This Governance Framework establishes how GreenShield governs, protects, uses, and manages personal information, including health and social services information (Personal Information), in accordance with but not limited to the Personal Information Protection and Electronic Documents Act (PIPEDA), Personal Health Information Protection Act, Ontario (PHIPA), Quebec’s Act respecting the protection of personal information in the private sector (APPIPS),  Quebec’s Act respecting Health and Social Services Information (Law 5)the Health and Social Services Information Act (Quebec Law 5). Its purpose is to operationalize statutory requirements on privacy, accountability, transparency, and security across the full information lifecycle—from collection to destruction.

The framework applies to:

• All GreenShield employees, agents, affiliates, representatives, contractors, and/or service providers with access to Personal Information.
• All Personal Information collected, stored, used, or disclosed by GreenShield, regardless of format (electronic or paper) or location, including information entrusted to third parties.

In accordance with applicable legislation, GreenShield has assigned individuals to be responsible for the privacy and security of the Personal Information it holds.  The following outlines key roles and their responsibilities:
‍

Chief Privacy Officer (CPO)‍

• Oversees and monitors compliance with applicable Canadian privacy legislation, and internal governance requirements.
• Authorizes disclosures, maintains registers (examples include: communications, consents, incidents), oversees inquiries and complaints, privacy incidents, individual rights requests, training, and privacy impact assessments.
• Chairs the Security and Privacy Committee.

Technology and Information Resources Leadership [Designated Person Responsible for ensuring compliance with technological standards (Chief Information Security Officer - CISO)]

• Ensures that the technological products or services used by GreenShield are compliant and operating effectively.
• Supervises the implementation and maintenance of security measures to protect Personal Information.

Security and Privacy Committee

• The Committee’s role is one of oversight recognizing the need to develop a culture of security and privacy awareness amongst GreenShield employees across the enterprise.
• Provides oversight of access classes, security controls, logging mechanisms, and compliance monitoring.
• Conducts annual, quarterly, and event driven reviews of access, use, and incidents.
• Reviews and recommends approval for privacy and security policies to ensure alignment with applicable legislation in accordance with the Committee Charter.

GreenShield Staff and Authorized Users, including Health Service Providers

• Access and use information strictly on a need to know and necessity basis, comply with retention schedules, and report privacy incidents promptly.

GreenShield’s Privacy Policy establishes a comprehensive framework for the collection, use, disclosure, and protection of Personal Information across its enterprise. It affirms GreenShield’s commitment to complying with all applicable Canadian privacy laws, while adhering to recognized fair information principles. The policy clearly outlines accountability through a designated Chief Privacy Officer and internal governance structures, emphasizes obtaining informed consent (express or implied), and limits data collection to what is necessary for defined purposes such as benefits administration, claims processing, service delivery, fraud prevention, and product improvement.

‍

The policy further details:

• The types of Personal Information collected, used and disclosed.
• How Personal Information is safeguarded through administrative, technical, and physical controls.
• How Personal Information may be disclosed to authorized parties, service providers, regulators, or affiliates strictly for identified purposes, and as permitted by law without an individual’s knowledge or consent.
• Provides guidance to individuals regarding their rights of access, correction, withdrawal of consent, and complaint escalation to regulatory authorities, alongside additional rights such as data deletion, portability, and objection to processing where applicable.
• Includes an overview of key operational areas including:
  • Retention and destruction practices,
  • Cross-border data transfers, including inter-Provincially,
  • Use of cookies and digital tracking,
  • Handling of minors’ data, and
  • Emerging practices such as voice recognition authentication—ensuring transparency, security, and regulatory alignment throughout the information lifecycle.

The full Privacy Policy can be reviewed here: https://www.greenshield.ca/en-ca/privacy-policy

GreenShield’s Privacy by Design (PbD) Protocol establishes a proactive, enterprise-wide approach to embedding privacy into all activities involving Personal Information. Aligned with applicable Canadian privacy legislation, the protocol requires that privacy considerations be integrated from the outset and throughout the lifecycle of systems, processes, and services.

‍

The protocol is grounded in the seven foundational principles of Privacy by Design, which emphasize proactive risk prevention, privacy as the default setting, and embedding privacy into system design without compromising functionality. It promotes end-to-end security, transparency, and a user-centric approach that prioritizes individual rights and trust. These principles guide business practices and decision-making across the organization to ensure that privacy is not an afterthought but a core operational requirement.

‍

GreenShield operationalizes this protocol through the completion of Privacy Impact Assessments (PIAs) which:

• Identify and mitigate risks before implementing any initiative involving personal information, including third-party arrangements,
• Ensure secure handling throughout the information lifecycle,
• Enforce strict access controls,
• Maintain oversight of service providers through contractual requirements and breach management processes, and
• Ensure consistent and compliant protection of health information across all operations.

GreenShield has established privacy and security policies to ensure the appropriate collection, use, disclosure, and retention of Personal Information, and to safeguard such information in accordance with applicable legal and regulatory requirements.

‍

The following highlights key elements of lifecycle controls in place:

‍

Collection and Use

• In practice, Personal Information may only be collected and used for legitimate, explicit purposes permitted by law.
• Consent is obtained at the time of collection which outlines the purposes for which GreenShield will use and/or disclose Personal Information.
• Use is subject to the necessity and proportionality test; consent cannot override necessity requirements.

Retention

• Personal Information is retained according to approved retention schedules or for the minimum period required to achieve the purposes for which it was collected.
• Comprehensive retention schedules outline identification, classification, retention, storage and deletion requirements.
• Measures are in place to ensure availability, integrity, and continuity (e.g., backups and restoration testing).
• Third parties who hold records on behalf of GreenShield are contractually required to adhere to the retention schedules.

Disclosure

• Personal Information is disclosed for the purposes of the services provided by GreenShield and for which consent was obtained.
• Disclosure without consent will only be done in narrowly defined circumstances (e.g., public safety, legal proceedings), subject to documented assessment, minimization, authorization, and logging.

Destruction and Anonymization

• Personal Information will be securely destroyed, de-identified, or anonymized once purposes are fulfilled, using approved methods appropriate to the medium and sensitivity of such information.

GreenShield has a specific protocol in place to outline how it manages requests from individuals regarding their rights in compliance with Canadian privacy laws. The protocol ensures that GreenShield continues to handle personal data transparently, securely, and consistently, balancing individuals’ rights with legal, operational, and security obligations.

It establishes clear processes for handling requests including:

• Access,
• Correction,
• Withdrawal of consent, and
• In Quebec, data portability and control over information disclosure.

GreenShield’s Privacy Breach Management Protocol establishes a structured, enterprise-wide approach for identifying, reporting, assessing, and managing privacy incidents involving Personal Information in compliance with applicable Canadian privacy laws.

‍

The protocol requires a formal risk-based assessment to determine whether a breach poses a “real risk of significant harm” (RROSH), considering factors such as the sensitivity of the information and the likelihood of misuse.

‍

Where thresholds are met, GreenShield ensures timely notification to affected individuals, regulators, and, where required, third parties, with clear information on the incident, mitigation steps, and recommended actions. For health-related incidents, additional regulatory and professional college reporting requirements are considered.

‍

All incidents are formally closed once mitigation is complete, with records retained for audit, reporting, and trend analysis purposes. All incidents, whether confirmed breaches or not, are documented and tracked in a centralized log to support compliance and continuous improvement.

‍

Key elements from the policy include the required timeframe for employees to report suspected or confirmed incidents to the Privacy Office, as well as guidance on the steps to be followed when managing and responding to such incidents including:

• Investigation of the incidents,
• Determination of whether a breach has occurred,
• Determination of the root cause of the incident,
• Assessment of any reporting obligations,
• Notification to senior management where there is a real risk of significant harm,
• Ensure that appropriate remediation actions are taken; and
• Maintenance of a record of each incident.

GreenShield’s Complaint Handling Policy establishes a standardized framework for receiving, investigating, resolving, and escalating customer complaints in compliance with applicable legislative and regulatory requirements, including provincial and territorial complaint handling requirements.

‍

Complaints are initially managed through a structured, multi-step resolution process beginning with the Customer Contact Centre, with escalation to the Resolution Team, Complaints Officer, and Ombudsman as needed. Specialized complaint streams follow distinct procedures aligned with regulatory or professional obligations. The Complaints Office ensures consistency and fairness by reviewing escalated complaints, conducting thorough assessments, and issuing a formal Complaint’s Officer Response, while the Ombudsman provides an independent and impartial review for unresolved matters, including the closure of the complaint with a Final Position Letter.

‍

All complaints are logged, tracked, and reported internally and, where required, to external regulators, supporting transparency, accountability, and continuous improvement. GreenShield emphasizes fair, client-centric handling, staff training, and proactive issue resolution, while maintaining robust governance through defined roles, oversight mechanisms, and ongoing analysis of complaint trends to strengthen service quality and compliance.

‍

Additional information regarding GreenShield’s Complaint Resolution Process can be found here: https://www.greenshield.ca/en-ca/contact/resolution-process

GreenShield maintains a comprehensive Information Security Program designed to protect the confidentiality, integrity, and availability of its systems, data, and applications. The program is aligned with industry best practices and is supported by formal policies, governance structures, and continuous monitoring. All employees, contractors, and stakeholders are required to comply with these policies, which are regularly reviewed and updated to address evolving risks. The program is overseen by the Chief Information Security Officer and covers areas such as risk management, compliance, incident response, and vendor oversight.

‍

To ensure resilience and preparedness, GreenShield maintains formal incident response, business continuity, and disaster recovery frameworks, which are regularly tested and updated. Vendor and third-party risks are actively managed through structured assessments and ongoing monitoring.

‍

GreenShield’s security program emphasizes strong foundational controls, including:

• Physical safeguards,
• Acceptable use standards,
• Role-based access management,
• Protection of information through data classification and encryption,
• Completion of security assessments,
• Robust network defenses,
• Continuous monitoring,
• Proactive threat detection including tabletop exercises, vulnerability management and penetration testing, and
• Secure destruction of information.

GreenShield requires that all personnel complete privacy and security training when they join GreenShield and annually thereafter.

‍

Privacy training reviews the applicable Canadian legislation and its requirements, including the 10 fair information principles, defines the types of Personal Information and consent, provides an overview of individual’s rights, and obligations of employees including knowing and understanding the privacy policy, proper handling of Personal Information, and reporting privacy incidents. Additional communications are sent to all employees as reminders of best practices, policies and procedure updates and event driven articles.

‍

Security training ensures that employees stay informed about potential threats, policies, and best practices. Ongoing awareness campaigns keep employees updated on the latest security trends, emerging risks, and organizational expectations, fostering a strong security-conscious culture.

‍

Completion of mandatory privacy and security training courses are tracked, and security refresher courses are conducted periodically to ensure continued compliance and awareness across all personnel.

In accordance with various privacy legislation’s accountability principles, GreenShield maintains:

• A register of communications/disclosures documenting all authorized disclosures.
• A register of consents obtained by individuals for privacy and marketing, including withdrawals.
• A complaint registry and privacy incident registry ensuring traceability, response tracking, and regulatory reporting, where required. 
• A register all access and rectification of information requests.

This framework is intended to be dynamic and is reviewed and updated as legal, regulatory, operational, or risk conditions evolve, supporting continuous alignment with applicable Canadian legislation, including Quebec Law 5 and APPIPS expectations.