Privacy Policy & Client Commitment

At Cornwall Group Benefits (“CGB”), we are committed to protecting the privacy of personal information entrusted to us by our clients, plan administrators, and plan members. This policy is established under the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Accountability

CGB’s Privacy Officer oversees PIPEDA compliance, responds to inquiries and complaints, and ensures appropriate handling of personal information shared with third parties.

Joe Leger, President & Partner
joe@cornwallgroupbenefits.com

2. Information We Collect

We may collect and have access to:

  • Plan member demographics, dependent and beneficiary information
  • Health, disability, and medical information related to benefits or underwriting
  • Employment and earnings information where required for eligibility or billing
  • Plan administrator contact and authorization details
  • Banking or payroll information where applicable

3. Purpose of Collection

Personal information is collected only for identified purposes, including:

  • Plan design, renewal, and carrier submissions
  • Enrolment, claims support, and TPA coordination
  • Claims experience reporting and financial analysis
  • Industry benchmarking and analytics, in de-identified form
  • Legal, regulatory, and contractual compliance
  • Communication of plan changes and legislative updates

4. Consent

CGB obtains meaningful consent before collecting, using, or disclosing personal information. Express consent is required for sensitive information (health, disability, financial). Consent may be withdrawn at any time by contacting our Privacy Officer; withdrawal may affect delivery of certain services.

Plan sponsor consent is provided via the Consent & Acknowledgement section that follows. Plan member consent is obtained through benefit enrolment forms.

Where we contact you about additional products or services, we seek your consent for those communications.

5. Limiting Collection

CGB collects only the personal information necessary to fulfill identified purposes, gathered by lawful and fair means. We do not collect beyond what is required to deliver our services.

6. Use, Disclosure & Retention

Personal information is used only for identified purposes. To deliver our services, we must share it with third parties, including:

  • Insurance carriers
  • Our group advisory service, Group Force Benefits Inc.
  • Third-party administrators (TPAs) and benefits platforms
  • Voluntary and supplemental carriers
  • Reinsurers, stop-loss carriers, and technology vendors (including our secure file platform and CRM) under confidentiality obligations
  • Legal or regulatory bodies as required by law

As part of our advisory role, we may market your plan to other carriers to obtain competitive coverage and pricing on your behalf.

Once we provide information to a carrier — for example, to enrol plan members — that carrier manages it under its own privacy policy. A carrier may contact plan members directly about individual products, including after they leave a group plan. We do not control these communications.

We may contribute de-identified plan data to an industry benchmarking pool so that clients receive accurate, market-wide benchmarking. Company names are removed and the data is not identifiable or searchable; individual plan member information is not included.

CGB does not sell personal information. Records are retained only as long as required to fulfill these purposes or meet legal obligations, then securely destroyed or anonymized. Sensitive information is permanently destroyed when no longer needed (e.g., secure digital shredding).

7. Accuracy & Access

CGB maintains accurate, complete, and current records. Plan administrators and members may request access to their personal information or submit corrections in writing to our Privacy Officer. CGB will respond within 30 days at no cost.

8. Security Safeguards

We protect personal information through:

  • Physical: locked filing, restricted office access
  • Organizational: confidentiality obligations, staff training, need-to-know access
  • Technical: encrypted communications, password-protected systems, secure platforms

We are intentional about keeping client information within Canadian borders: we use Canadian-based platforms (such as TitanFile and our CRM) and select Canadian data-residency settings wherever available.

Where we use technology — including artificial-intelligence tools — to assist with routine tasks such as claims-experience summaries, information is processed only by vetted providers under confidentiality obligations.

Third-party service providers are required to maintain comparable privacy and security standards.

9. Privacy Breach Response

In the event of a breach posing a real risk of significant harm, CGB will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required under PIPEDA. Please contact our Privacy Officer immediately if you believe your information has been compromised.

10. Challenging Compliance & Updates

Clients, administrators, and members may raise privacy concerns directly with our Privacy Officer. Unresolved complaints may be escalated to the Office of the Privacy Commissioner at www.priv.gc.ca.

This policy may be updated periodically. Material changes will be communicated to active clients. The current version is always available from our Privacy Officer.

Policy Version: 202607