We may collect the following types of information:

• Personal Information: Name, address, phone number, email, date of birth, and other personally identifiable information.

• Health Information: Information related to your mental health history, diagnosis/es, counselling/psychotherapy goals, support persons, details related to informing your collaboration, and other health-related data.

• Payment Information: Billing information and payment methods (processed through our payment provider Stripe) for services rendered.

• Communication Information: Correspondence through email, phone, encrypted client-portal chat or other forms of communication.

• Session and Scheduling Information: Appointment details, emails, call logs, and voicemail recordings associated with our phone service or Google Mail.

• Website cookies: Small pieces of data our website may store on your device to remember preferences and understand feature use. You can manage these preferences, and can learn more via our website host's privacy information by visiting this link.

We operate on an ‘ask only what is needed’ basis and include optional fields when possible.

To provide and administer your care, we use the following third-party services. Each has been selected based on its security practices, and we maintain agreements or terms of service with each provider governing their handling of your information:

• Practice Better — our secure client portal, used for client files, clinical notes, scheduling, encrypted messaging/chat, and virtual appointment hosting.

• Telzio — our phone system, used for calls and voicemail. Call logs and voicemails may be retained as part of your record.

• Google Workspace (Gmail) — used for email correspondence. Please note that standard email is not fully end-to-end encrypted; we ask that you avoid sending highly sensitive clinical details by email and use our secure client portal messaging instead wherever possible.

• Zoom — an optional video-conferencing option offered as an alternative to our primary virtual platform. Use of Zoom is your choice; you may request to use our standard secure video option instead at any time. We have signed a Business Associate Agreement (BAA) with Zoom to enable compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Health Information Protection Act (PHIPA) in Canada. You can learn more by clicking this link here.

• Stripe — our payment processor, used to handle credit card transactions. We do not store your full card number; Stripe is PCI-DSS compliant and handles payment data under its own security standards.

Some of these providers may store or process information on servers located outside of Canada, including in the United States. Where this is the case, we have taken reasonable steps to confirm these providers offer a level of protection for your information that is equivalent to the protection required under Canadian and Quebec privacy law before using them, as required for our Quebec clients under Law 25.

We use your personal and health information for the following purposes:

• Provision of Services: To inform your service related needs, recommend tailored approaches and provide therapy services, including evaluation, assessment and collaboration on a service plan.

• Billing and Payments: To process payments and ensure accurate billing for services.

• Compliance with Legal Obligations: To meet the legal requirements of PHIPA, PIPEDA, Quebec's Law 25, the Health Care Consent Act, and the requirements of our regulatory college.

• Communication: To inform you about appointments, billing, service resources, and updates related to your services.

Your personal and health information may be shared in the following instances:

• With Your Consent: We will disclose your information with your explicit consent, except where required by law.

• Healthcare Providers: We may share information with other healthcare professionals involved in your care (e.g., psychiatrists, family doctors or other mental health practitioners) if/when you request it for continuity of care.

• Service Providers: With the third-party platforms named in Section 2, solely as needed to deliver and administer our services to you.

• Legal and Regulatory Authorities: In compliance with legal or regulatory requirements, including mandatory reporting laws (e.g., child or vulnerable person protection, risk of harm to self or others). We do not have a duty to notify you if or when we are complying with the law.

We do not share, sell, or rent your information for marketing purposes.

We take your privacy and the security of your information seriously. Measures we use to safeguard your information include:

• Encryption: Personal and health information is encrypted in transit and at rest wherever supported by our platforms. Clinical records and client files are secured in Practice Better; client-portal messaging is encrypted

• Access Control: Access to personal and health information is restricted to the practice team on a need-to-know basis. Recording keeping is used when exporting/exchanging data.

• System security updates: Devices used to operate practice receive regular security updates per manufacturer requirements.

• Vendor Due Diligence: We periodically review the privacy and security practices of the third-party services listed in Section 2.

While we strive to ensure the highest level of security, no method of storage or transmission is 100% secure. We remain committed to continually improving our practices to protect your information.

Under the Personal Health Information Protection Act (PHIPA), if you are receiving services in Ontario, you have the right to:

• Access: your health records, subject to certain exceptions under PHIPA.

• Correction: of information you believe is inaccurate in your health record.

• Consent: to withdraw or modify your consent for the collection, use and disclosure of your personal health information.

• Complaint: to file a complaint with Ontario's Information and Privacy Commissioner if you believe your rights under PHIPA have been violated.

Under Quebec's Law 25, if you are located in Quebec, you additionally have the right to:

• Be informed of, and consent to, the collection of your personal information and the purposes for which it is used.

• Know when your information is transferred outside Quebec, and request details of the safeguards in place.

• Request the portability of certain computerized personal information you have provided to us.

• Withdraw consent to the use of your personal information, subject to legal or contractual restrictions.

• File a complaint with Quebec's Commission d'accès à l'information (CAI) if you believe your rights have been violated.

We have designated a person responsible for the protection of personal information in our practice, in accordance with Quebec's Law 25 and as a matter of good practice for all clients. Questions, concerns, or requests to exercise your privacy rights can be directed to this person using the contact information in Section 10.

We retain your personal and health information only for as long as necessary to provide services and as required by our regulatory college. Records must be retained for at least 10 years following last contact. If you were under 18 at the last contact, the practice must retain records 10 years following the day you would have become 18. When it is no longer needed, we securely destroy the information in a manner that ensures confidentiality is maintained (e.g., secure deletion, secure shredding).

As a regulated health professional, we are required by law to report certain types of information, including:

• Child Protection: We are obligated to report any suspected child abuse or neglect to the appropriate authorities (Children’s Aid Society).

• Harm to Self or Others: We must take appropriate action if there is a risk of harm to you or others, including implementing an agreed upon safety/wellness plan, notifying mental health crisis authorities or first responders (depending on services available in your community) or family/trusted individuals in your community.

• Court Orders and Subpoenas: If required by law, we may need to disclose your personal information to comply with court orders or subpoenas.

If a breach of your personal information occurs that poses a real risk of significant harm, we will notify you and the relevant regulator (Ontario's Information and Privacy Commissioner and/or Quebec's Commission d'accès à l'information, as applicable) in accordance with our legal obligations.

We may update this Privacy Policy from time to time to reflect changes in our practices or changes in legal requirements. Any material changes will be communicated to you, and the revised policy will be made available with the updated effective date.

If you have any questions or concerns about this Privacy Policy, or if you would like to exercise your rights, please contact us at:

Lincoln Grey

lincoln@branchanchor.com

1-647-872-3671

For additional information on your privacy rights in Ontario, you may also contact:

Information and Privacy Commissioner of Ontario  

• Website: www.ipc.on.ca  

• Phone: 1-800-387-0073  

• Commission d'accès à l'information du Québec Website: www.cai.gouv.qc.ca

• Phone: 1-888-528-7741

By using our services, you acknowledge that you have read, understood, and agree to this Privacy Policy.