How this policy applies:  

Bespoke often handles personal information on behalf of employers, plan sponsors and other clients. In those engagements, the client determines the purpose and authority for the work, and Bespoke uses the information only to provide the agreed services.

​

Purpose and scope

This policy describes how Newnimble Solutions Inc., operating as Bespoke Benefit Solutions ("Bespoke," "we," "us" or "our"), handles personal information in the course of providing employee benefits consulting and related professional services. It applies to information about client representatives, employees, plan members, dependants, survey or interview participants, and other individuals whose information we handle in connection with an engagement.

This policy applies to Bespoke personnel and to subcontractors acting for Bespoke. It does not replace a client's own privacy notices or responsibilities, and it does not limit rights provided by applicable law. Our website privacy practices are addressed separately in the Bespoke Website Privacy Policy.

For this policy, personal information means information about an identifiable individual. Information that has been aggregated or de-identified so that an individual cannot reasonably be identified is not generally treated as personal information, although contractual restrictions and appropriate safeguards may continue to apply.

​

Accountability and our role

Bespoke is accountable for personal information in its custody or control and for meeting its contractual and legal obligations. Valerie Travis, Founder & Principal Consultant, is Bespoke's Privacy Officer and oversees this policy, responds to access requests and complaints, and coordinates privacy-incident responses.

Bespoke often acts as a consultant or service provider to an employer, plan sponsor, benefits trust or other client. When a client or an authorized benefits provider gives us personal information, the client remains responsible for having the authority to collect and provide it, including giving any required notices and obtaining any required consent. Bespoke uses the information only for the client's authorized purposes and the services described in the engagement.

When Bespoke collects information directly from an individual, such as through a survey, interview or focus group, we explain the purpose of the collection and other material information about the handling of the information. We obtain consent or rely on another lawful basis, as applicable.

​

Personal information we may handle

Depending on the engagement, Bespoke may handle the following categories of personal information:

• Identity and contact information, such as names, mailing addresses, email addresses, telephone numbers and employee or plan identifiers.

• Demographic and dependant information, such as dates of birth, ages, family status, postal code, and the names and ages of spouses or dependant children.

• Employment and benefits information, such as employer, job or employee classification, hire or service dates, benefits eligibility and enrolment, coverage or benefit elections, salary, earnings and other compensation information.

• Health, disability, absence and claims information, such as diagnosis or medical information, functional limitations, treatment or recovery information, return-to-work information, claims history or status, benefit payments, and related correspondence.

• Survey, interview and focus-group information, such as responses, opinions, demographic answers, open-text comments and participation information. Depending on the project, responses may be anonymous, confidential or potentially identifiable.

• Business and engagement information, such as client-contact information, instructions, correspondence, contracts and records relating to the delivery of our services.

Bespoke may receive information about dependant children from a client for benefits-related work. We do not use that information for unrelated purposes. We limit the personal information we request or receive to what is reasonably needed for the engagement.

​

How we receive personal information

Bespoke may receive or collect personal information from:

• employers, plan sponsors, benefits trusts and other clients;

• insurers, third-party administrators, benefits vendors and other authorized providers, including through secure portals and reports;

• individuals who respond to surveys, participate in interviews or focus groups, or communicate directly with us; and

• subcontractors, actuaries or other consultants supporting an authorized engagement.

 

Why we use personal information

Bespoke uses personal information only for reasonable, identified purposes connected with its services, which may include:

• assessing benefits eligibility, enrolment, plan design, cost and demographic or workforce considerations;

• analyzing claims, disability, absence, plan experience and benefits utilization;

• supporting or resolving an individual claim, coverage issue or service escalation with a client, insurer, administrator or other authorized provider;

• designing and administering surveys, interviews or focus groups, communicating with participants, analyzing responses and reporting findings;

• preparing member or employee communications and education materials;

• developing client reports, advice and recommendations;

• administering the client relationship and meeting contractual, professional, legal and record-keeping obligations; and

• protecting our systems and information, investigating concerns, responding to privacy requests or incidents, and establishing or protecting legal rights.

Bespoke does not sell or rent employee, dependant, plan-member, claims or survey personal information, and we do not use it for unrelated marketing. If we wish to use personal information for a new purpose, we will obtain any consent or other authority required by law.

 

Consent and other authority

Bespoke collects, uses and discloses personal information with consent or as otherwise permitted or required by applicable law. The appropriate form of consent depends on the sensitivity of the information, the individual's reasonable expectations, and the circumstances.

Where a client provides personal information or directs Bespoke to obtain it from an insurer, administrator or other provider, Bespoke relies on the client's instructions and authority for the work. If Bespoke collects information directly, we provide a notice appropriate to the circumstances. A person may withdraw consent for a collection or use that depends on consent, subject to legal, contractual and practical limitations. Withdrawal does not affect handling that occurred lawfully before the withdrawal and may limit the services that can be provided.

​

Surveys, interviews and focus groups

Before collecting responses directly, Bespoke describes the purpose of the project and whether participation and responses are anonymous, confidential or otherwise potentially identifiable. A survey may use a unique link to manage participation without linking a name to the answers, or it may be designed so that Bespoke can link responses to an individual. The applicable survey notice governs the specific project.

Bespoke generally reports survey and research findings in aggregated or statistical form. We remove names and other direct identifiers, combine or suppress small groups where practical, and review open-text comments before quoting them to reduce identifying details. Even after these steps, a respondent may sometimes be recognizable from a unique combination of demographic details, circumstances or wording. We do not promise anonymity where re-identification could reasonably occur, and we explain material limits in the project notice.

 

Sharing personal information

Bespoke may disclose personal information or provide access to it only as reasonably necessary for an authorized purpose, including to:

• the client that engaged Bespoke and individuals within the client's organization who are authorized to receive it;

• Bespoke personnel who need the information to perform their responsibilities;

• subcontractors, actuaries and other consultants supporting the engagement and subject to confidentiality, use, security and return-or-deletion requirements;

• insurers, third-party administrators and benefits vendors when directed or authorized by the client or individual;

• technology and hosting providers that process information for Bespoke, such as business-productivity, file-storage, communication and survey platforms;

• professional advisers, insurers, regulators, law-enforcement authorities, courts or other persons where permitted or required by law; and

• a party to a proposed or completed business transaction, subject to applicable legal requirements and safeguards.

We limit the information shared to what is reasonably necessary and use contractual or other measures appropriate to the circumstances to protect information handled by service providers.

​

Processing outside Canada

Bespoke, its clients and its service providers may store or process personal information in Canada, the United States or another jurisdiction. Some business-productivity, file-storage, communication and survey services may involve storage or processing in the United States or other jurisdictions. The specific location may vary depending on the provider, service and account configuration. Information handled outside Canada may be subject to the laws of that jurisdiction and may be accessible to its courts, law-enforcement or national-security authorities.

Bespoke remains accountable for meeting its obligations for information transferred to a service provider. We consider the sensitivity of the information and use contractual or other measures appropriate to the arrangement. No contract can prevent lawful access under the laws of another jurisdiction. Clients that require a specific data-residency arrangement should identify that requirement before information is provided so that Bespoke can confirm whether it can be accommodated.

​

Accuracy and correction

Bespoke takes reasonable steps to ensure that personal information is sufficiently accurate, complete and current for the purpose for which it is used. We generally rely on the client, authorized provider or individual who supplied the information. Individuals may ask to correct information as described under Access, correction and complaints below.

 

Retention and secure disposal

Bespoke retains personal information only for as long as reasonably necessary for the identified purpose and to meet contractual, professional, legal and record-keeping obligations. Retention may be set out in a client agreement or project-specific schedule. Raw project data is deleted after the engagement or the agreed retention period, while final reports and selected working files may be retained where reasonably necessary for business, professional or legal purposes.

When personal information is no longer required, Bespoke securely deletes, destroys or anonymizes it, subject to any legal hold or required retention period. Copies in backups, security logs or a service provider's systems may remain for a limited period under the provider's normal retention and recovery cycles and are not used for other purposes.

 

Safeguards

Bespoke uses reasonable administrative, technical and physical safeguards appropriate to the sensitivity, amount, format and distribution of the personal information. Our safeguards include, as applicable:

• limiting access to personnel and subcontractors who need the information for an authorized engagement;

• confidentiality and contractual restrictions on use, disclosure, safeguarding and return or deletion;

• passwords and multi-factor authentication;

• device encryption, automatic screen locking and security software on Bespoke-managed devices;

• account, file-sharing and access controls within the systems and client workspaces we use; and

• secure file-transfer methods or password protection when appropriate to the sensitivity of the information.

Bespoke primarily maintains client records electronically. Although we take reasonable precautions, no method of transmission or storage is completely secure. Safeguards are reviewed and adjusted as our services, systems and risks change.

 

Privacy and security incidents

If Bespoke becomes aware of a suspected loss, unauthorized access, use or disclosure, or another breach involving personal information, we take reasonable steps to contain and investigate the incident, document the circumstances and response, and reduce the risk of further harm. We notify an affected client promptly where the incident relates to information handled for that client and support the client's assessment and required notifications.

Where Bespoke has responsibility under applicable law, we assess the risk, notify affected individuals and privacy regulators when required, and maintain incident records for the required period. A suspected incident involving information handled by Bespoke should be reported promptly to the Privacy Officer.

​

Access, correction and complaints

An individual may contact the Privacy Officer to ask whether Bespoke holds personal information about them, request access to it, ask for a correction, withdraw consent where applicable, or raise a concern about Bespoke's privacy practices. We may need to verify the requester's identity and obtain enough information to locate the relevant records.

If the information was provided by or is controlled by a client, Bespoke will normally refer the request to that client or coordinate the response with the client. If Bespoke collected the information directly and is responsible for the response, we will respond within the period required by applicable law. Access may be limited or refused where permitted or required by law, including where disclosure would reveal personal information about another person, confidential commercial information or information protected by legal privilege.

Bespoke will investigate privacy complaints and communicate the outcome. If a concern is not resolved, the individual may contact the privacy regulator with jurisdiction over the matter.

 

Changes to this policy

Bespoke may update this policy to reflect changes in our services, practices or legal obligations. The effective date and version will be updated when the policy changes. Where a change is material, we will provide notice through a method appropriate to the circumstances.

 

Contact the Privacy Officer

Questions, access requests, correction requests, complaints and suspected privacy incidents may be directed to:

Privacy Officer:    Valerie Travis

Title:                          Founder & Principal Consultant

Company:                Newnimble Solutions Inc., operating as Bespoke Benefit Solutions

Email:                        valerie.travis@bespokebenefit.com

General email:       letsconnect@bespokebenefit.com

Telephone:              (604) 790-0108

Mailing address:    1451 Highlands Blvd, Agassiz, BC  V0M 1A1