Privacy Policy

Benefits Plus Inc. protects the personal information entrusted to us by clients, plan members, dependants, beneficiaries and authorized representatives. This policy explains how we handle personal information while advising on, arranging and administering group and individual insurance plans.

We do not share personal information with third parties unless disclosure is required by law or is necessary for the operation of our clients' insurance plans. We will never sell or rent our clients' personal information.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal law governing personal information in our commercial insurance activities in Prince Edward Island, and other applicable Canadian and PEI legal requirements. PEI's Health Information Act principally governs health information custodians. Handling medical information for insurance purposes does not, by itself, make us a health information custodian. We respect applicable restrictions when receiving information from health care providers.

We collect only information reasonably necessary for an identified insurance purpose. Depending on the service, this may include contact details, date of birth, employment and earnings information, dependant and beneficiary details, policy and certificate numbers, coverage selections, payment details, and relevant application, health or claim information.

We use this information to assess insurance needs; obtain requested quotes; submit applications; arrange coverage; confirm eligibility; enrol and update members and dependants; administer premiums and billing; assist with claims and coverage questions; coordinate benefits; and support plan reviews and renewals. We also maintain required records and meet legal obligations.

We explain what information is needed, why it is needed and the parties involved before seeking meaningful consent. We obtain express consent for sensitive information, including medical information, unless the law allows otherwise. Plan administration alone does not eliminate consent requirements. This policy is not a substitute for a required consent or authorization form.

You may withhold or withdraw consent by contacting us, subject to legal or contractual restrictions and reasonable notice. We will explain any effect on applications, coverage, claims or services before acting. We do not require consent beyond what is needed for the service. We verify the authority of anyone acting for another person, including a dependant.

Our restriction on third-party sharing applies to all personal information, including medical, financial and claim information. Even where sharing is necessary for plan operation, we disclose only what is needed and obtain consent or another lawful basis. We do not disclose information merely because another organization requests it.

Necessary plan operation includes obtaining quotes you request, arranging and maintaining coverage, enrolment, premium administration, renewals, and authorized assistance with claims. Depending on the task, recipients may include insurers, benefits or claims administrators, authorized plan sponsors, and health care providers involved in a specific insurance matter.

Service providers may process information only where their services are necessary to operate or administer your insurance plan, such as secure record storage, communications or billing support. We use contractual or other appropriate measures to require confidentiality, suitable safeguards and use only for the authorized service. We remain accountable for personal information transferred to providers for processing.

Disclosures required by law may include responding to a binding court order, a statutory reporting duty or another legally enforceable requirement. We verify the legal basis and limit disclosure to the information required. We do not treat a disclosure that the law merely permits as automatically required.

Employers and plan sponsors receive only the information necessary for their authorized plan administration duties, such as eligibility, enrolment, coverage and premium details. We do not routinely provide them with diagnoses, prescriptions, medical records or detailed individual claim information.

Any disclosure of sensitive details to a plan sponsor must fall within our sharing restriction and have the individual's express authorization or a legal requirement. Employer sponsorship does not give unrestricted access to a member's health information. Where possible, medical evidence should go directly to the insurer or claims administrator through an appropriate secure channel.

Plan experience reports are provided in aggregate or de-identified form where possible. We take reasonable steps to prevent identification of members, including in small groups where a report could reveal an individual's condition or claim.

We maintain safeguards appropriate to the sensitivity of the information, including restricted access, confidentiality obligations, secure physical storage and appropriate technical protections. Access is limited to personnel who need the information for their duties. We use suitable secure methods for sensitive documents and verify recipients before sending them. Please contact us to arrange secure delivery of medical or financial records.

Necessary plan services may involve processing in another province or country. Before using a provider, we assess the privacy risks and require appropriate protections. Information processed outside Canada may be subject to that country's laws and lawful access by its authorities. You may contact us for information about relevant providers, processing locations and safeguards.

We take reasonable steps to keep information accurate, complete and current for its purpose. Please tell us promptly about changes to your contact details, dependants, beneficiary designations or other plan information.

We retain personal information only as long as necessary for identified purposes and applicable legal or contractual obligations. Retention considers policy administration, claims, complaint handling and required records. Once no longer needed, information is securely destroyed, erased or made anonymous. Ending coverage does not necessarily require immediate deletion of every record.

You may request access to the personal information we hold about you and an explanation of its use and disclosure. Please submit your request in writing to the privacy contact below. We verify identity using only what is reasonably necessary and generally respond within 30 days, at no or minimal cost. Any extension will follow PIPEDA's requirements, with written notice and information about your complaint rights.

You may ask us to correct inaccurate or incomplete information. Where appropriate, we communicate corrections to recipients. If a disagreement is unresolved, we record it as required. If access is refused in whole or in part, we explain the reason and available recourse, except where the law prevents us from doing so. We protect information about other individuals and legally privileged information.

If a privacy breach occurs, we take steps to contain it, assess the risk and reduce potential harm. Where a breach involving information under our control creates a real risk of significant harm, we notify affected individuals and report to the Office of the Privacy Commissioner of Canada as soon as feasible. We notify other organizations where legally required to reduce or mitigate harm. We keep records of all breaches for at least 24 months and longer where required by law.

Benefits Plus Inc. is accountable for personal information under its control. Please direct privacy questions, consent requests, access or correction requests, and complaints to our privacy contact:

We investigate privacy complaints and take appropriate corrective action. You may also contact the Office of the Privacy Commissioner of Canada about matters under PIPEDA. For matters governed by PEI's Health Information Act, the PEI Information and Privacy Commissioner is the relevant oversight office.

We review this policy when our services, privacy practices or legal obligations change. The updated date appears at the beginning. We make the current policy available on request and provide notice of material changes where appropriate. A policy update does not replace consent required for a new purpose.