Privacy Policy

OMHAS Solutions Inc. ("OMHAS", "we") is an occupational health and safety firm at 10-317 Southdale Road West, London, Ontario N6J 4Y7. This policy explains what personal information we collect through omhas.ca, the OMHAS Academy, the Library Card subscription and our telephone line, why we collect it, who sees it, how long we keep it, and the choices you have. It applies to visitors and callers, clients and prospective clients, organisations that purchase a Library Card, and the people those organisations add as named users. OMHAS has designated a Privacy Officer who is accountable for this policy and for our compliance with privacy law; the Privacy Officer is reached at omhas@omhas.ca.

Visitors and callers: information you send through a contact or enquiry form (name, email, phone, organisation, message), what you tell our telephone or website assistant (Section 8), and the limited technical information described in Section 12.

Clients and prospective clients: contact details, organisation details, and the information you give us in the course of our work together. In consulting engagements we receive workplace information from the client organisation, which can include incident reports, photographs, witness statements, training records and, where the client provides them, a worker's health-related work restrictions. We use that information only for the engagement, treat health-related information with heightened care, and handle it under our agreement with that client.

Library Card purchasers and administrators: the organisation's legal name and billing address, the purchaser's first and last name, email address and phone number, the names and email addresses of any administrators the organisation designates, the number of named users, the version of the Terms accepted and when, and your marketing consent choice. Payment card details are entered directly with our payment processor, Stripe; OMHAS never sees or stores a full card number, and sees only what Stripe shows us, such as the card brand, the last four digits, the expiry date and the payment status.

Named users: the first name, last name and email address your organisation gives us, your course enrolments, progress and assessment results, the courses you complete, and the certificates you earn.

Everyone who signs in: the technical records a secure system keeps, such as IP address, browser and device type, sign-in times and security logs.

We use personal information to: create and run accounts; deliver training and issue certificates; keep training records; process payments, invoices and refunds; answer enquiries and provide support; send the account, billing, security, course and certificate messages that the service requires; send marketing only to people who have separately consented (Section 5); protect the security of our systems; meet legal, tax and regulatory obligations; respond to access requests; and detect and prevent fraud or misuse. We do not use personal information for any other purpose without telling you and, where the law requires it, obtaining your consent.

Purchasers give consent at checkout by completing the purchase. Named users' information is provided by their organisation, which confirms it is authorized to do so and that it will inform its people; each named user sees a short notice when activating their account. Marketing consent is always separate (Section 5). You may withdraw consent at any time by emailing omhas@omhas.ca, subject to any legal or contractual reason we must keep the information. Withdrawing consent for information a service needs may mean we cannot provide that service.

We ask for marketing consent only from the person who purchases a Library Card or otherwise deals with us directly, through an unticked box with its own wording. We never ask named users for marketing consent and never send them marketing. We record who consented, when, the wording shown, how, and any withdrawal. Every marketing email identifies OMHAS, gives our contact details and has a working unsubscribe link, and we act on an unsubscribe within ten business days. We do not send marketing by text message; if you text us, we may reply by text. Withdrawing consent stops marketing; it does not stop the account, billing and course messages your service requires.

We do not sell, rent or trade personal information, and we do not give it to anyone for their own use. We share it only with service providers who process it for us under contract and may use it only to provide their service: Stripe (payments, invoices, receipts and tax calculation); our website and learning platform hosting; our email delivery service; our customer records system (GoHighLevel), which we use to manage our own client and contact records and communications and never to disclose personal information for unrelated purposes; the provider of our telephone and website assistant (Section 8); and professional advisers bound by confidentiality. Within OMHAS, access to personal information is limited to our directors, the consultant assigned to your engagement, and the technical staff who maintain our systems, all bound by confidentiality. We also disclose personal information where the law requires it, to protect our rights or safety or the rights or safety of others, and, for training records, as set out in Section 7.

Your training record is part of the compliance system of the organisation that enrolled you, and your certificates belong to you. While an organisation's subscription is active, its administrators can see the completed courses and certificates of its named users, including people who have left and been archived. An organisation may ask us to release a record from our archive for audit, inspection, prequalification, insurance, legal or other compliance purposes. A named user may obtain a copy of their own record at any time. Requests are subject to identity verification. OMHAS may revoke a certificate obtained through a shared login, by someone other than the named user, or on the basis of false information.

Calls to (226) 781-7154, and the assistant on omhas.ca, are answered by an automated assistant that uses artificial intelligence. Its only job is to take your name, your organisation and the reason for your call or message, and either connect you to a person at OMHAS or give you a direct number to reach one. The assistant tells you at the start that it is automated and that the conversation may be recorded or transcribed so that OMHAS can return your call or message. You can ask for a person at any time. What you say is passed to OMHAS so that we can return your call or message; it is seen only by the people described in Section 6. Conversations may be recorded or transcribed for that purpose. The provider of the assistant processes what you say only to operate the assistant for us, and we do not permit any other use.

Completed-course records and certificates: seven years from the course completion date, including after a subscription ends, because employers and regulators rely on them. Account information and incomplete-training records: for the life of the subscription and twelve months after it ends, then deleted or anonymised. Marketing consent records: for as long as the consent is in force and three years after it is withdrawn. Payment and invoice records: seven years, to meet tax, accounting and dispute requirements. Terms-acceptance and subscription records: seven years after the subscription ends. Consulting engagement records, including the workplace information described in Section 2: for the life of the engagement and seven years after it ends, unless our agreement with the client sets a different period. Enquiries, assistant conversations and call records that do not become client work: two years. Privacy requests and complaints: two years after they are closed. Records of breaches of security safeguards: at least 24 months. We delete or anonymise information when it is no longer needed for these purposes.

Our service providers may store and process information outside Canada, including in the United States. Information held outside Canada is subject to the laws of that country and may be accessible to its authorities. We choose providers that protect personal information to a standard comparable to Canadian law.

We use reasonable physical, technical and administrative safeguards appropriate to the sensitivity of the information, including access controls and encrypted connections. If a breach of security safeguards creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as the law requires, and we will notify the affected organisation under its Terms. We keep a record of every breach of security safeguards for at least 24 months after we determine it occurred, whether or not anyone is notified.

omhas.ca uses only the cookies needed for the site and the Academy to work, such as keeping you signed in. We do not use advertising cookies.

You may ask what personal information we hold about you, ask us to correct it, withdraw consent, and ask questions or make a complaint. Email omhas@omhas.ca. We respond within 30 days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or the privacy commissioner of your province.

Named users are added only by their employer, and the website is not directed to children. We do not knowingly collect information from anyone under 13 through the website.

We may update this policy. The current version and its effective date are always published at this page. Material changes will be announced to account holders by email before they take effect. If a change introduces a new purpose, disclosure or practice for which consent is required, we will obtain that consent before the change applies.