Privacy Policy

1. Who we are

Legacy Point Care Inc. (“Legacy Point Care”, “we”) provides residential and community support services in the Greater Toronto Area, Ontario. We are the organisation responsible for the personal information collected through this website.

Questions about this policy, or about information we hold, go to Info@legacypointcare.com or (437) 453-4782.

2. What this policy covers

This policy covers information collected through this website. Personal health information held about people receiving our services is governed separately, under the Personal Health Information Protection Act, 2004 (PHIPA) and our internal privacy policies, which are provided at intake and available on request.

3. What we collect

Information you give us

• Contact and inquiry forms: your name, email address, phone number, organisation, city, relationship to the person being supported, the service you are asking about, and the message you write.
• Admission inquiries: additionally the approximate age of the individual, funding source and desired start date, where you choose to provide them.
• Job applications: your name, contact details, city, LinkedIn address, résumé, cover letter, availability, years of experience, and your answers about work entitlement, driver’s licence and police record check.
• Newsletter: your email address.
• Donations: your name, email address and any message. Card details are entered on Stripe’s systems and never reach ours.

Information collected automatically

• A one-way cryptographic hash of your IP address is stored with form submissions. We cannot reverse it to recover your address; it exists so that abuse of our forms can be investigated.
• Your browser type and referring page, in standard server logs.
• If analytics are enabled, aggregate usage data through Google Analytics and Microsoft Clarity. We enable IP anonymisation in Google Analytics.
• Your display preferences (text size, contrast, motion) are stored in your own browser and never sent to us.

Please do not send us detailed medical or diagnostic information through the website forms. We will collect what is needed securely once we are in touch.

4. Why we collect it

To respond to your inquiry, assess a referral, process a job application, send newsletters you asked for, process a donation, protect our forms from abuse, and understand which parts of the site are useful. We do not use your information for any other purpose without asking you first.

We do not sell personal information. We do not share it for advertising. We do not trade contact lists with other organisations.

5. Who we share it with

• Our own staff, limited to those whose role requires access. Résumés are visible only to authorised hiring staff, and every access is logged.
• Service providers who operate parts of this website on our behalf: our hosting provider, our database provider, our email provider, and Stripe for donations. Each processes information only on our instructions.
• Other organisations involved in someone’s care, but only with signed consent.
• Authorities, where we are legally required to disclose — including our duty to report suspected abuse or neglect.

6. How long we keep it

Inquiries that do not proceed

Two years from last contact.

Inquiries that become a service

Retained with the service record, under our record-retention policy and applicable legislation.

Unsuccessful job applications

One year, then deleted.

Successful job applications

Retained in the employee record.

Newsletter subscriptions

Until you unsubscribe.

Donation records

Seven years, as required for financial records.

Server and audit logs

Twelve months.

7. How we protect it

The site is served over HTTPS. Administrative access requires an individual account with a strong password and is limited by role, with accounts locked after repeated failed sign-in attempts. Uploaded files are stored outside the public web root and private files require an authenticated session with the appropriate permission; every access is recorded in an append-only audit log. Passwords are stored using bcrypt and are never recoverable, by us or anyone else.

No system is perfectly secure. If we discover a breach affecting your information, we will notify you and the Office of the Privacy Commissioner of Canada as required.

8. Your rights

You may ask us to:

• Tell you what personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete information, where we are not required to keep it.
• Withdraw a consent you previously gave, including for a published testimonial or photograph.
• Stop sending you newsletters — every email carries an unsubscribe link.

Write to Info@legacypointcare.com and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or, for personal health information, the Information and Privacy Commissioner of Ontario. We will not discourage you from doing so.

9. Cookies and similar technologies

This site sets a session cookie only for staff signing in to the administration portal. It is strictly necessary, contains no personal information, and is removed when you sign out. Your display preferences and any dismissed announcement are stored in your browser’s local storage and never transmitted to us. If analytics are enabled, Google Analytics and Microsoft Clarity set their own cookies; you can block them with your browser settings or an ad blocker without affecting the site.

10. Children

This website is intended for adults. We do not knowingly collect information directly from children. Information about a young person we support is provided by a parent, guardian or referring professional.

11. Changes to this policy

We will update this page when our practices change and revise the effective date. For material changes we will place a notice on the site.