Updated August 2017
The Canadian Resident Matching Service (“CaRMS”) has always placed the highest value on ensuring the confidentiality of applicant information, including any personal information, provided to us. In the course of providing our services, CaRMS collects personal information and we have prepared this policy to inform you about our ongoing commitment to ensuring that the personal information obtained during the course of our activities remains accurate and confidential.
What is personal information?
We consider “personal information” to mean any information, recorded in any form, about an identified individual or an individual whose identity may be inferred or determined from such information. This policy does not cover “business contact information” (e.g. name, title, business address) or aggregated data from which the identity of the individual cannot be determined. CaRMS retains the right to use business contact information or aggregated data in any ethical way that it determines appropriate.
What is a “commercial electronic message”?
“Commercial electronic message” is defined under CASL and includes a message that offers to purchase, sell barter or lease a product, good, or service; provide a business opportunity; or advertise or promote any of these items.
Why CaRMS may collect personal information
CaRMS may use the personal information provided verbally or in writing (including via electronic media) by applicants, medical schools or other third parties in order to:
- Determine an applicant’s eligibility for CaRMS’ online services;
- Provide and communicate information about CaRMS services and timelines to clients or other third parties;
- Collect and distribute medical school applications and documentation, as well as application and training statistics to participating undergraduate institutions;
- Collect and distribute residency applications, documentation and match results, to participating postgraduate institutions;
- Match applicants with postgraduate medical residency programs;
- Provide applicants’ required personal information to the undergraduate or postgraduate office or their designate at the medical school where the applicant has applied for undergraduate medical school or matched to a postgraduate medical residency position.
- Provide an applicant’s personal information (including social insurance number) to the postgraduate office or its designate where the applicant was matched to a postgraduate medical residency program and where the information is required for the residency program;
- Conduct statistical and research analyses related to CaRMS services;
- Manage our client relationships;
- Meet legal and regulatory requirements; and
- Such other purposes consistent with these purposes.
How CaRMS collects and uses personal information
CaRMS only collects, uses and discloses personal information for purposes that would be considered reasonable and consistent with our service offerings. CaRMS limits the collection of personal information to what is required. We use only fair and lawful methods to collect personal information. Personal information is routinely collected from clients through: CaRMS’ online services, documents submitted for application purposes, and interactions via telephone, email or chat with CaRMS help desk for verification and help service purposes.
Our use and disclosure of personal information is limited to the purposes described in this policy and CaRMS does not otherwise sell, trade, barter, exchange or disclose for consideration any personal information, including your electronic contact information, that it has obtained.
When CaRMS may disclose your personal information
CaRMS may disclose your personal information to:
- Individuals or organizations who use our application and/or residency matching services;
- Medical schools where an applicant has applied for undergraduate medical education;
- The medical school from which an applicant has graduated and the residency program(s) where an applicant has applied and is matched;
- Organizations who require the information for statistical and research purposes; and
- Individuals or organizations that perform services on behalf of CaRMS, including those involved in maintaining, reviewing and developing our systems, procedures and infrastructure, including testing or upgrading our systems.
Where CaRMS discloses personal information to third party organizations, CaRMS will enter into a written agreement to require that the organization use and disclose such information solely for specified permitted purposes and have appropriate safeguards for the protection of that personal information.
In some cases, the individuals or organizations that perform services on behalf of CaRMS may use or store personal information outside of Canada. Personal information stored outside Canada may be subject to different laws than those in Canada and may be accessible to law enforcement agencies outside of Canada where permitted by law. CaRMS is committed to the protection of privacy and will evaluate the privacy implications associated with disclosing personal information to a third party service provider in a given jurisdiction before establishing a relationship in which personal information will be disclosed.
Please note that there are circumstances where the use and/or disclosure of personal information may be justified or permitted or where CaRMS is obliged to disclose information without consent. Such circumstances may include:
- Where required or permitted by law or by order or requirement of a court, administrative agency or governmental tribunal;
- Where CaRMS believes, upon reasonable grounds, that it is necessary to protect the rights, privacy, safety or property of an identifiable person or group;
- Where it is necessary to establish or collect monies owing to CaRMS;
- Where it is necessary to permit CaRMS to pursue available remedies or limit any damages that we may sustain; or
- Where the information is public.
Where obliged or permitted to disclose information without consent, CaRMS will not disclose more information than is required.
The information submitted to CaRMS on both the applicant’s and the program’s rank order list is confidential.
As per the applicant contract, CaRMS will share your personal information with the National Resident Matching Program (NRMP) if you have applied to a residency program in the United States. The NRMP uses personal information for the purpose of operating a mapping program so as to manage matches that occur in both Canada and the United States. When CaRMS sends personal information to the NRMP, it will be stored outside of Canada. As noted above, personal information stored outside of Canada will be subject to the laws of that jurisdiction.
Unless permitted by law, no personal information is collected without first obtaining the consent of the individual concerned to the collection, use and dissemination of that information. To the extent that any message from CaRMS qualifies as a “commercial electronic message” (CEM), CaRMS will only send the CEM if it has obtained appropriate consent from you in accordance with the requirements of CASL and this policy.
However, we may seek consent to use and disclose personal information after it has been collected in those cases where CaRMS wishes to use the information for a purpose not identified in this policy, not previously identified or for which the individual concerned has not previously consented.
The provision of personal information to CaRMS means that the person concerned agrees and consents that we may collect, use and disclose their personal information in accordance with this policy. In addition, where appropriate, specific authorizations or consents may be obtained from time to time.
In most cases and subject to legal and contractual restrictions, an individual is free to refuse or withdraw his or her consent at any time upon reasonable, advance notice. Similarly, an individual is free at any time to unsubscribe from receiving any future commercial electronic messages that may be sent by CaRMS.
It should be noted that in certain circumstances, services can only be offered if personal information is provided to CaRMS. Consequently, if an individual chooses not to provide us with any required personal information, we may not be able to offer the services requested.
The accuracy and retention of personal information
CaRMS endeavors to ensure that any personal information provided and in its possession is as accurate, current and complete as necessary for the purposes for which we use that information. CaRMS provides the opportunity for individuals to update their personal information to ensure accuracy and currency. Individuals are responsible for ensuring that their personal information is accurate and have access to change it at any time. CaRMS will use its best efforts to inform third parties which were provided with inaccurate information so that those third parties may also correct their records.
CaRMS retains personal information only for as long as it is required for the reasons it was collected. This period may extend many years beyond the end of an individual’s relationship with CaRMS, but it will be only for so long as it is necessary for us to have sufficient information to provide application and matching services, respond to any issues that may arise at a later date or as otherwise permitted or required by law.
For example, personal information within CaRMS Online will be retained far beyond the closing of the match cycle to permit CaRMS to respond to any issues that may arise at a later date and facilitate aggregated statistical analyses and research related to our services. Any application documentation submitted in paper form, including but not limited to letters of reference, MSPRs and transcripts, will be scanned to your CaRMS Online account and retained electronically; paper copies will be destroyed shortly after the closing of the match cycle. When personal information is no longer required for CaRMS’ purposes, we have procedures to destroy, delete or convert it into an anonymous form.
Protection of personal information
CaRMS endeavors to maintain appropriate physical, procedural and technical security with respect to its offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of personal information. This also applies to our disposal or destruction of personal information.
CaRMS further protects personal information by restricting access to it to those employees with a need to know that information in order for us to provide our services or information.
If any employee of CaRMS misuses personal information, this will be considered a serious offence for which disciplinary action may be taken, up to and including termination of employment. If any individual or organization misuses personal information that was provided for the purpose of providing services to or for CaRMS, this will be considered a serious issue for which action may be taken, up to and including termination of any agreement between CaRMS and that individual or organization.
Access to personal information
CaRMS permits the reasonable right of access and review of personal information held by us and will endeavor to provide the information in question within a reasonable time, usually within 30 calendar days following the request. To guard against fraudulent requests for access, we may require sufficient information to allow us to confirm that the person making the request is authorized to do so before granting access or making corrections.
CaRMS reserves the right not to change any personal information but will append any alternative text the individual concerned believes to be appropriate and CaRMS agrees is reasonable.
CaRMS reserves the right to decline to provide access to personal information where the information requested:
- Would disclose (i) personal information, including opinions, about another individual or about a deceased individual; or (ii) trade secrets or other confidential business information that may harm CaRMS or the competitive position of a third party or interfere with contractual or other negotiations of CaRMS or a third party;
- Is subject to solicitor-client or litigation privilege;
- Is not readily retrievable and the burden or cost of providing it would be disproportionate to the nature or value of the information;
- Does not exist, is not held, or cannot be found by CaRMS;
- Could reasonably result in (i) serious harm to the treatment or recovery of the individual concerned, (ii) serious emotional harm to the individual concerned or another individual, or (iii) serious bodily harm to another individual;
- May harm or interfere with law enforcement activities and other investigative or regulatory functions of a body authorized by law to perform such functions; or
- Any other grounds under applicable legislation.
Where information will not or cannot be disclosed, the individual making the request will be provided with the reasons for non-disclosure.
CaRMS will not respond to repetitious or vexatious requests for access and in making such a determination, we will consider such factors as the frequency with which information is updated, the purpose for which the information is used and the nature of the information.
CaRMS will not charge individuals for verifying or correcting their information; however, to the extent permitted by applicable law, there may be a minimal charge imposed if individuals need a copy of records.
Resolving privacy concerns
In the event of questions about: (i) access to personal information; (ii) our collection, use, management or disclosure of personal information; (iii) CaRMS’ CASL procedures; or (iv) this policy, please contact firstname.lastname@example.org.
CaRMS will investigate all complaints and if a complaint is justified, we will take all reasonable steps to resolve the issue.