Privacy and Confidentiality Policy

1. Scope and Applicable Requirements

HolistiCare Inc. (“HolistiCare,” “we,” “us” or “our”) respects the privacy of clients, families, caregivers, applicants, personnel, independent practitioners and website visitors.

This Policy applies to information handled through our website, inquiries, intake, services, programs, recruitment, personnel administration and therapy-room rental administration.

Applicable requirements depend on the information, activity and relationship involved. They may include Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”); Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”); applicable provisions of Ontario’s Child, Youth and Family Services Act, 2017; professional College requirements; and relevant employment, accessibility, tax and electronic-marketing laws.

This Policy does not assert that every HolistiCare activity or employment record is governed by the same privacy law. “Personal information” and “personal health information” have their applicable statutory meanings. Initials, codes or removal of a name do not necessarily make information anonymous.

This Policy explains information practices. Reading it, acknowledging it or using our website does not replace consent required for treatment, disclosure, recording, marketing or another particular purpose.

2. Responsibility for Records

Our Privacy Officer coordinates privacy inquiries, requests and complaints with the responsible record holder or health information custodian.

Before clinical services begin, HolistiCare identifies in the client’s service documentation the health information custodian responsible for the clinical record, the responsible professional, and the contact through whom access, correction and privacy requests may be made. Where HolistiCare acts on behalf of another custodian, its role and the custodian’s identity are explained.

These responsibilities depend on the actual lawful service arrangement. A professional’s status as an employee or independent contractor does not, by itself, determine custody or control of a record. Regulated professionals retain their own legal and professional duties.

Clients may ask who controls their record and how it will remain accessible if a professional leaves, services end or operations change. Any transfer or change in record responsibility must comply with applicable law and required notice or consent.

Independent room renters

A practitioner independently renting a HolistiCare room is responsible for their own services, consents, records and privacy practices unless an expressly established lawful arrangement provides otherwise. Rental alone does not make the practitioner a HolistiCare clinician or their clients HolistiCare clients. HolistiCare handles information necessary to administer the rental.

3. Information Collected

Depending on the interaction, information may include:

• identity, contact details, preferred language and communication preferences;
• relevant age, developmental, behavioural, educational, health and accessibility information;
• assessments, goals, service plans, session data, supervision, progress and attendance records;
• consents, capacity-related information, authorized contacts, pickup permissions and relevant authority documents;
• allergies, safety risks, emergency instructions and incident information relevant to services;
• scheduling, invoices, payment status, accepted payment authorizations and authorized funding documentation;
• applications, qualifications, references, registration, screening and personnel records;
• practitioner details, room bookings, access and rental-payment records;
• device, browser, website interaction, cookie and security-log information; and
• feedback, complaints and investigation correspondence.

Collection must be proportionate to an identified, legitimate purpose. We do not require unrelated sensitive information merely because it might be useful later.

4. Sources and Collection Limits

Information may come directly from the individual or an authorized representative, arise during services, or be received from another provider, school, reference, regulator or funding organization with valid consent or other lawful authority.

Technical information may be collected automatically through website and security technologies. Relevant collection purposes are explained through this Policy, the applicable form, service documentation or a specific notice.

Personnel must not access information out of curiosity or collect information unrelated to their assigned duties. Information obtained from a third party must have an appropriate purpose and lawful basis.

5. Purposes of Use

Subject to applicable consent and lawful authority, information is used to:

• respond to inquiries and assess service suitability;
• arrange, deliver, supervise, review and coordinate authorized services;
• maintain clinical, educational, safety and administrative records;
• verify identity and decision-making authority;
• manage scheduling, billing, payments and authorized funding processes;
• administer recruitment, personnel, placements and room rentals;
• respond to accommodation requests, complaints and privacy requests;
• conduct lawfully authorized quality assurance and risk management;
• operate and protect our website and approved systems; and
• meet applicable legal and professional obligations.

An unrelated purpose requires the consent or other authority required by law. Identifiable information is not used for external research, teaching or publication without the required authority and approvals. HolistiCare does not sell personal information or personal health information.

6. Consent, Restrictions and Withdrawal

Where consent is required, it must be knowledgeable or informed as required by law, voluntary, related to the information and purpose, and free from deception or coercion. Express consent is obtained when required. Implied consent is relied upon only where lawful and appropriate.

An inquiry permits a response to that inquiry and related lawful handling. It does not provide unrestricted consent to treatment, external sharing, recording, promotional use or future unrelated activities.

You may request lawful limits concerning particular information, recipients, purposes or periods. Restrictions on personal health information are sometimes described as “lock-box” restrictions. We explain material implications and implement restrictions as required by law. They do not prevent a disclosure legally permitted or required without consent.

You may communicate withdrawal verbally or in writing to the Privacy Officer. We document the instruction, verify identity or authority where necessary, and inform relevant personnel. Written notice helps accuracy but is not the only accepted method where another form is legally recognized.

Withdrawal applies prospectively. It does not undo lawful handling already completed, remove mandatory retention duties or cancel a separate agreement by itself. If a restriction materially affects services, we explain the consequences and consider reasonable alternatives without retaliation or coercion.

7. Children and Decision-Making Authority

Capacity is decision-specific. Age, diagnosis, disability, communication style or disagreement alone does not establish incapacity. Under PHIPA, capacity concerns understanding the information relevant to the proposed handling and appreciating the reasonably foreseeable consequences of giving, withholding or withdrawing consent.

A capable individual makes the decisions the law permits them to make. For an incapable individual, the appropriate legally authorized substitute decision-maker acts within their authority.

Special PHIPA rules apply to children under 16, including exceptions concerning treatment the child decided upon and certain independently obtained counselling. Where the law gives a capable child a decision and that decision conflicts with an eligible representative’s decision, the child’s decision prevails as required by law.

A parent, caregiver, payer, emergency contact or pickup person is not automatically entitled to every record or decision. We may verify identity, current authority and relevant court restrictions. An affected disclosure may be paused while material uncertainty is resolved. HolistiCare does not determine family-law disputes.

8. Sharing and Legal Reporting

Information is shared only for an authorized purpose and to the extent reasonably necessary, subject to applicable law. Recipients may include authorized service personnel, a lawful representative, another provider or school, an authorized funder or insurer, necessary service providers, professional advisers, or an authority entitled to receive it.

Where a Release of Information is used, it identifies the parties, information, purpose, restrictions and expiry or ending event. Consent to one disclosure does not authorize unrestricted sharing. Billing responsibility alone does not authorize access to clinical notes.

Disclosure without consent may be required or permitted for child protection, specified serious safety risks, legal proceedings, regulatory obligations or privacy-breach reporting. A request from a family member, police officer, insurer or funder does not automatically establish authority.

Group participants are asked to protect one another’s privacy and refrain from unauthorized recording or sharing. HolistiCare remains responsible for information within its control but cannot guarantee another participant’s conduct.

9. Technology and Service Providers

Service providers may support communications, document signing, scheduling, clinical administration, storage, hosting, accounting, payments, analytics and security.

Provider access must be limited to the necessary function and supported by safeguards appropriate to the information and applicable requirements. Outsourcing does not remove responsibilities HolistiCare retains under law.

Some providers may store, process or permit access to information outside Ontario or Canada. Applicable foreign laws may permit access by courts or authorities. Ask the Privacy Officer about the providers, processing locations and arrangements relevant to your information.

Payment information should be provided through the approved payment process. Selecting a preferred payment method does not authorize a pre-authorized debit or card charge.

10. Photographs, Recordings and Security Surveillance

Clinical photographs, recordings and promotional media

Photographs and recordings require an identified purpose, appropriate legal authority, safeguards and retention arrangements. Clinical documentation, supervision, training, promotional publication and security surveillance are distinct purposes. Authority for one purpose does not automatically authorize another.

Optional promotional consent is separate from necessary service consent. Declining promotional consent does not, by itself, affect access to services. Optional consent may be withdrawn prospectively, subject to practical limits concerning material already lawfully distributed and records that must legally be retained.

Recording a session, meeting, screen or another person must be discussed in advance and comply with applicable consent, privacy, accessibility and professional requirements. Personnel must not retain personal copies or use unapproved personal accounts.

Security cameras at the HolistiCare centre

HolistiCare operates security cameras at its centre on a continuous, 24-hour basis, including outside operating hours. Signs notify people of surveillance in camera-covered areas. The purpose is to protect people and property, deter unauthorized activity and assist in investigating security or safety incidents.

Camera placement, coverage and recording must be limited to what is reasonably necessary for the identified security purposes. Cameras must not be installed in washrooms or changing areas. Recording in areas where clinical services occur requires a separate assessment of necessity, privacy implications and applicable legal authority. Security signage does not, by itself, authorize clinical recording or audio recording.

Access to security footage is restricted to authorized persons with a legitimate need. Footage must be safeguarded and must not be used for promotional publication, routine clinical assessment or unrelated purposes without the required separate authority.

Security footage is retained only for a defined period reasonably necessary for its security purpose, unless an incident, access request, investigation or legal obligation requires preservation. Disclosure to police, insurers or other parties requires consent or another applicable lawful authority; a request alone does not automatically authorize release.

For information about camera-covered areas, recording practices, retention or access to footage concerning you, contact HolistiCare’s Privacy Officer at info@holisticare.ca or (343) 322-2077. Access requests are subject to applicable law, including protection of other individuals’ information.

Cameras at homes and other service locations

Services may take place in a client’s home, public setting, school, community facility or temporarily rented premises where cameras are operated by a homeowner, landlord, facility operator or another third party. Where HolistiCare does not operate or control those cameras, their collection, storage, access and disclosure practices are the responsibility of the operator and are governed by applicable law and that operator’s policies.

Clients and host premises are asked to disclose known cameras, audio recording or other recording arrangements affecting the service area before services begin. HolistiCare considers known recording arrangements when assessing privacy, consent and the suitability of the service setting. Where necessary, an alternative location or other reasonable safeguard may be discussed.

This distinction does not waive anyone’s privacy rights or remove HolistiCare’s obligations concerning its own service delivery, personnel, or footage it requests, receives, accesses or controls. A camera operated for HolistiCare by a service provider is not excluded from HolistiCare’s responsibilities merely because another organization operates the equipment.

11. Artificial Intelligence and Automated Tools

Identifiable client information must not be entered into an unapproved public generative-AI service or supplied for public model training.

Proposed transcription, documentation, translation, scoring or other automated tools require assessment of their purpose, data handling, safeguards, limitations and consent requirements before use.

Material technology use and relevant privacy risks are explained where required, and necessary consent is obtained. Regulated professionals remain responsible for professional judgment and review of work issued in their names. Automated output does not replace qualified assessment or supervision.

12. Recruitment and Personnel

Application information is used to assess an opportunity, communicate with applicants and verify relevant qualifications. Initial applications should not contain unnecessary medical information, SINs, banking information or identity documents.

Accommodation information is shared only as reasonably necessary. References and role-appropriate screening require the applicable consent or authority. HolistiCare uses human review and does not use AI to screen, rank or select applicants.

Application-retention periods are determined by recruitment needs and applicable legal recordkeeping obligations. Where an applicant separately agrees to future consideration, information may be retained for up to 12 months, subject to withdrawal and any longer mandatory period. Successful applicants’ information may become part of the relevant personnel record.

Personnel records are subject to the requirements applicable to the actual relationship. This Policy does not assert that PIPEDA governs every Ontario employment record.

13. Cookies and Analytics

The website uses Google Analytics to understand website activity and may use cookies or similar technologies for functionality, analytics and security.

Analytics information can include device or cookie identifiers, browser and device characteristics, referral sources, pages viewed, interaction events and approximate location derived from technical information. This can reveal an interest in particular services. Reduced identifiability does not necessarily make the information anonymous.

Google processes analytics information through its systems. Information about its practices is available in Google’s Privacy Policy.

Clinical form contents, diagnoses, identifiable treatment details and sensitive information in URLs or event labels must not be transmitted to analytics or advertising systems without a lawful basis and required consent. Accidental transmission is also a privacy concern and must be assessed.

Where consent is required for non-essential tracking, it must be obtained before that tracking occurs. Continued browsing or acknowledgement of this Policy is not a substitute for consent where the law requires a specific choice.

You can block or delete cookies through browser settings and ask the Privacy Officer about the tracking configuration and available choices. Some features may function differently. Deleting cookies does not necessarily stop every form of technical processing. You may contact HolistiCare by telephone instead of submitting a website form.

External websites operate under their own privacy notices. A link does not give HolistiCare control over their information practices.

14. Communications and Marketing

Authorized service communications may concern inquiries, appointments, care coordination, documents, billing and safety. Detailed clinical information should be exchanged through an approved secure method.

Ordinary email, SMS and voicemail can be delayed, misdirected or accessed by others. We limit message contents and use authorized contact methods. Please advise us if an account or communication method is not private. Group messages must not unnecessarily disclose recipients’ identities or addresses.

Commercial promotional messages are subject to applicable consent, identification and unsubscribe requirements. Marketing consent may be withdrawn using the unsubscribe method or by contacting us. This does not prevent necessary lawful service, transactional, safety or legal communications.

15. Safeguards and Confidentiality

HolistiCare is responsible for safeguards appropriate to the sensitivity, volume, format and location of information and the applicable legal and professional requirements. Relevant measures include restricted access, secure accounts and storage, appropriate encryption, confidentiality obligations, personnel training, secure disposal and incident response.

Authorized personnel must use information only for assigned lawful purposes, follow approved systems, maintain confidentiality and report suspected incidents promptly. Confidentiality continues after an engagement ends. Record handover and removal or adjustment of access must be managed securely.

Paper records must be protected from public view and transported and stored securely. Identifiable clinical conversations must be kept private. Client records must not be forwarded to personal email, stored in unapproved personal accounts or retained as private copies.

Electronic clinical records must meet applicable encryption and transmission requirements. No system guarantees absolute security; this does not excuse a failure to meet required safeguards.

16. Privacy Incidents

Suspected loss, theft or unauthorized handling is assessed, contained, investigated and documented. Relevant evidence is preserved, risks are evaluated and corrective action is taken. Mandatory notification is not delayed until an investigation is complete.

Where PHIPA applies, affected individuals are notified at the first reasonable opportunity as required, including notice of their right to complain to Ontario’s Information and Privacy Commissioner. Incidents meeting prescribed reporting criteria are reported to that Commissioner. Applicable College reporting and annual breach-statistics requirements are assessed separately.

Where PIPEDA applies, a breach creating a real risk of significant harm is reported to the federal Privacy Commissioner and affected individuals are notified as soon as feasible, subject to law. Relevant factors include sensitivity and the probability of misuse. Required records of safeguards breaches are retained for at least 24 months after determining that the breach occurred, and longer where required.

Required notices explain the incident, protective measures and appropriate contact information. Reviews inform corrective action and prevention.

17. Retention and Disposal

Retention depends on the record’s purpose and applicable legal and professional requirements. There is no single period for every record.

• Individual ABA service records governed by CPBAO: at least ten years after the client reaches age 18 or after the last professional contact, whichever is later. Related fee and billing records follow the applicable professional rule.
• Other regulated clinical records: the responsible College and custodian requirements, including applicable rules for minors.
• Tax and business records: generally at least six years after the relevant tax year, with longer periods where required. This does not shorten a clinical-record obligation.
• Applications, personnel, inquiries and technical records: periods determined by their purposes, statutory obligations and justified dispute or security needs.
• Incidents and recordings: applicable privacy, clinical or program requirements. Material forming part of a client record follows the relevant clinical retention rule.

Information subject to a complaint, investigation, audit or legal hold is preserved as required. You may ask about the retention period or criteria applicable to your information.

When retention is no longer required, information is securely destroyed, deleted or effectively de-identified. Protected backups may persist until their applicable deletion cycle expires. Ending services or withdrawing consent does not require destruction of a mandatory record.

18. Access and Correction

You may request access, correction of inaccurate or incomplete information, an explanation of handling, or assistance with an applicable consent restriction. Identity and authority may be verified proportionately before release.

For written PHIPA access or correction requests, the responsible custodian generally responds within 30 calendar days, subject to lawful extensions and required notice. Requests governed by another law follow that law’s requirements. Any permitted access fee is disclosed as required.

Access is subject to statutory exceptions, including applicable privilege, third-party privacy and specified serious-harm circumstances. Reasons and complaint rights are provided where required. Records are not withheld solely because an account is unpaid where the individual has a legal entitlement to access.

Correction does not create a right to rewrite a professional opinion or observation made in good faith. Other statutory exceptions may apply. Where applicable, a statement of disagreement may be attached to the record and statutory complaint rights exercised.

Deletion or anonymization requests are assessed under applicable law. They do not create an unconditional right to erase required clinical, financial or investigation records.

19. Contact and Complaints

For privacy questions, access or correction requests, consent restrictions or suspected incidents, contact:

Use “Privacy Request” in the subject line and avoid detailed health information in the initial email. We can arrange an appropriate follow-up. An accessible format or explanation is available on request.

Complaints are reviewed fairly and without retaliation. Confidentiality is maintained as reasonably possible while allowing necessary investigation, procedural fairness and legally required disclosure. A complaint about the usual reviewer is referred to an appropriate unimplicated person or independent review route.

You may contact an external authority without first completing our internal process:

• Information and Privacy Commissioner of Ontario for matters within its jurisdiction;
• Office of the Privacy Commissioner of Canada for PIPEDA matters; or
• the responsible professional College, including CPBAO, COTO or CASLPO, where applicable.

20. Updates and Interpretation

This Policy may be updated to reflect changes in practices, services or legal requirements. Material changes are communicated as required, and fresh consent is obtained where necessary.

An update does not retrospectively change accrued rights, amend a signed agreement by itself or supply consent required for a new purpose. Previous editions may remain relevant to earlier handling. Applicable law prevails over inconsistent wording. Nothing in this Policy excludes a legal duty, remedy or liability that cannot lawfully be excluded.