Privacy Governance at Speech Metrics
1. Purpose of This Page #
Speech Metrics ("we," "us," or "our") publishes this summary of its privacy governance framework so that Providers, Clients, and the public can see how personal information is governed. It is published in accordance with section 3.2 of Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and reflects our obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws described in our Privacy Policy.
This page summarizes our internal policies. The Privacy Policy remains the full statement of what information we process, why, and the rights available to you. Terms such as "Provider," "Client," "Provider Account Data," and "Encrypted Session Data" have the meanings given in the Privacy Policy.
2. Roles and Responsibilities #
2.1. Person in Charge of the Protection of Personal Information
Our Privacy Officer is the person in charge of the protection of personal information at Speech Metrics. The Privacy Officer is accountable for our privacy program, decides on every privacy request and complaint, approves all notifications of confidentiality incidents, and is the point of contact for privacy regulators.
- Title: Privacy Officer
- Name: Gregory Hedlund
- Email: privacy@speechmetrics.ca
- Mail: Speech Metrics, Attn: Privacy Officer, 80 Allandale Road, St. John's, NL, A1B 3A1, Canada
2.2. Privacy Committee
Our Privacy Committee is the governing body for privacy matters. It is chaired by the Privacy Officer and includes representatives responsible for information technology and security, human resources, and operations. The Committee meets quarterly. Its mandate is to:
- Establish and review our privacy policies and procedures.
- Monitor compliance with applicable privacy laws and standards.
- Conduct and review privacy impact assessments (Section 5).
- Oversee the handling of privacy requests and complaints, including contested refusals (Section 4).
- Oversee our response to confidentiality incidents and the remediation that follows (Section 6).
- Oversee privacy training and awareness for staff.
- Make sure public privacy notices and forms are accessible and written in clear language.
2.3. Staff
Access to personal information is limited to staff who need it for their role. Staff must report any suspected confidentiality incident to the Privacy Officer immediately, and support staff must pass any privacy request or complaint to the Privacy Officer on the day it is identified.
2.4. Providers
SpeechCatcher is built on end-to-end encryption, so Speech Metrics cannot read Encrypted Session Data. For that data, the Provider is the party responsible for the information (the data controller or health information custodian) and Speech Metrics acts only on the Provider's instructions. Requests and complaints about a Client's session records are therefore answered by the Provider, and we help the Provider do so.
3. Retention and Destruction #
We keep personal information only for as long as it is needed for the purpose for which it was collected, or for as long as the law requires. The table below sets out our retention rules for each category of information.
| Category | Retention period | At the end of the period |
|---|---|---|
| Provider Account Data | While the account is active. After the account is closed, a limited subset is kept only as long as needed to meet legal, financial, and tax obligations. | Deleted from active systems when the account is closed; the retained subset is deleted when the obligation ends. |
| Encrypted Session Data | Set by the Provider, in line with the health-record-retention law and professional guidelines that apply to the Provider. | Deleted on the Provider's instruction, or when the Provider's account is deleted, subject to the Provider's retention obligations. |
| Recording Consent records | Set by the Provider; normally as long as the Client's clinical record, plus any limitation period. | Deleted on the Provider's instruction. |
| Usage and Device Data (including analytics and error reports) | Typically 18 to 24 months. | Deleted or anonymized. |
| Mailing-list sign-ups | Until You unsubscribe or ask us to remove Your information. | Deleted from our records and from our email provider. |
| Support requests and correspondence | As long as needed to resolve the request and meet our record-keeping obligations. | Deleted. |
| Privacy request and complaint records | No longer than needed to show that we handled the request or complaint in compliance with the law. | Deleted. |
| Confidentiality incident register and notification records | 7 years. | Deleted. |
Where the law allows, we may anonymize information instead of destroying it. Anonymized information can no longer identify a person, directly or indirectly, and is used only for serious and legitimate purposes such as improving the Service.
4. Privacy Requests and Complaints #
4.1. How to Make a Request or Complaint
You may ask to access or correct Your personal information, exercise any other right described in the Privacy Policy, or make a complaint about how we handle personal information. Contact us in any of these ways:
- Email: privacy@speechmetrics.ca
- The support form at speechcatcher.ca/support
- Mail: Speech Metrics, Attn: Privacy Officer, 80 Allandale Road, St. John's, NL, A1B 3A1, Canada
4.2. How We Handle It
- Logging (same business day): The request or complaint is recorded in our privacy request log on the day it is identified, and the response period starts on the day we received it.
- Acknowledgement (within 2 business days): We confirm receipt and give You a reference number and the date by which we will respond.
- Review: The Privacy Officer reviews it, verifies Your identity where needed using information we already hold, and decides whether Speech Metrics or the Provider holds the information concerned. Where it concerns a Client's session records, we explain how to reach the Provider and support the Provider in responding.
- Response (within 30 days): We respond in writing within 30 calendar days of receipt. If we need more time where the law allows it, we tell You in writing before the 30 days end, with the reason and the new date.
- Closure: The Privacy Officer approves the response and the outcome is recorded. The Privacy Committee reviews contested refusals and recurring issues.
If we refuse a request in whole or in part, we tell You the reason and the legal basis, release any part we can, and tell You how to bring the matter to a privacy regulator.
4.3. If You Are Not Satisfied
You may contact a privacy regulator at any time. In Quebec, this is the Commission d'accès à l'information du Québec (CAI). Elsewhere in Canada, it is the Office of the Privacy Commissioner of Canada (OPC) or Your provincial commissioner. Users outside Canada can find their regulator in the Privacy Policy.
5. Privacy Impact Assessments #
We conduct a privacy impact assessment (PIA) to identify privacy risks and the measures that reduce them. A PIA is done:
- Before we acquire, develop, or substantially change an information system or electronic service that involves personal information.
- Before we communicate personal information outside Quebec, including to the sub-processors listed in Section 6 of the Privacy Policy. The assessment considers the sensitivity of the information, the purpose of the transfer, the protection measures (including contractual ones), and the privacy laws that apply where the information will be held. Information is communicated only if the assessment shows it will receive adequate protection.
- Before we start a new project or processing activity, or change an existing one, in a way that affects how personal information is collected, used, shared, or kept.
The Privacy Committee reviews each PIA and follows up on the actions it identifies. A PIA is proportionate to the sensitivity of the information, the purpose of its use, its amount, its distribution, and its medium.
6. Confidentiality Incidents #
A confidentiality incident is any access, use, or communication of personal information that the law does not authorize, the loss of personal information, or any other breach of its protection. We handle each incident as follows:
- Report and log: Staff report any suspected incident to the Privacy Officer immediately. Every incident is recorded in our incident register when it is detected, however minor it appears, and the record is updated as the response proceeds.
- Contain: We take prompt measures to reduce the risk of harm and to prevent a recurrence, for example by revoking access or rotating credentials.
- Assess: The Privacy Officer assesses whether the incident presents a risk of serious injury (in Quebec) or a real risk of significant harm (under PIPEDA), considering the sensitivity of the information, the likely consequences of its use, and the probability that it will be misused.
- Notify: If that risk exists, we notify the CAI or the OPC, as applicable, and the affected individuals promptly. Where an incident affects Encrypted Session Data, we notify the Providers concerned without unreasonable delay so that they can meet their own obligations to their Clients and regulators. Every notification is recorded against the incident.
- Resolve: We correct the root cause, record what was learned, and close the incident.
The incident register records a description of each incident, the information involved, the dates, the risk assessment, and every notification. It is kept for 7 years, longer than the minimum required by Quebec and federal law, and is provided to the CAI or the OPC on request.
7. Review of These Policies #
The Privacy Committee reviews our privacy policies and procedures at least once a year, after any significant incident, and when the law or our processing changes. We update this page when our governance practices change.