Privacy Policy

1. Scope and Applicable Laws

HolistiCare handles information in accordance with the privacy and professional requirements that apply to the particular information, service, relationship and circumstances. These may include:

• Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”);
• Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), where applicable;
• Part X of Ontario’s Child, Youth and Family Services Act, 2017, where applicable;
• Ontario’s health-profession legislation and the standards of applicable regulatory colleges;
• Canada’s anti-spam legislation for applicable commercial electronic messages;
• tax, payroll, employment, occupational health and safety, accessibility and other legal recordkeeping requirements; and
• contractual privacy and confidentiality obligations that lawfully apply to a particular program or service.

The United States Health Insurance Portability and Accountability Act (“HIPAA”) is not generally the governing health privacy law for services provided in Ontario. HolistiCare does not represent that HIPAA applies to every service or system. If a specific cross-border relationship lawfully makes a HIPAA requirement applicable, that requirement will be addressed for that relationship.

2. Our Privacy Roles

Depending on the service and circumstances, HolistiCare may act as a health information custodian, an agent of a health information custodian, a service provider to a regulated professional, or an organization handling personal information outside PHIPA.

Regulated professionals working with or through HolistiCare—including Registered Behaviour Analysts and members of other Ontario regulatory colleges—remain responsible for complying with the legal, ethical and professional requirements applicable to their own practice.

Use of the BCBA or BCBA-D certification does not replace Ontario registration requirements. The title “Behaviour Analyst” is restricted in Ontario and is used only in accordance with applicable Ontario law and College requirements.

3. Information We Collect

We limit collection to information reasonably necessary for identified and legitimate purposes. The information collected depends on how a person interacts with HolistiCare.

Contact and identity information

• Name, email address, telephone number and preferred communication method;
• city, service location and contact details;
• parent, guardian, caregiver or authorized representative information; and
• identity or authority information where verification is reasonably necessary.

Service and personal health information

• Developmental, behavioural, educational, communication, functional or clinical information;
• assessment, treatment, behaviour-plan, progress, attendance and service records;
• relevant health history, diagnoses, risks, medications or safety information when reasonably necessary;
• records received from another provider with lawful authority or consent;
• caregiver goals, preferences, observations and communications; and
• consent, capacity, substitute decision-maker and disclosure instructions.

Program, billing and administrative information

• Scheduling, attendance, location, service authorization and cancellation information;
• billing, payment status, invoices, receipts and funding-related information;
• OAP or other program information where required and lawfully authorized;
• insurance or third-party payer information when applicable; and
• complaints, feedback, incident reports and quality-improvement information.

Recruitment and workforce information

• Contact details, résumé, cover letter, qualifications and work history;
• professional registration, certification, language skills and availability;
• work-authorization confirmation and preferred engagement arrangement;
• references and screening information when requested at an appropriate stage; and
• employment, contractor, payroll, tax and operational records for successful candidates.

Website and technical information

• IP address, browser, device type, operating system and approximate location;
• pages viewed, links used, referral source and interaction information;
• cookie identifiers, analytics information and security logs; and
• information voluntarily submitted through website forms.

Communications

We may maintain records of email, telephone, video, text or other communications. If a call or meeting is recorded, HolistiCare will provide notice and obtain consent where required before recording begins.

4. How We Collect Information

Information may be collected:

• directly from the individual or an authorized representative;
• through inquiries, intake, consultation, consent and application forms;
• during service delivery, assessment, supervision, scheduling or billing;
• from another provider, school, funding organization or authorized third party with consent or other lawful authority;
• from workers, contractors, references or professional regulators for legitimate recruitment and credential-verification purposes;
• automatically through website, analytics, security and cookie technologies; and
• as otherwise permitted or required by law.

5. How We Use Information

HolistiCare may use information to:

• respond to inquiries and determine whether services may be appropriate and available;
• schedule consultations, appointments, programs and service delivery;
• assess needs and develop, implement, supervise, monitor or coordinate authorized services;
• communicate with clients, capable individuals, authorized representatives and care-team members;
• maintain clinical, educational, operational, safety and quality records;
• process billing, payments, funding documentation, accounting and tax records;
• meet professional, regulatory, insurance, safeguarding and legal obligations;
• manage complaints, incidents, risks, privacy requests and security events;
• recruit, screen, onboard and administer employees and independent contractors;
• operate, secure, troubleshoot and improve our website and systems;
• understand general website use and evaluate communications; and
• carry out another purpose explained at or before collection, or otherwise authorized by law.

HolistiCare will not use personal information for an unrelated purpose without obtaining any consent required by law, unless the use is otherwise permitted or required by law.

6. Consent and Lawful Authority

Where consent is required, HolistiCare seeks consent that is knowledgeable, relates to the information and purpose involved, and is not obtained through deception or coercion. Consent may be express or implied depending on the sensitivity of the information, reasonable expectations and applicable law.

Some collections, uses or disclosures may occur without consent where permitted or required by law. Examples may include specific safety, child-protection, professional-reporting, legal-process, fraud-prevention or privacy-breach circumstances.

An individual may withdraw consent, subject to legal, professional, contractual and recordkeeping restrictions. Withdrawal does not invalidate lawful handling that occurred before withdrawal and may limit HolistiCare’s ability to provide or continue a requested service.

Submitting a general website form does not constitute consent to every possible future use. The purposes described in the form, this policy and any applicable consent or service documentation govern the information submitted.

7. Children, Youth, Capacity and Substitute Decision-Makers

HolistiCare serves children and youth, but privacy decision-making is not determined by age alone in every circumstance. Capacity is assessed according to the applicable law and the particular decision.

A capable individual may make decisions concerning their own information. Where an individual is not capable, consent and privacy decisions may be made by the legally authorized substitute decision-maker.

For individuals under 16, a parent or other legally authorized person may often act as substitute decision-maker. However, a capable young person’s decision may prevail in circumstances established by law, including certain treatment and counselling situations.

HolistiCare may verify custody, decision-making responsibility or other legal authority when reasonably necessary before granting access to, or disclosing, a child or youth’s information.

8. When Information May Be Disclosed

HolistiCare does not sell personal information or personal health information.

Information may be disclosed, only as reasonably necessary and with appropriate authority, to:

• regulated professionals, authorized workers, supervisors and team members involved in the applicable service;
• a capable individual’s authorized family member, representative or substitute decision-maker;
• another healthcare, educational or community provider with consent or other lawful authority;
• OAP, insurers, funding organizations or payers where required for an authorized service, claim or program;
• technology, payment, accounting, legal, insurance, storage or administrative providers supporting HolistiCare;
• professional colleges, government bodies, courts, law enforcement or other authorities where permitted or required by law;
• a children’s aid society or other authority where a legal reporting duty applies; and
• another organization involved in a proposed business transaction, subject to applicable confidentiality and legal safeguards.

HolistiCare seeks to disclose no more information than reasonably necessary for the authorized purpose.

9. Service Providers, Technology and Processing Locations

HolistiCare uses third-party providers for functions such as website hosting, forms, communications, scheduling, clinical administration, document management, accounting, payment processing, analytics, security and data backup.

Providers receive only the access reasonably required for their function and are expected to protect information through contractual, administrative and technical safeguards appropriate to the information involved.

Some providers may process or store information outside Ontario or Canada. Information handled in another jurisdiction may be subject to that jurisdiction’s lawful access requirements. HolistiCare evaluates sensitivity, necessity, safeguards and legal requirements when selecting and managing providers.

HolistiCare remains responsible for meeting its applicable privacy obligations when using third-party providers and does not rely solely on a provider’s general security representations.

10. Recruitment and Workforce Information

Application information is used to assess current or anticipated employment and independent-contractor opportunities, communicate with applicants, verify qualifications and administer recruitment.

Applicants should not include medical details, disability information, SINs, banking information, government identification or unrelated sensitive information in their initial application. Information required for accommodation is handled separately and shared only as reasonably necessary to arrange the accommodation.

HolistiCare currently uses human review and does not use artificial intelligence to screen, rank or select job applicants. If this practice materially changes, this policy and the relevant recruitment notices will be updated before the change is implemented.

Applications for a specific opportunity are retained for a reasonable recruitment and legal-administration period. Where an applicant separately agrees to future consideration, application information may be retained for up to 12 months unless consent is withdrawn earlier, subject to applicable legal requirements.

For successful applicants, information may become part of the applicable employment or contractor record and may be retained for payroll, tax, credentialing, insurance, safety, operational and legal purposes.

11. Website Analytics and Cookies

Our website may use essential cookies and similar technologies required for security, navigation, forms and website functionality.

We also use Google Analytics to understand general website use. Analytics information may include IP-derived information, device and browser information, cookie or device identifiers, referral information, pages viewed and interaction events. Although settings may reduce identifiability, analytics information should not be assumed to be completely anonymous.

Browser controls may allow users to block or delete cookies. Blocking essential technologies may affect website functionality. Where legally required, HolistiCare will request consent before activating non-essential cookies or similar tracking technologies.

For more information about Google’s data practices, review Google’s Privacy Policy.

12. Electronic Communications

HolistiCare may send service-related communications necessary to respond to requests, administer services, provide safety or operational information, or manage an existing relationship.

Marketing or promotional electronic messages are sent in accordance with applicable consent and identification requirements. Where required, messages will include an unsubscribe mechanism. A request to stop marketing messages does not prevent necessary transactional, clinical, safety, billing or legal communications.

13. Security Safeguards

HolistiCare uses administrative, technical and physical safeguards appropriate to the sensitivity, volume, format and location of the information. Measures may include:

• role-based and need-to-know access controls;
• unique user accounts, strong authentication and password controls;
• encryption in transit and, where appropriate, at rest;
• secure configuration, updates, backups, logging and monitoring;
• privacy, confidentiality and security training;
• confidentiality and service-provider requirements;
• secure office, device, paper-record and disposal practices;
• incident-response and business-continuity procedures; and
• periodic review of privacy and security risks.

No website, email, storage or transmission method can be guaranteed completely secure. Individuals should avoid sending sensitive clinical records through ordinary email unless specifically instructed to use an approved method.

14. Privacy and Security Incidents

HolistiCare maintains procedures to identify, contain, investigate, document and respond to suspected loss, theft, unauthorized access, collection, use, disclosure, copying, modification or disposal of information.

Response measures may include:

• containing the incident and preserving relevant evidence;
• assessing the information involved, affected individuals and risk of harm;
• changing credentials, correcting controls and recovering information;
• notifying affected individuals where required;
• reporting to the Information and Privacy Commissioner of Ontario, the Office of the Privacy Commissioner of Canada, a professional regulator or another authority where required; and
• maintaining breach records for the period required by applicable law.

Notification timing and content depend on the governing law and circumstances. PHIPA and PIPEDA have different reporting thresholds and requirements.

15. Retention and Secure Disposal

HolistiCare retains information only for as long as reasonably necessary for the identified purposes and any applicable legal, professional, regulatory, insurance, contractual, tax or limitation-period requirements.

There is no single retention period for every HolistiCare record. Retention depends on the type of record and the professional or legal context.

• Clinical and personal health records: retained according to PHIPA and the requirements applicable to the relevant custodian and regulated professional, including any rules concerning minors.
• Behaviour-analysis records: retained according to applicable Ontario law and CPBAO professional requirements.
• Other regulated-professional records: retained according to the requirements of the applicable Ontario regulatory college.
• Recruitment records: retained for a reasonable recruitment and legal-administration period; future-opportunity applications may be retained for up to 12 months where the applicant has agreed.
• Tax, accounting, payroll and business records: generally retained for at least six years from the end of the relevant tax year, or longer where required by the Canada Revenue Agency or another law.
• Website, inquiry and security records: retained according to operational necessity, sensitivity, consent, security needs and applicable limitation periods.
• Privacy-breach records: retained for the period required by the applicable privacy law.

When retention is no longer required, records are securely destroyed, deleted or de-identified using methods appropriate to their format and sensitivity. Information may remain temporarily in protected backups until the applicable backup cycle expires.

16. Access, Correction and Privacy Choices

Subject to applicable law, individuals may request:

• access to personal information or personal health information about them;
• correction of incomplete or inaccurate information;
• information about how their information has been used or disclosed;
• withdrawal of consent for future handling, where consent is the legal basis;
• restriction of certain uses or disclosures where supported by applicable law; or
• information about HolistiCare’s privacy practices and service providers.

HolistiCare may need to verify identity and legal authority before responding. Access may be limited where permitted or required by law, including where a record contains another person’s information, is protected by legal privilege, or disclosure could create a serious risk recognized by law.

HolistiCare will respond within the period required by the applicable law. A reasonable fee may apply where legally permitted, with advance notice where required.

A deletion request does not override clinical, professional, tax, legal or other mandatory retention requirements.

17. Questions, Requests and Complaints

Privacy questions, access or correction requests, consent withdrawals and complaints should first be directed to HolistiCare’s Privacy Officer.

Please write “Privacy Request” in the email subject line and do not include detailed personal health information in the initial email.

If a concern is not resolved, an individual may contact the appropriate oversight body:

• Information and Privacy Commissioner of Ontario for matters within PHIPA or other Ontario privacy jurisdiction;
• Office of the Privacy Commissioner of Canada for matters within PIPEDA; or
• the applicable Ontario regulatory college regarding the professional conduct or records of a regulated professional, including the College of Psychologists and Behaviour Analysts of Ontario where applicable.

Accessibility

HolistiCare will provide this policy in an accessible format upon request. Contact the Privacy Officer using the information above.

18. Changes to This Policy

HolistiCare may update this policy when its services, systems, legal obligations or privacy practices change. The effective date displayed at the top identifies the current version. Where a material new collection, use or disclosure requires consent, HolistiCare will obtain the consent required by applicable law.

Previous version: June 4, 2026. Current version effective August 24, 2026.