1. Laws that apply
- Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial private-sector laws: Alberta PIPA, British Columbia PIPA and Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25).
- European Economic Area, United Kingdom and Switzerland: the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss FADP, for visitors located there.
Where laws differ we apply the standard that gives you the stronger protection.
2. Your rights
| Right | What it means for the Directory |
|---|---|
| Access | Ask what personal information we hold about you (for example the enquiries you sent) and receive a copy. |
| Correction | Have inaccurate or incomplete information corrected. Clinics can correct their listing through a clinic account or by request. |
| Deletion | Ask us to delete your enquiries, contact-reveal records or account. We may keep a minimal record where the law requires it or to prevent abuse. |
| Withdraw consent | Withdraw the consent you gave when sending an enquiry or accepting optional cookies. Withdrawal does not affect processing already carried out. |
| Portability (GDPR, Quebec) | Receive the information you provided in a structured, machine-readable format. |
| Object / restrict (GDPR) | Object to processing based on legitimate interests, or ask us to restrict processing while a request is checked. |
| No automated decisions | The Directory does not make decisions about you by automated means. |
| Complain | Lodge a complaint with us and with a regulator (section 5). |
3. How to make a request
- Email Brightsquid’s Privacy Officer at the address published on brightsquid.com with the subject “RIGHTCLINIQ privacy request”.
- Tell us which right you are exercising and, for enquiries, the email address or phone number you used, so we can find the records.
- We may ask for information to confirm your identity before releasing or deleting data. We will not ask for more than is needed.
Clinic managers can also view and manage their listing and the enquiries they have received directly from their clinic account.
4. How quickly we respond
We acknowledge requests promptly and respond within 30 days (PIPEDA and provincial laws; one month under GDPR). If a request is complex we may extend this once by a further 30 days (two months under GDPR) and will tell you why. Requests are free unless they are manifestly unfounded or repetitive, in which case we may charge a reasonable fee or decline, explaining our reasons.
5. Regulators
- Office of the Privacy Commissioner of Canada
- Office of the Information and Privacy Commissioner of Alberta
- Office of the Information and Privacy Commissioner for British Columbia
- Commission d’accès à l’information du Québec
- EEA and UK residents: your national data-protection authority, for example the UK Information Commissioner’s Office.
6. Practitioners and clinics named in listings
Listings show business contact information. If a listing names you and you want it corrected, unpublished or removed, write to the privacy contact above or claim the listing through Clinic Login. Removal requests from a clinic are actioned within 5 business days.
7. Breach notification
If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy commissioner as soon as feasible, as PIPEDA and GDPR require, and keep a record of the breach.