Understandable you don't want to go to the press, but I and other Canadian HNers would love to see the exchange you had with our privacy office. Between that and the ArriveCAN contract, I think the people deserve some concrete answers behind some of the decisions our federal government made.
It wasn't federal, they just provided air cover. All the covid stuff was done at the municipal public health level, co-ordinated through provinical public health and "science tables" using the WHO's Covax system on the back end, run by one of the big-5 consulting firms and delivered over a well known CRM platform.
The one thing you can see about covid policy was that every single decision was deniable to where no individual holds responsibility or accountability for it. It's by design, where everyone was using "recommendations" and acting on them with a tacit alignment to narrative, it was a modern version of just following orders. The effort and panic to avoid being held individually accountable for any decision is what characterized the whole response.
If you are concerned, do an access to information (canadian "FOIA") request for the privacy impact assessments that every initiative related to health information is legally obligated to do and provide, and keep track of what initiatives didn't have one done. Have a look at the regs changes to privacy legislation that were "temporary" for emergency use as well. The whole debacle was an orchestrated end run around privacy laws and other conventions around the use of health information and services as a political tool.
