada.
While information is in another country it is subject to the laws of that country, and may be accessible to that country's courts, law enforcement and national security authorities under those laws. Under PIPEDA, transferring information to a service provider for processing is treated as a use rather than a disclosure, and separate consent is not required. I remain accountable for information transferred to a provider, and rely on contractual and other means to require a comparable level of protection.
Personal information is kept only as long as necessary for the purpose it was collected for, or as long as required by law or by professional obligations, whichever is longer.
Enquiries that do not proceed to a retainer are kept long enough to run and record a conflicts check and to deal with any follow-up, then destroyed. Client files, including medical records, are retained in accordance with the firm's file retention obligations, which are considerably longer and are driven by limitation periods, professional requirements and the possibility of future proceedings. Server logs and analytics data are kept for the periods set by the relevant provider.
Safeguards are applied in proportion to the sensitivity of the information, which for a medical malpractice practice means a high standard. They include encrypted connections to this website, access controls, secure storage of client records, and confidentiality obligations binding everyone at the firm.
No system is perfectly secure, and information sent over the internet carries inherent risk. That is one of the reasons for the caution in clause 4 about sending sensitive material through a web form. If you need to send records, ask and a secure method will be arranged.
You may ask what personal information about you is held, how it is being used, and to whom it has been disclosed. You may also ask that inaccurate information be corrected. Requests should be made in writing to the contact in clause 12.
A response will be provided within thirty days of receiving the request. Where more time is genuinely required, you will be told in writing within that thirty days, with the reasons, the new time limit, and your right to complain to the Office of the Privacy Commissioner of Canada. Access is provided at little or no cost, and if any cost is unavoidable you will be given an estimate before it is incurred.
Access can be refused in the limited circumstances PIPEDA allows. Two are worth naming: information subject to solicitor-client or litigation privilege, and information about a person other than you that cannot be severed. A request for access does not waive privilege.
Questions about this policy, requests for access or correction, and complaints about how your information has been handled should come to me directly:
Paul Cahill
Davidson Cahill Morrison LLP
220 Bay Street, Suite 1400, Toronto, Ontario M5J 2W4
Telephone: (416) 643-3845
Email: intake@paulcahill.ca
If you are not satisfied with my response, you may complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, telephone 1-800-282-1376. I would ask that you raise the matter with me first, so that I have the chance to put it right.
This website is intended for adults and is not directed at children. Personal information is not knowingly collected from children through this site. Claims involving injuries to children are a significant part of this practice, and information about a child provided by a parent or guardian in that context is handled as client information under clause 5, not as website data.
This policy may be updated to reflect changes in the site, in the providers it relies on, or in the law. The version published on this page is the version in force, and the date at the top shows when it was last revised. Material changes will be reflected in that date, so it is worth checking if you rely on this policy.
Federal privacy legislation is currently under review in Parliament. If the law changes, this policy will be updated accordingly.
If you want to know what information is held about you, have it corrected, or raise a concern about how it has been handled, get in touch and it will be dealt with directly.