Privacy Policy

1. Introduction

OntarioRefund.net ("Company," "we," "our," or "us") helps people recover money lost through financial disputes — online scams, denied insurance claims, and fraudulent billing, among others. Delivering this kind of service often means handling sensitive personal details, including information related to your health.

Protecting that information is something we take seriously. This Privacy Policy explains what we collect, how we use and share it, what rights you have over it, and what obligations we operate under according to relevant privacy law.

2. Scope and Legal Framework

This policy covers all personal information — including sensitive and health-related data — that we gather from anyone who visits our website, uses our services, or contacts us with an inquiry.

Because we operate out of Ontario, Canada, our practices are shaped mainly by two laws: the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs private-sector data handling nationally and calls for meaningful consent plus strong safeguards around sensitive data, and the Personal Health Information Protection Act (PHIPA), which sets out rules specifically for organizations in Ontario that handle health information.

We treat financial and health-related data as categories that deserve extra protection. When we process data belonging to residents of other regions — for instance, EU residents under the GDPR — we take steps to comply with those frameworks as well.

3. Definitions

"Personal information," as used here, means anything that can identify a specific person. "Sensitive personal information" covers things like racial or ethnic background, political views, religious affiliation, biometric or genetic data, and especially financial and health details.

"Personal health information" (PHI) means any identifying detail connected to someone's physical or mental health — this includes medical history, diagnoses, treatments received, and records of payment for healthcare services.

4. Information We Collect

We only gather what's actually needed for the purposes described in this policy. Broadly, this can include:

a) What You Give Us Directly

• Identifying details: your name, address, email, phone number, date of birth.
• Case details: the story and documentation behind your case — things like contracts, email threads, or other correspondence relevant to your dispute.

b) What's Collected Automatically

• Technical data such as your IP address, browser and operating system type, referring links, and general site-usage patterns, gathered via cookies and similar tools mainly for security and analytics.

5. How We Use Your Information

With your consent, or where the law otherwise permits, we use your information to:

• Verify and assess: Confirm your identity and evaluate whether your case is a good candidate for fund recovery.
• Deliver our services: Put together your case file and prepare/submit claims, appeals, or disputes to the relevant banks, insurers, or authorities on your behalf.
• Communicate with you: Answer your questions, keep you posted on case progress, and send you notices related to our services.
• Protect against fraud: Watch for suspicious activity or unauthorized access, and keep our systems and your data secure.

Before we collect, use, or share anything considered sensitive, we get your explicit consent, consistent with PIPEDA's heightened consent standard for this type of data.

6. Data Sharing and Disclosure

We never sell, rent, or trade your personal information. We only share it under specific circumstances, and always with safeguards in place:

• Our own team: Employees and contractors who need the data to do their jobs, all bound by confidentiality obligations.
• Outside service providers: Trusted partners — such as legal counsel or forensic accountants — who help us deliver our services. These partners are contractually required to protect your data and use it only as we direct.
• Legal requirements: When disclosure is required by law, regulation, or court order, or when it's necessary to protect our rights, safety, or property. Unless legally barred from doing so, we'll try to let you know when this happens.

7. How Long We Keep Your Data

We hold onto personal information only as long as it serves the purpose it was collected for, or as long as the law requires. Specific timeframes depend on the type of data:

• Active case files: Kept for up to seven (7) years after a case closes, to satisfy potential legal or audit needs.
• Inquiries that don't proceed: If you reach out but never sign a retainer agreement, we delete your information within twelve (12) months of our last contact with you.
• End of life for data: Once information is no longer needed, we securely destroy it or anonymize it beyond recovery, making sure sensitive and health-related data can't be reconstructed or accessed afterward.

8. How We Protect Your Data

We maintain administrative, technical, and physical protections around your data, with extra layers for sensitive financial and health information:

• Encryption: AES-256 for stored data, TLS 1.3 for data in transit.
• Access restrictions: Role-based permissions, multi-factor authentication, and a least-privilege approach so only the people who genuinely need access to sensitive data have it.
• Ongoing checks: Regular security audits and continuous system monitoring.
• Staff training: Recurring privacy and security education for our team.

That said, no system connected to the internet is completely immune to risk. If a breach occurs that could cause you meaningful harm, we'll notify you and the relevant regulators promptly, in line with our obligations under PIPEDA and PHIPA.

9. Cookies and Tracking

We rely on essential cookies to keep the site functional and secure, and may use analytics cookies to understand how visitors use our site. We don't use cookies to gather sensitive personal or health data. You're free to adjust your cookie settings through your browser at any time.

10. Your Rights Over Your Data

Subject to applicable law and identity verification, you have the right to:

• Access a copy of the personal information we hold about you.
• Correct anything that's inaccurate or incomplete.
• Request deletion of your data, within the bounds of any legal retention requirements.
• Withdraw consent for us to process your data at any time — though this may come with contractual or legal limitations, which we'll explain before acting on your request.

To exercise any of these rights, or if you have questions about this policy, reach out to our Privacy Officer using the contact details below.

11. Contact Us

OntarioRefund.net — Privacy Officer Email: [email protected]