As an Organization

Accerta is committed to safeguarding and handling the personal information in its care, in compliance with privacy laws, best practice for protection of personal information and as stipulated in contracts with its customers.

The Accerta Privacy & Security Office is responsible for providing leadership on all privacy matters that affect the organization and oversees all compliance activities.

Through its Policies and Procedures

Accerta has developed privacy and security policies which outline the rules and guiding principles by which Accerta will ensure compliance with privacy laws and fair information practices, as found in the CSA Model Code.

By Ensuring Privacy and Security Training

Privacy and security training of all new personnel is conducted as a part of the onboarding and annual activities at Accerta in accordance with the Accerta Privacy & Security Training and Awareness Policy.

Through its Agreements Accerta enters into a written agreement with:

• Plan Sponsors/Customers
• Vendors that support program delivery
• Users of the Accerta’s digital properties
• Personnel to advise them of their obligations for Confidentiality

Identifying Purpose for the Collection of Personal Information

In all situations where Accerta directly collects personal information from clients of the plan sponsor (“clients”), it will provide notice of collection and also identify the purpose for the collection. If Accerta receives information for/from a plan sponsor, it will identify the purpose for receipt of the personal information within the relevant service agreements.

Consent for the Collection, Use and Disclosure of Personal Information

Depending on the terms of the agreement with the plan sponsor, the plan sponsor may maintain custody and control of personal information held by Accerta, or Accerta may have custody and control of the personal information held by Accerta.

In circumstances where the plan sponsor maintains custody and control, Accerta expects that each plan sponsor fully complies with any consent directive expressly given by their clients, prior to any personal information being shared with Accerta. In cases where Accerta directly collects personal information from a client, the collection is made on behalf of the plan sponsor. Accerta will provide notice to clients for the collection of any personal information.

In circumstances where Accerta maintains custody and control of the information that it collects on behalf of plan sponsors, Accerta will determine the preferred consent method (express or implied) under which the data is collected by Accerta. Subject to limited exceptions, Accerta will obtain consent, either express or implied, before the collection, use, or disclosure of personal information.

When an individual contacts Accerta to withdraw their consent for continued participation in a benefits program,  Accerta may refer the matter back to the plan sponsor or may deal with withdrawal directly, depending on the terms of the agreement between Accerta and the plan sponsor. The plan sponsor must advise Accerta about changes or removal of clients from any benefits program.

Accerta Limits the Collection of Personal Information

Accerta receives only that personal information necessary to fulfill its responsibilities as the benefits plan administrator for each plan sponsor.

Accerta’s Use, Disclosure and Retention of Personal Information

Use of Personal Information

Accerta does not use personal information for purposes other than to fulfill its contractual obligations to the plan sponsor. All permitted uses of personal information are noted within Accerta’s service agreements.

Disclosure of Personal Information

Accerta only discloses  personal information for the purpose of providing services to or on behalf of the plan sponsors, or for other purposes only if permitted or required by law. Accerta may act on behalf of the plan sponsor to allow the sponsor to disclose personal information to another authorized party (through Accerta’s  portal), or back to the client (via the call centre).

Accerta will not disclose any personal information for its own purpose or for any secondary purpose, unless permitted or required by law.

Accerta will notify the plan sponsor and conduct an investigation in the case of a potential unauthorized access, collection, use or disclosure of the personal information.

Retention of Personal Information

Accerta will retain personal information in accordance with its policies for secure data retention and in compliance with specific contractual obligations. Secure destruction of personal information in paper and electronic form will be completed by a third party vendor. A certificate of destruction and a log of destruction will be maintained by Accerta.

Collaboration for Ensuring the Accuracy of Personal Information

Plan sponsors and their clients are responsible for ensuring that the data they provide to Accerta is up to date and accurate, for the purpose that it is shared. Once personal information is received by Accerta, Accerta will work in collaboration with the plan sponsor and clients to ensure it is maintained and updated to fulfill its purpose.

Safeguards for the Protection of Personal Information

Security safeguards for the personal information on the Accerta system are in place to protect data from theft or loss, as well as unauthorized access, disclosure or copying.

All data under the stewardship of Accerta is stored and processed exclusively within Canada and does not leave the country at any stage. Accerta systems and service providers are fully compliant with Canadian data residency requirements, ensuring that personal information remains within Canadian borders at all times. No data, under the stewardship of Accerta, is transferred, accessed, or disclosed outside of Canada.  

Accerta applies administrative, technical and physical security controls over the data to ensure the appropriate handling of personal information regardless of the format in which it is held (i.e. paper or electronic records). Controls are in place to secure personal information throughout its lifecycle.

Accerta is Open About its Management of Personal Information

Accerta makes general information about its data management practices readily available to the public through its website.

Additional information on the Accerta privacy program or a copy of the Accerta Privacy Policy can be requested from the Accerta Privacy & Security Office at [email protected].

Accerta Supports Individual Access and Amendment of Personal Information

Accerta acknowledges an individuals’ right of access to their personal information held by Accerta and has implemented procedures to support individuals making a request for access.

Accerta responds to each request in accordance with the requirements specified by each plan sponsor. In cases where no requirements are stipulated by the plan sponsor, Accerta will respond as soon as possible, but no later than 30 days after receiving the request. When processing an access request, Accerta may:

• Inform the requestor of the existence of the requested personal information on the Accerta system and provide them with access to this information;
• Advise that additional time is required to comply with the request and provide an explanation as to why additional time is required;
• Identify which Plan Sponsor forwarded the Beneficiary’s information to Accerta for processing; or
• Direct the requestor to directly contact the Plan Sponsor with their access request.

Challenging Compliance Practices at Accerta

Any individual concerned with the privacy practices at Accerta can make an inquiry and/or register a complaint to the Accerta Privacy & Security Office by: