Whistleblower Policy  

The Rick Hansen Institute strives to achieve the highest standards of ethical and legal conduct.

While RHI’s internal controls are intended to prevent or detect improper activities, even the best systems and internal controls cannot provide absolute safeguards. 

RHI encourages the reporting of suspected or known illegal and inappropriate conduct by RHI personnel or its partners that affects others (e.g., the SCI community, RHI personnel, the general public, or RHI’s own reputation).

RHI is committed to respect and protect whistleblowers, including their identity to the extent permitted by law, and retaliation against any suspected whistleblower, their colleagues or relatives.

Whistleblower Procedures

The Rick Hansen Institute has the following whistleblower procedures in place for third parties (e.g., grantees and service providers) and the general public.

Reporting Procedures

When to Report?

Concerns about illegal or inappropriate conduct that affects others should be reported as soon as you have a reasonable suspicion. This allows the concerns to be investigated and addressed promptly.

You are not expected to investigate the matter yourself or to prove that your concern about illegal or inappropriate conduct is well-founded.
If you raise a genuine concern and act in good faith, even if it is later discovered that you are mistaken, under this policy you will not be at risk suffering any form of retribution as a result. This assurance will not be extended to an individual who maliciously raises a matter they know to be untrue or who is involved in any way in the malpractice.

How to Report?

If you wish to report a concern about illegal or inappropriate conduct by RHI or its partners that affects others, RHI encourages you to fill out RHI’s Whistleblower Report Form (MS Word document) and send it to the Chair of the Audit and Finance Committee.

This can be done:

• via email to whistle[at]rickhanseninstitute.org (this email account is only accessible to the Chair of the Audit and Finance Committee and not to any RHI personnel); or
• by mail (or other means of delivery), addressed to RHI, in a sealed envelope marked "Private and Strictly Confidential – Attention: Chair of the Audit and Finance Committee of RHI", and with the reference “Whistleblowing” on the letter. (Envelope shall be forwarded unopened to the Chair of the Audit and Finance Committee.)

Note that:

• Your name will not be revealed without your consent to the extent permitted by law (e.g., if an investigation leads to a criminal prosecution, it may become necessary for you to provide evidence or be interviewed by the police). Efforts will be made to treat a report of illegal or inappropriate conduct as confidential, consistent with the need to investigate and prevent or correct the wrongdoing.
• Although RHI provides the opportunity for the whistleblower to remain anonymous, anonymous reports are very difficult to act upon as there may be little or no corroborated evidence to substantiate the allegations. Proper investigation may prove impossible if the investigator cannot obtain further information from you, give you feedback or ascertain whether your report was made in good faith. Therefore RHI encourages individuals to come forward with their concerns without remaining anonymous. However, RHI would rather you report anonymously than keep the information to yourself.
• The whistleblower policy is not meant for personal complaints or grievances (which stems from you being poorly treated and seeking personal redress; there is no additional public interest dimension) and privacy concerns or complaints about RHI’s information handling practices.
  • Personal grievances should be mailed or emailed to RHI (see RHI's Complaints Policy).
  • For privacy concerns or complaints about RHI’s information handling practices RHI’s Privacy Officer should be mailed or emailed (as explained in RHI’s Privacy Policy).

Hence, wrongdoings reported under this policy but that fall under other RHI policies and procedures, will be typically investigated under those specific policies and procedures. However, if these other established RHI reporting mechanisms do not result in an acceptable outcome or in cases where the whistleblower policy method is deemed to be the most appropriate for raising wrongdoing, this policy may be used.

Investigations

Most investigations will be conducted by the Chair of the Audit and Finance Committee with the assistance and direction of whomever he/she thinks appropriate. Persons implicated in the report will not investigate reports in which they have been named.

Some concerns might be based on a misapprehension which can be addressed without delay, some may require urgent investigation, while others could be akin to a tip-off which can be better addressed as part of a forthcoming audit or review.

In complex or sensitive situations, an external investigator might be hired.

Follow Up

Feedback to Whistleblowers

The Chair of the Audit and Finance Committee will acknowledge receipt to whistleblowers within five business days and will advise whistleblowers of the outcome of an investigation. This will not be possible for anonymously submitted reports.

Possible outcomes of an investigation could be that:

• the allegation could not be substantiated; or
• appropriate corrective actions are (to be) made to ensure that the problem does not arise again.

Whistleblowers will not, however, be given details about the actions taken as this could breach the human rights of the person(s) involved.

Corrective Actions

Appropriate corrective actions will be taken within a reasonable time frame.

Reports to the CEO and Audit and Finance Committee

A summary of whistleblowing reports (in which no personal information is revealed) will be made at least annually by the Chair of the Audit and Finance Committee to the CEO and the Audit and Finance Committee. However important issues will be escalated immediately to the CEO, Audit and Finance Committee and/or Chair of the Board.

Privacy Policy

Effective since 10 December, 2012

Our Commitment

The Rick Hansen Institute is fully committed to protecting the privacy of our employees, prospective employees, contributors, volunteers and all stakeholders. We value your trust and understand that upholding this trust requires us to be transparent and accountable as to how we use any personal information you provide to us.

In fulfilling our mission, from time to time we may collect and use personal information (as defined in this policy). The Rick Hansen Institute is compliant with the Personal Information Protection Act (PIPA) of BC, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) when handling personal information.

Collection, use, and disclosure of personal health information from health care organizations is in compliance with the Freedom of Information Protection of Privacy Act (FIPPA).

The purpose of these acts are to “Govern the collection, use and disclosure of personal information and personal health information by organizations in a manner that recognizes both the right of individuals to protect their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.”

What is Personal Information/ Personal Health Information?

Personal information is information about an identifiable individual such as someone’s name, home address, home phone number, personal email address, social insurance number, gender, income or family status. Personal information also includes donation information.

Personal health information is identifying information that relates to the provision of health care to the individual.  It can include patient survey data, patient reported outcomes, and abstracted health information. At RHI, personal health information is sometimes collected by researchers and securely transmitted to RHI for storage, analysis and aggregate reporting.

Employee personal information is information that is collected, used or disclosed for the purposes of establishing, maintaining or managing a relationship between RHI personnel (includes a volunteer or ambassador) and the Rick Hansen Institute. Information that allows an individual to be identified or contacted at work is not personal information. Work product information that is prepared or collected by an employee as a part of their work responsibilities is not considered the personal information of that individual. All RHI personnel are required to read and abide to the Rick Hansen Institute Privacy Policy.

Policy Application 

This privacy policy applies to the Rick Hansen Institute and all of its departments and organizations who contract to us.

Why We Collect and Use Personal Information

The Rick Hansen Institute collects and uses personal information for purposes necessary to fulfill our mission and in order to comply with any legal requirements. This includes the following purposes:

• To share information about the Rick Hansen Institute with stakeholders and those who may be interested in our activities.
• To track and issue tax receipts for donations received in accordance with Canada Revenue Agency requirements.
• To establish, build, and maintain relationships.
• To process financial transactions (including donations).
• To determine the eligibility of an individual or community to receive a grant and/or to issue grants.
• To use photographs taken at events related to the Rick Hansen Institute in Institute publications including: newsletters, registration forms or on our website.
• To establish, maintain and manage employment relationships between the Rick Hansen Institute and its personnel.
• To share other people's stories in relation to the Rick Hansen Institute and spinal cord injury (SCI) in general.
• To improve our ability to provide services in accordance with our mission.

The Rick Hansen Institute discloses personal information only for purposes necessary to fulfill our mission and in order to comply with legal requirements. This includes the following purposes:

• To assist an individual in receiving a grant or service in accordance with our mission.
• To use photographs in future publications including: newsletters, registration forms, or on our website.
• To establish, maintain, and manage employment relationships between RHI and its personnel.
• To share other people’s stories in relation the Rick Hansen Institute and SCI in general.
• To give donor recognition where permission to do so has been granted by the donor.
• To use third party service providers to process personal information on our behalf or to assist us with various other services such as research and mail distribution (refer to Limits on Collection, Use and Disclosure section for more detail).

In order to achieve the above stated purposes, the Rick Hansen Institute collects the following types of information:

• Contact information including name, address, phone number, and email.
• Financial information required to process donations.
• Spinal cord injury information.
• Photographs to use in future publications including: newsletters, registration forms, and on our website.
• Personal stories (which are voluntarily provided).

Limits on Collection, Use and Disclosure 

The Rick Hansen Institute will only collect, use, and disclose personal information for the purposes stated above and in accordance with the Personal Information Protection Act, and the Personal Information Protection and Electronic Documents Act. If we do require your personal information for any purposes other than those for which it was originally obtained, we will first ask for your permission to do so.
In the case of employee home contact information, no employee is authorized to share this information with anyone outside of the Rick Hansen Institute unless authorized by that employee. In the case of emergency contact information, it is only to be used in the case of an emergency. 

How We Disclose Personal Information

The only times in which personal information will be disclosed to other organizations is when service providers are contracted on our behalf to process your information or assist us with various other services such as mail distribution and research, if it is to help an individual in receiving a grant or service in accordance with our mission, or if we are required to do so by law.

In the case where another organization is contracted to process your information or assist us with other services, legally binding confidentiality agreements exist that commit those organizations to strictly adhere to the Rick Hansen Institute Privacy Policy.

The Rick Hansen Institute will not rent, sell, lease, or barter your information to any organizations or individuals. 

How We Obtain Consent to Collect, Use and Disclose Personal Information

When the Rick Hansen Institute does find it necessary to collect, use and/or disclose personal information, consent to do so will be obtained either through express consent, deemed consent, or by giving an individual the opportunity to decline consent.

The Rick Hansen Institute will make every effort to notify an individual of the purpose for collection, use or disclosure of personal information and give a reasonable chance to refuse consent and/or to withdraw consent at a later date. Only extenuating circumstances which are in the best interests of donors/participants will permit the contacting of donors/participants whom have opted out of being on our contact list.

In the case of photographs or information collected at school events, consent to use this information will be acquired from the school in accordance with its privacy policies and practices. In the case of photographs and film taken by the Rick Hansen Institute at other private events, signs will be placed at the entrances and other visually accessible places to notify people that this will be taking place, what the photographs and film will be used for, and that give the contact information for the privacy officer or delegate should that person wish to not have their photographs and film used or disclosed.

At any time after collection, an individual may withdraw their consent by giving a reasonable amount of notice to the Rick Hansen Institute.  

Retention of Personal Information

The Rick Hansen Institute acts in accordance with the Canada Revenue Agency’s guidelines for retaining donor information for a time period of six years from the end of the year in which the donation was made.  Any other personal information used to make a decision about an individual will be retained for a minimum of one year. Permission for use or disclosure of this information can be withdrawn at any time.  

Accuracy of Information 

The Rick Hansen Institute ensures that any personal information in our custody is accurate and up to date. In most instances we rely on individuals to notify us of any changes to their information. 

Security and Protection of Online Donation Information

The Rick Hansen Institute maintains appropriate security measures to safeguard personal information depending upon the sensitivity of the information and how it is stored. Measures include locked cabinets, restricted access to certain records on a need- to- know basis, the use of passwords, the use of encryption, and legally binding confidentiality agreements with all RHI personnel. 

Use of "Cookies"

Just like many other websites, the Rick Hansen Institute uses a standard technology called a "cookie". Cookies are small pieces of information that a website can send to a visitor's web browser for statistical purposes. When visitors surf our website a small text file called a "cookie" could be placed onto their hard drives. Our cookies identify the number of visitors to different sections of the website, visitors' browser types, time and length of visits, pages accessed places of origin, and visitors' internet protocol (IP) addresses. They do not collect other personal information about our visitors. Our use of cookies is solely intended to improve and enhance the experience of returning users by understanding our visitors' preferences, measure website activity, and prevent abuse in our online forums.

Most web browsers automatically accept cookies. Users can be notified when this happens, or prevent it from occurring, by setting the appropriate browser selections. 

Use of Internet Protocol (IP) Addresses

The Rick Hansen Institute uses IP addresses to assist in diagnosing server problems. We reserve the right to perform statistical analyses of user behaviour and characteristics, to measure interest in and user traffic patterns to the various sections of our website, to prevent abuse in our online forums, and to help us improve design, layout and navigation. 

Links to Other Websites

The Rick Hansen Institute website contains links to other websites that may be of interest to the visitor to our site. By providing these linkages, the Rick Hansen Institute is not responsible for the privacy practices, content, transactions, and functioning of the linkages of these sites. Users submitting information to these third party websites should review the privacy statements of these sites before providing them with personally identifiable information. 

Policy Updates and Changes

We review our privacy practices regularly and every two years. As a result, changes to this privacy policy may be made from time to time. The most current policy can be accessed on our website or by contacting the Rick Hansen Institute.

Privacy Officer

If you have any questions or concerns about our information practices, you may contact the privacy officer at:

Privacy Officer
Rick Hansen Institute
6th Floor, Blusson Spinal Cord Centre
6400 - 818 W 10th Avenue, Vancouver, BC V5Z 1M9
privacy[at]rickhanseninstitute.org