Privacy Policy

Effective Date: May 15, 2026

Open Haven Counselling and Therapy is committed to protecting the privacy, confidentiality, and security of your personal information and Personal Health Information (PHI). This policy outlines how information is collected, used, disclosed, stored, and protected in accordance with Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), Personal Information Protection and Electronic Documents Act (PIPEDA), and the professional standards of the College of Registered Psychotherapists of Ontario (CRPO).

1. Our Role As A Health Information Custodian

Open Haven Counselling and Therapy acts as a Health Information Custodian (HIC) under PHIPA. We are legally responsible for the protection and proper handling of your personal health information.

All clinicians, employees, and independent contractors comply with:

• PHIPA and applicable privacy legislation
• CRPO Standards of Practice
• Ethical obligations regarding confidentiality and client dignity

2. What Is Personal Health Information (PHI)?

Personal Health Information includes identifying information about you that relates to your physical or mental health or the provision of health care services.

This may include:

• Identifying information (name, date of birth, address, contact details)
• Clinical records (intake forms, assessments, treatment plans, session notes)
• Health history and presenting concerns
• Billing and insurance information
• Appointment history and communications related to care

PHI also includes any information that could reasonably identify you as a client.

3. How We Collect Information

We collect information in the following ways:

Directly from you:

• Intake and consent forms
• Verbal communication during sessions
• Email, phone, or secure messaging platforms

Indirectly (with consent):

• From other health professionals or individuals involved in your care

Through our website:

• Contact form submissions (name, email, phone)
• Non-identifying technical data (IP address, browser type, cookies)

We do not collect clinical information through our public website.

4. Consent

Your consent is required for the collection, use, and disclosure of your PHI, except where permitted or required by law.

• Implied consent applies for purposes directly related to providing care
• Express consent is required for disclosures outside the circle of care

You may withdraw consent at any time, subject to legal and professional limitations. Withdrawal of consent may affect our ability to provide services.

5. How We Use Your Information

Your information is used only as necessary to:

• Provide psychotherapy services
• Develop and maintain treatment plans
• Communicate about appointments and care
• Process billing and insurance claims
• Maintain accurate clinical records
• Comply with legal and regulatory requirements

We do not use personal health information for advertising or marketing.

6. Disclosure Of Information

Your information may be disclosed:

• Within the circle of care (other healthcare providers involved in your treatment)
• To third-party service providers (e.g., secure electronic record platforms) under strict confidentiality agreements
• When required or permitted by law, including:
  • Risk of serious harm to self or others
  • Suspected abuse or neglect (duty to report)
  • Court orders, subpoenas, or legal proceedings
  • Regulatory requirements (e.g., CRPO investigations)

We do not sell or share your information for commercial purposes.

7. Limits Of Confidentiality

Confidentiality is a cornerstone of therapy but is not absolute. Information may be disclosed without consent where legally required, including:

• Risk of serious bodily harm to yourself or others
• Child protection concerns
• Legal proceedings
• Professional regulatory requirements

These limits are also reviewed as part of the informed consent process.

8. Safeguards And Security

We implement reasonable administrative, technical, and physical safeguards, including:

• Secure electronic record systems with encryption
• Access controls based on role and necessity
• Confidentiality agreements for all staff and contractors
• Secure storage and disposal of records

We use secure electronic systems (e.g., practice management or record-keeping platforms) that meet Canadian privacy standards.

In the event of a privacy breach, we will:

• Contain and assess the situation
• Notify affected individuals where required
• Report to the Information and Privacy Commissioner of Ontario (IPC), if applicable

9. Retention Of Records

In accordance with CRPO standards:

• Adult client records are retained for at least 10 years from the date of last contact
• Records of minors are retained for 10 years after the client reaches age 18

After this period, records are securely destroyed.

10. Your Rights

You have the right to:

• Access your personal health information
• Request corrections to your records
• Withdraw or limit consent (where applicable)
• Receive information about how your data is handled

Requests must be submitted in writing. You may be required to verify your identity before accessing records.

We will respond to requests within applicable legal timelines (typically within 30 days).

11. Website Cookies And Analytics

Our website may use cookies to improve user experience and understand general usage patterns. This data is non-identifying and not linked to clinical records.

You may disable cookies through your browser settings.

12. Third-Party Services

We may use secure third-party platforms (e.g., booking or record systems). These providers are contractually required to meet privacy and security standards consistent with PHIPA.

13. Security & Bot Protection

To ensure the security of our website and protect our forms from automated abuse, we utilize Google reCAPTCHA. We act as the Data Controller for the technical data collected by this service (such as IP addresses), which is processed by our service providers strictly for security purposes and not for advertising. For more information, you may review the Cloud Data Processing Addendum.

14. Changes To This Policy

This policy may be updated periodically to reflect changes in legal or professional requirements. The most current version will always be available on our website.

15. Contact Information

Privacy Officer / Contact Person
Nathalie Girgis, Registered Psychotherapist
(343) 655-3685
nathalieg.psychotherapy@gmail.com

If your concern is not resolved, you may contact:

Information and Privacy Commissioner of Ontario (IPC)
1-800-387-0073
www.ipc.on.ca

This policy meets Ontario legal requirements and CRPO professional standards as of 2026 and is suitable for website publication.