About · Your Privacy

Your story stays yours.

Telling someone how you were burned is not a small thing. When you tell us, you decide who else ever hears it. This page sets out exactly what we hold, who can see it, and how to make us delete it.

Your rights Ask us anything
Never sold. Never traded.
Not to anyone, for any amount, under any circumstances. We don't buy lists either.
Nothing published by default
Joining peer support and appearing anywhere public are two separate decisions. The second one is always yours.
Nothing medical is required
You can take part in every one of our programs without telling us a single detail about your injury.

What we hold, and why

Only what a program actually needs to work. If a field isn't doing a job, we don't have it.

What Why we need it Optional?
Name, email, city, province To reach you, and to know which region a peer supporter is in Required
Your connection to burn injury To match peer support, and to keep survivor-only spaces survivor-only Required
Your injury — year, cause, what you're living with So we can match you with someone who has been through something similar Optional
Camp health and consent forms Allergies, medications, emergency contacts. To keep a child safe at camp Required for camp
Donation records To issue your receipt. The CRA sets what a receipt must show Required to receipt
Newsletter consent, and the date you gave it Canada's anti-spam law requires us to be able to show when you agreed Optional

Who can see it

By role, and only what the role needs. Being on our board does not give someone the right to read your file.

Your peer supporter
Sees what you chose to tell us, and nothing about anyone they aren't matched with.
Camp staff
Health and emergency information for the children in their own cabin only.
Our Treasurer
Donation records, because someone has to reconcile the bank. Never session notes.
Our directors
Governance records. Not your file — not automatically, and not on request without a documented reason.
Every look is recorded
When anyone opens your contact record, your support request, a session note about you, or your peer supporter or volunteer file, our system logs who opened it and when. Ask us and we will send you that list. We can tell you who has seen your information because we keep track on purpose.

What you can ask us to do

These are rights under Canadian law, not favours. One email to info@canadianburnsurvivors.ca is enough, and we answer within 30 days at no charge.

See everything you hold about me
We gather it from every system and send you a copy. Not a summary — the records.
Correct something that's wrong
Tell us what's wrong and we fix it.
Delete it
We delete everything except donation receipts, which the CRA makes us keep for seven years, and anything tied to an open safety matter. We tell you plainly what was kept and why.
Tell me who has looked at my record
We send you the log.
Take me out of the directory, but keep supporting me
Withdrawing consent to be listed never affects your access to peer support. They were never the same decision.
If you aren't satisfied with how we answer, you can complain to the Office of the Privacy Commissioner of Canada — or, if you live in Quebec, to the Commission d'accès à l'information du Québec. We'll tell you how to do it rather than making you find out.

How long we keep it

Set in our system and enforced automatically. When something passes its date, it's deleted — we don't rely on remembering. Camp health and consent forms are still paper, kept in a locked cabinet and destroyed by hand 12 months after camp ends.

24 mo
Peer support session notes
12 mo
Unactioned support requests
7 yr
Donation and receipt records — the CRA requires it
Always
Minutes, resolutions and registers — charity law requires it

How we keep it safe

Encrypted, and moving to Canada
Records are encrypted at rest and in transit. We are moving survivor and member records to a Canadian data centre — we would rather tell you that plainly than imply it is already done.
We can't read your password
Passwords aren't stored — only a one-way hash. Nobody here can look yours up, including our administrators.
Individual accounts, automatic sign-out
No shared logins. Sessions close after 20 minutes idle, so nothing sits open on a borrowed laptop.
Suppliers, named
Payments through Square, email through Google and Mailchimp. They hold contact and payment details — never session notes or camp health forms.
If something goes wrong
We have a written breach response plan. If a breach could seriously harm you, we tell you directly — by phone or a personal email, not a notice buried on a web page — and we report it to the Privacy Commissioner. We say what happened, exactly what of yours was involved, and what we're doing about it. We keep a register of every breach, including the ones that turned out to be minor.

Talk to our Privacy Officer

A real person, not a form. Our President holds this role until the board appoints someone else, and answers these requests personally. Ask what we hold, ask us to delete it, or ask a question before you decide to tell us anything at all. That last one is always a fair question.

info@canadianburnsurvivors.ca
The laws we follow
PIPEDA — federal privacy law
Quebec Law 25 — for our Quebec members
Alberta and B.C. PIPA
CASL — anti-spam
We are a Canadian charity, so American HIPAA does not apply to us. We hold survivor health information to the standard those Canadian laws set, and to the standard we would want for ourselves.
Charity BN 784855405RR0001