Privacy Policy
How handles personal information on , and what you can ask us to do with yours.
Last updated .
1. Who this policy is from
This website is operated by , a registered charity in , , charity number . The office is at .
The Foundation is the organisation responsible for the personal information described here. Questions, requests and complaints about it go to the privacy officer at . The privacy officer is reachable by email.
This policy applies to and to the enquiries and account records that reach the Foundation through it. It does not apply to the raffle system that sells the tickets, which is covered in section 5, and it does not apply to the hospital, which is covered in section 3.
2. The law this policy follows
The Foundation applies the Personal Information Protection and Electronic Documents Act (), the federal privacy law that governs organisations in Ontario, together with the ten principles in its Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.
Two other statutes shape how this site behaves. Canada's Anti-Spam Legislation governs the commercial messages the Foundation may send you and is described in section 8. Ontario's Accessibility for Ontarians with Disabilities Act requires this site to meet a published accessibility standard, which affects the way consent choices are presented.
You may complain to the Office of the Privacy Commissioner of Canada, and, in matters that fall to the province, to the Information and Privacy Commissioner of Ontario. Section 12 explains how.
3. This is not a health service
Nothing on this site asks for a diagnosis, a treatment history, a health card number or any other health detail, and the Foundation asks you not to put such information into the contact form. If you send health information anyway, the Foundation will not add it to any record: it will answer your enquiry and then delete the message.
The Foundation raises money for equipment at . It has no access to patient records, no role in clinical care and no way to look anything up on a patient's behalf. Requests about hospital records belong with .
4. What is collected, and when
The Foundation collects the following through this website, and nothing else.
Contact form
Your name, email address, the subject you choose and the message you write. The form has no server behind it: it composes the message in your own mail application, so the details reach the Foundation as an ordinary email you send yourself. Nothing is stored on this site in the process.
Website account
If you create an account: first name, last name, email address, date of birth, Ontario postal code, language preference, a one-way derivation of your password, your consent record, and whatever you later choose to save — ticket numbers, reminder settings, a spending budget, donation records and the result of the self-assessment.
These account records are held in your own browser's local storage on the device you used. They are not transmitted to the Foundation and the Foundation cannot read them. Clearing your browser data removes them. The Foundation only learns something about your account if you write to it and tell it.
Cookies and analytics
Identifiers set by cookies and similar storage, plus the aggregate measurement described in the Cookie Policy. Nothing beyond the strictly necessary category runs before you choose. Section 7 covers this.
Server logs
The hosting provider records the usual technical details of a request — IP address, time, page requested, browser type — for security and to keep the site running. These logs are not combined with anything else and are not used to build a profile of you.
5. Information the Foundation does not hold
When you buy a ticket, the purchase happens inside the raffle system run by . That system takes your name, contact details and payment, issues the ticket number and sends you the confirmation. It does so under its own privacy policy and its own obligations as a gaming supplier registered with the .
No card number, expiry date or security code ever reaches this website. There is no cart here, no payment page and no ticket generation.
The Foundation receives from the raffle system what it needs to run the lottery under its licence: the record of tickets sold, and the winner's details when a prize has to be awarded. Those records are held by the Foundation offline, not on this website, for as long as the licence conditions require.
6. Why the information is used
Each purpose below is the only reason the matching information is collected.
- Answering you. Contact details from your enquiry, used to reply and to keep a record of what was asked and answered.
- Running your account. Profile details, used to sign you in, show your saved records and apply your language preference.
- Confirming eligibility. Date of birth and postal code, used to confirm you are at least and resident in before an account is created.
- Sending reminders you asked for. Email address, used only after you confirm it, and only for the reminders you switched on.
- Publishing a result. A winner's first initial, surname, city and winning ticket number, published because rule 21 of the Rules of Play requires it.
- Measuring the site. Aggregate analytics, used to see which pages people rely on, and only with your consent.
- Keeping the site safe. Server logs and the form's spam controls, used to prevent abuse.
The Foundation does not sell personal information, does not rent mailing lists, and does not share your details with other charities.
The legal basis
Under the basis is consent, and the form the consent takes depends on how sensitive the information is and what a reasonable person would expect. Sending an enquiry carries implied consent to a reply. Creating an account, switching on reminders and allowing analytics all require an express action from you: a tick, a toggle, a button. None of them is pre-selected.
Publishing a winner's name, city and ticket number is a condition of entry set out in the Rules of Play and required by the licence. Buying a ticket is acceptance of that condition.
7. Cookies and measurement
The Cookie Policy lists every category in use, with its purpose, the names of the identifiers, how long each lasts and who provides it. In summary: strictly necessary storage keeps the site working and cannot be switched off; preferences, analytics and marketing are all off until you turn them on.
Analytics runs through Google Analytics 4 with consent mode. Until you consent, the analytics and advertising signals are set to denied, no measurement script is requested, and no analytics identifier is written. Where no measurement property is configured, nothing is requested at all.
You can change your mind at any time using the cookie control in the footer of every page. Withdrawing consent stops future collection; it does not delete measurements already recorded in aggregate, which cannot be traced back to you.
8. Email, and how to stop it
Canada's Anti-Spam Legislation requires express consent before a commercial electronic message is sent, clear identification of the sender, and a working way to unsubscribe. The Foundation applies all three. The reminder consent is unticked by default. After you tick it, the address stays in a pending state until you confirm it, and nothing is sent in the meantime.
To stop receiving reminders, use the unsubscribe link in any email or turn them off under Draw reminders in your account. A single control turns every reminder off at once. Requests take effect immediately and in any event within ten business days, as the law allows.
Messages that answer something you asked, or that tell a winner they have won, are not marketing and are sent regardless of your reminder setting.
9. Who else sees it
The Foundation uses a small number of suppliers. Each is bound by contract to use the information only for the service it provides.
| Supplier type | What it handles | Where |
|---|---|---|
| Website hosting | Serving the pages and keeping server logs | Canada |
| Email delivery | Sending the reminders you switched on | Canada or the United States |
| Analytics | Aggregate page measurement, with consent | United States |
| Raffle system | Ticket sales, ticket numbering, payment, draws | Canada |
| Donation provider | Processing donations and issuing tax receipts | Canada |
The Foundation will also disclose personal information where the law requires it: to the in the course of its oversight of the licences, to the Canada Revenue Agency in relation to charitable receipting, or in response to a court order or lawful demand.
Information that leaves Canada
Some suppliers store or process information in the United States. While it is there it is subject to the laws of that country, and a court or public authority there may be able to require access to it. The Foundation limits what crosses the border to the analytics and email categories described above, and requires contractual protection comparable to what Canadian law provides. You can avoid the analytics transfer entirely by declining analytics cookies.
10. How long it is kept
| What is held | How long |
|---|---|
Account records held in your browser last until you delete the account or clear your browser data, whichever comes first. The Foundation has no copy of them and cannot restore them.
Once a retention period ends, records are deleted or anonymised. Winner records are the exception: the licence conditions require the Foundation to keep them, and the published entry on the Winners page stays up as the historical record of the draw.
11. Keeping it safe
The site is served over HTTPS with HTTP Strict Transport Security, and a content security policy restricts what the pages are permitted to load. Account passwords are never stored: what is kept is a one-way derivation produced with PBKDF2-SHA-256 over 210,000 iterations and a random salt unique to each account. The original password cannot be recovered from it, by the Foundation or by anyone else.
Forms carry spam controls that need no third-party script. Access to Foundation systems is limited to staff who need it. Suppliers are chosen partly on their security posture and are bound by contract.
No system is perfect. If a breach occurs that creates a real risk of significant harm, the Foundation will report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as requires.
12. Your rights
You may exercise any of the following. Write to and the Foundation will respond within thirty days.
- Access. Ask what personal information the Foundation holds about you, how it is used and who it has been disclosed to.
- Correction. Ask for anything inaccurate or incomplete to be fixed.
- Withdraw consent. Turn off reminders, decline cookies or ask the Foundation to stop a use you previously agreed to. Some consequences follow: withdrawing the age and residence confirmation, for example, means the account can no longer be held.
- Deletion. Delete your account from Privacy and data inside the account, or ask the Foundation to erase what it holds. Records the Foundation must keep under the licence conditions or tax law cannot be deleted before their period ends.
- Portability. Download everything held in your account as a single file, from the same screen.
- Complain. Raise a concern with the privacy officer first. If the answer does not satisfy you, take it to the Office of the Privacy Commissioner of Canada, or to the Information and Privacy Commissioner of Ontario for matters within provincial jurisdiction. Both accept complaints directly and neither charges a fee.
The Foundation may need to confirm who you are before acting on a request, which usually means replying from the address on the account.
13. Young people
The raffle is licensed for players aged and over. The account area is closed to anyone younger: the date of birth is checked when the account is created, and a date under is refused with nothing saved.
The Foundation does not knowingly collect personal information from anyone under . If you believe a young person has given information through this site, write to and it will be deleted.
Ticket buying is subject to the same limit under the Rules of Play: tickets may not be bought for, or in the name of, anyone under .
14. If you win
Rule 21 of the Rules of Play requires the winning ticket number, the winner's name and the winner's city of residence to be recorded and announced. Buying a ticket is agreement to that publication in the event the ticket wins. The Foundation publishes a first initial and surname rather than a full first name.
Nothing further is published. Your address, your email, your telephone number and the number of tickets you bought stay out of the public record. A winner who is asked for a photograph or a quotation may decline, and the prize is unaffected.
15. Changes to this policy
The Foundation updates this policy when what it does changes. The date at the top of the page shows when it last did. A change that materially affects how your information is used will be announced on the site before it takes effect, and where the change requires it, consent will be asked for again.
The Foundation keeps superseded versions and will send you the one that applied on a given date if you ask.
16. How to reach the privacy officer
General enquiries that are not about privacy go to .
Last updated .