Covenant Health is accountable for protecting the information in our custody or control. 

• we have a Chief Privacy Officer responsible for our privacy management program and compliance with applicable privacy legislation. 

• we maintain privacy policies, procedures and guidelines. 

• our workforce receives ongoing privacy education. 

• privacy considerations are integrated into our clinical, administrative and digital systems. 

• when we use service providers to perform services on our behalf, we remain responsible for the protection of personal or health information and require them to meet our privacy and security requirements. 

We collect, use and disclose information only for defined and lawful purposes, including:

Providing care

• delivering safe, high‑quality health services

• coordinating care among health care providers

• supporting continuity of care

System operations

• scheduling, registration and billing

• quality improvement and patient safety

• risk management and accreditation

• workforce administration

Legal and public responsibilities

• meeting requirements under HIA, POPA, ATIA and other laws

• public health reporting

• responding to lawful requests from regulators or oversight bodies

Research and education

• health research (with ethics approval and appropriate safeguards)

• teaching and training health professionals

Implicit consent for care

In most cases, your consent to collect and use your health information is implied when you seek or receive care.

Express consent

We will seek your explicit consent when required by law, including:

• certain disclosures outside the care team

• participation in research

• uses not directly related to care or operations

Withdrawing consent

You may withdraw consent where permitted by law, though this may limit our ability to provide services or meet legal obligations.

We collect only the information necessary to fulfill our identified purposes.

Information may be collected:

• directly from you

• from other health care providers

• through clinical systems and diagnostic tools

• from authorized provincial systems or registries

Use and disclosure

We use and disclose information only:

• for the purposes identified

• with your consent, where required

• as authorized or required by law

Information may be shared:

• with other members of your care team

• with service providers working on our behalf

• with health system partners where authorized

• with researchers (with appropriate approvals)

• with government or public sector bodies where legally required

We do not sell personal or health information.

We retain information:

• for as long as required to deliver care

• to meet legal, regulatory and clinical requirements

• in accordance with approved retention schedules

Information is securely destroyed when no longer required.

We take reasonable steps to ensure information is:

• accurate

• complete

• up to date

You can help by informing us of changes to your information.

We protect information using administrative, physical and technical safeguards, including:

• secure clinical and administrative systems

• role‑based access and least‑privilege controls

• encryption and cybersecurity monitoring

• secure facilities and records storage

• vendor privacy and security requirements

Access to information is limited to those who need it to perform their duties.

We are committed to openness and transparency in how we manage information.

You may:

• review this Privacy Statement to understand how we handle information.

• ask questions about how your information is collected, used, disclosed and protected.

• request more detailed explanations of specific information handling and privacy practices, including our Privacy Management Program Framework.

• some of our clinical and administrative systems use automated tools to support care delivery and operational processes. We are committed to being transparent about the use of these systems and apply appropriate safeguards and human oversight to help ensure information is used lawfully, responsibly and in a manner consistent with our obligations under privacy legislation.