Skip to Main Content

Advanced Search

Customer Connect Login | Payer Login | Surveyor Login

CARF Canada | CARF Europe | uSPEQ®

  • Personal Information Protection Policy

    Personal Information Protection Policy for Canada, the United Kingdom, the European Union, and uSPEQ®

    CARF is committed to safeguarding the personal information entrusted to us by stakeholders. We manage all personal information in accordance with applicable laws. This policy outlines the principles and practices we follow in protecting personal information. A copy of this policy is provided to any stakeholder on request.

    What is personal information? Personal information means information about an identifiable individual, including but not necessarily limited to an individual’s name, home address and telephone number, and email address.

    What personal information do we collect?

    Generally, we do not solicit, collect, use or disclose personal information. From time to time, we may receive personal information from our stakeholders ancillary to non-personal information about the activities of CARF customers or from consumers seeking to inform quality improvement of services. In such cases, we normally receive the personal information directly from the individual to whom the information relates. In rare events, we may receive personal information from other persons with appropriate consent or as authorized by law. We inform our stakeholders, before or at the time of receiving personal information, of the purposes for which the information may be used. However, we don’t provide this notification when a stakeholder volunteers information for an obvious purpose (for example, stakeholders may provide personal information asking us to contact them or individuals may provide responses to questions addressing the quality of services). While CARF may use or disclose non-personal information provided by its stakeholders, any ancillary personal information is typically not used other than to acknowledge receipt of the non-personal information.

    Where is personal information located? Unless received at a CARF Canada or CARF Europe mailing address, all personal information is received by the Commission on Accreditation of Rehabilitation Facilities (not CARF Canada or CARF Europe) and located in the United States.

    Consent. In the event we intend to collect, use or disclose personal information, we ask for consent except in specific circumstances where collection, use or disclosure without consent is authorized or required by law. We may assume your consent in cases where you volunteer information for an obvious purpose. In cases where we collected personal information before January 1, 2004, we assume your consent to our use and, where applicable, disclosure for the purpose for which the information was collected. We may ask for your express consent for some purposes and may not be able to take certain actions if you are unwilling to provide consent to the collection, use or disclosure of certain personal information. Where express consent is needed, we will ask stakeholders to provide their consent orally, in writing, or electronically. A stakeholder may withdraw consent to the use and disclosure of personal information at any time, unless the personal information is necessary for us to fulfill our legal obligations. We will respect your decision, but we may not be able to take certain actions if we do not have the necessary personal information. We may collect, use or disclose personal information without consent only as authorized by law. For example, we may not request consent when the collection, use or disclosure is reasonable for an investigation or legal proceeding, or in an emergency that threatens life, health or safety.

    How do we use and disclose personal information? We use and disclose personal information only for the purposes for which the information was received, except as authorized by law. All personal information collected is received for the purpose of benefitting public health. For example, we may use the information in connection with monitoring the activities of CARF customers or for helping providers improve the quality of their services. 

    How do we safeguard personal information? We rely on our stakeholders to notify us if there is a change to their personal information that may affect their relationship with our organization. If you are aware of an error in our information, please let us know and we will correct it on request wherever possible, if the information exists in our records. In some cases we may ask for a written request for correction. We protect personal information in a manner appropriate for the sensitivity of the information. We make every reasonable effort to prevent any loss, misuse, disclosure or modification of personal information, as well as any unauthorized access to personal information. We will notify the Office of the Information and Privacy Commissioner of Alberta, without delay, of a security breach affecting personal information received by CARF if it creates a real risk of significant harm to individuals in Alberta, Canada. We retain personal information only as long as is reasonable to fulfill the purposes for which the information was received or for legal or legitimate business purposes. We use appropriate security measures when destroying personal information, including shredding paper records and permanently deleting electronic records.

    Access to records containing personal information. Stakeholders have a right of access to their own personal information in a record that is in our custody or under our control, subject to some exceptions. For example, in many cases we will refuse access because the information does not currently exist in our records. We will also refuse to provide access to information that would reveal personal information about another individual or if disclosure would reveal confidential business information. Access may also be refused if the information is privileged or contained in mediation records. If we refuse a request in whole or in part, we will provide the reasons for the refusal. In some cases where exceptions to access apply, we may withhold that information and provide you with the remainder of the record (if any). You may make a request for access to your personal information by writing to CARF General Counsel. You must provide sufficient information in your request to allow us to identify the information you are seeking. You may also request information about our use of your personal information and any disclosure of that information to persons outside our organization. For personal information collected before January 2004, if we do not have a record of disclosures, we will provide information about any disclosure of your information that is likely to have occurred. You may also request a correction of an error or omission in your personal information. We will respond to your request within 45 calendar days of receipt, unless an extension is granted. We may charge a reasonable fee to provide information, but not to make a correction. We will advise you of any fees that may apply before beginning to process your request.

    Questions and complaints. If you have a question or concern about any collection, use or disclosure of personal information, or about a request for access to your own personal information, please contact CARF General Counsel in the first instance:

    CARF General Counsel
    6951 E. Southpoint Rd.
    Tucson, AZ 85756

    If you are not satisfied with the response you receive, you may lodge a complaint with an appropriate supervisory authority, including the Information and Privacy Commissioner of Alberta (if you are a resident of Alberta, Canada):

    Office of the Information and Privacy Commissioner of Alberta
    Suite 2460, 801 - 6 Avenue, SW
    Calgary, Alberta T2P 3W2
    Phone: 403-297-2728
    Toll Free: 888-878-4044

Legal notices  Careers  Contact Us

Text: A A A