MPI Research Privacy Policy
At MPI Research, we respect your privacy and are committed to protecting the personal data of our website visitors, research participants, and clients. This Privacy Policy outlines our data governance framework, how we collect, use, store, and protect your information, and your legal rights regarding your personal data.
This policy applies to information collected through our website (www.mpiresearch.ca) and during our qualitative and quantitative market research operations. Our privacy practices are designed to comply with Canadian federal and provincial privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), British Columbia’s Personal Information Protection Act (BC PIPA), Alberta’s Personal Information Protection Act (AB PIPA), Canada's Anti-Spam Legislation (CASL), and applicable international frameworks such as the General Data Protection Regulation (GDPR).
1. Privacy Governance & Contact Information
MPI Research has designated a Security & Data Protection Officer to oversee compliance with applicable privacy laws and maintain our data protection standards. If you have any questions, concerns, or requests regarding this Privacy Policy or the management of your personal data, please contact us:
- Email: privacy@mpiresearch.ca
- Mailing Address:
MPI Research
Attn: Security & Data Protection Officer
PO Box 1069, Mount Albert PO
Mount Albert, ON, L0G 1M0, Canada
2. Information We Collect
We categorize the information we collect based on your interaction with MPI Research:
Information You Provide Voluntarily
- Patients & Caregivers: When you express interest in participating in market research or register for our panel, we collect contact information (name, email address, telephone number, mailing address) and limited demographic and health-related data. This information is collected strictly under explicit, affirmative, opt-in consent.
- Healthcare Professionals (HCPs): We collect professional contact information, medical specialties and clinical interests, and practice details. Professional contact details and clinical interests may also be sourced from publicly available registries or professional directories in compliance with applicable anti-spam laws (e.g., CASL conspicuous publication exemptions) and provincial privacy legislation to contact HCPs regarding relevant research opportunities.
- Client & General Inquiries: When you request information about our services via our website or email, we collect your name, business email, organization name, and inquiry details to respond to your request.
Technical & Automated Information
- Website Server Logs: When you visit www.mpiresearch.ca, our web servers automatically collect basic technical network logs, including your IP address, browser type, operating system, and access timestamps. This technical information is used strictly for system administration, diagnostic security, and server performance monitoring. We do not attempt to link server log IP addresses to identifiable individuals. We do not use tracking cookies on our primary website.
- Market Research Survey Security: When you participate in a market research study or click a survey link hosted on our data collection platforms, our systems temporarily capture your IP address and device metadata. This information is collected strictly as an essential operational control for fraud prevention, bot detection, data integrity verification, and duplicate response screening. This technical metadata is stored securely and is permanently destroyed once all responses have been collected and reviewed for quality assurance.
Children’s Privacy
MPI Research does not knowingly collect or solicit personal data directly from children or minors under the age of 18 without explicit parental or legal guardian consent. If you believe a minor has provided us with personal data without required consent, please contact privacy@mpiresearch.ca for immediate deletion.
3. How We Use Your Information
We process personal data strictly for defined operational and research purposes:
- Research Relevance: Matching eligible panel members and healthcare professionals to relevant market research opportunities based on geographic and demographic criteria and/or clinical interests.
- Study Execution: Invitation delivery, survey scheduling, interviewing and survey administration.
- Incentive Fulfillment: Processing and delivering study honoraria or incentive payments (delivered via cheque to your mailing address or secure electronic transfer).
- Database & Profile Accuracy: Our database is regularly updated and validated using details supplied during recent screening questionnaires, project interactions, or direct communications. Capturing updates to health conditions, diagnosis status, medical specialty, or contact information ensures research invitations remain accurate and relevant.
- Preference & Opt-Out Management: Patients, caregivers, and HCPs maintain full control over their communication preferences. Unsubscribe requests, consent withdrawals, and opt-out notifications are recorded immediately and strictly enforced across all internal databases and outreach systems.
- Administrative & Legal Compliance: Fulfilling contractual obligations with clients, preventing fraudulent survey responses, maintaining data security, and satisfying statutory requirements under federal and provincial laws.
4. Data Protection Principles & Governance
Our data processing activities adhere to strict operational safeguards:
- Lawfulness, Fairness, & Transparency: Data is processed lawfully and transparently. All research invitations include clear opt-out and unsubscribe mechanisms.
- Purpose Limitation: Personal data collected for specific client engagements (Client Project Data) is maintained separately from our Proprietary Research Databases.
- Pseudonymization: Direct identifiers (such as names or email addresses) are detached from responses and stored in isolated repositories accessible only to authorized personnel.
- Data Minimization: We collect only the minimum personal data necessary to validate study eligibility, complete research objectives, and process incentive payments.
5. Information Sharing, Sub-Processors, & Cross-Border Transfers
Your privacy is protected at all times. Your identity will remain 100% confidential and will never be shared with anyone including our research clients, your employer, your family, or your personal doctors and medical team, or any third party without your prior, explicit consent.
Participation in our market research studies is completely voluntary. Your participation will not affect your medical care, ongoing treatments, or relationship with your healthcare providers in any way.
MPI Research will never rent, sell, or trade your personal information to third parties.
Third-Party Software as a Service (SaaS) Sub-Processors
To execute our research operations, we only use evaluated third-party, enterprise-grade cloud platforms, such as Google Workspace. These sub-processors handle data on our behalf and are vetted to ensure they maintain industry-standard security certifications (such as SOC 2 Type II and ISO/IEC 27001), enterprise technical access controls, and binding data protection commitments integrated into their standard terms of service.
Cross-Border & Interprovincial Transfers
Because our approved sub-processor infrastructure utilizes cloud servers located within and outside of Canada, your personal information may be stored or processed outside your province or country of residence. All cross-border and interprovincial data transfers are safeguarded through encryption in transit (TLS 1.2 or higher) and at rest (AES-256), as well as robust contractual and technical protections to adhere to applicable Canadian privacy laws.
Client Deliverables
Clients receive anonymized or pseudonymized study deliverables. Raw personal identifiers are never shared with research sponsors unless explicit, affirmative consent is obtained from you.
Legal Disclosures
We may disclose personal data without consent only when required by law, court order, subpoena, or government regulation, or when necessary to protect legal rights, safety, or network security in accordance with applicable federal and provincial privacy statutes.
Client-Designated Platforms & Third-Party Tools
For certain engagements, such as joint research initiatives, research activities may be conducted on software platforms, survey engines, or web conferencing tools managed directly by our clients or study sponsors. In these instances, participants are notified prior to the session, and data collected within those client-hosted environments is governed by the applicable client’s privacy notice and platform terms.
6. Data Lifecycle, Retention, & Disposal
Personal data is retained only for as long as necessary to fulfill the specific operational, research, or legal purposes for which it was collected:
- Client Project Data: Research outputs (including survey responses, session recordings, and transcripts) are maintained entirely free of direct personally identifiable information, using unique participant IDs. Session recordings and temporary project files are deleted upon project completion, and pseudonymized analytical datasets are archived for a minimum of two (2) years before being permanently deleted during our annual data minimization review.
- Opted-In Patient Panel: Panel member profiles are maintained to invite participants to future research opportunities and undergo periodic review. Profiles and associated personal data are permanently deleted or anonymized upon receipt of an opt-out request, following delivery failures, or after an extended period of inactivity.
- Healthcare Professional Database: Professional contact records are maintained for as long as the clinician remains in active practice. Records are suppressed or marked inactive upon receipt of an unsubscribe request, notification of retirement or death, license revocation, or unresolvable delivery failure.
7. Data Security Safeguards
We implement a comprehensive suite of Technical and Organizational Measures to protect personal data against unauthorized access, disclosure, alteration, or destruction:
- Encryption Standards: All web traffic and data transmissions rely on TLS 1.2+ encryption in transit. Data stored across cloud repositories is encrypted at rest using enterprise-grade AES-256 algorithms.
- Access Control: System access is governed by the principle of least privilege using Role-Based Access Control (RBAC). Multi-Factor Authentication (MFA) is strictly enforced across all platforms and accounts without exception.
- Endpoint Protection: All authorized corporate devices utilize full-disk encryption, mandatory 10-minute inactivity screen locks, and automated software patching.
8. Your Privacy Rights (Data Subject Requests)
Under PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA, and applicable international laws, you hold specific rights regarding your personal data:
- Access & Rectification: You have the right to request access to the personal data we hold about you and request corrections to inaccurate or incomplete records.
- Consent Withdrawal / Deletion: You may withdraw your consent for research participation or panel membership at any time. Upon request, we will permanently delete or anonymize your personal records, subject to statutory retention requirements.
- Opt-Out & Preference Mechanisms: Initial automated recruitment emails feature a one-click unsubscribe link. Subsequent 1-to-1 email communications honor opt-out requests sent via direct reply (e.g., "unsubscribe" or "remove me"), which authorized personnel manually log and enforce across all internal databases upon receipt.
- Data Portability: You may request a copy of your personal data in a structured, commonly used electronic format.
- Automated Decision-Making: MPI Research uses automated screening tools to filter and screen individuals for research study participation based on study criteria. We do not use automated processing or AI to make decisions that affect your legal rights, employment, or financial standing.
To exercise any of these rights, please submit a written request to our Security & Data Protection Officer at privacy@mpiresearch.ca. We will review and fulfill your request within required statutory timelines (typically within 30 days of receipt).
9. Policy Updates
We review this Privacy Policy annually or following significant operational or legal updates. Any revisions will be published on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.
Last Updated: September 2026