1. Who we are
This Privacy Policy describes how the clinic ("we", "us", "our") and the software platform we use to operate ("the Platform") collect, use, and disclose your personal health information ("PHI") in Ontario. The clinic is the Health Information Custodian (HIC) as defined in PHIPA s. 3(1). The Platform operates as a Health Information Network Provider / electronic service provider on the clinic's behalf and is bound by a written agreement under PHIPA s. 10(4).
2. Information we collect about you
We collect personal health information directly from you, your guardian, your health practitioners, and (where authorized) other custodians involved in your care. This may include:
- Identifying information: name, date of birth, gender, contact details, and your Ontario Health Card Number where applicable.
- Health information: medical history, current medications, allergies, diagnoses, treatment plans, clinical notes, lab results, and imaging.
- Payment and insurance information needed to bill for the care provided.
- Information about appointments, communications you send us, and access logs that record who at the clinic has viewed or modified your file.
We do not collect more information than is reasonably necessary for the purposes set out below.
3. Why we collect it (purposes)
We collect, use, and disclose your PHI to:
- Provide health care to you (the PHIPA "circle of care").
- Operate, monitor, and improve the clinic and the Platform (planning, quality assurance, accreditation).
- Bill for services and process payment.
- Comply with legal and regulatory obligations (for example, reporting required by law, professional college rules, and public health).
- Where you have given express consent: send you appointment reminders, educational materials, or non-care-related communications.
4. Your consent
Most of our uses and disclosures of your PHI for care purposes are made under the implied consent permitted by PHIPA among health information custodians (the "circle of care"). For all other uses or disclosures we will obtain your express consent.
You may withhold or withdraw consent at any time, subject to legal and ethical obligations that apply to us. Under PHIPA s. 20(2) you may also direct us to restrict the disclosure of part or all of your record to other custodians (a "lockbox" or consent directive). Where this is not yet technically supported in the Platform, we will record your direction and apply it manually until that capability ships.
5. How we protect your information
The clinic and the Platform follow the IPC Ontario "Manual for the Review and Approval of Prescribed Persons and Prescribed Entities" as a baseline. This includes:
- Encryption of PHI in transit (TLS 1.2 or higher) and at rest.
- Per-row access logging recording who viewed which record and when.
- Multi-factor authentication for clinic staff with administrative access.
- Background-checked staff bound by confidentiality agreements.
- A documented breach-response procedure aligned with PHIPA s. 12(2).
6. Your rights
Subject to PHIPA and PIPEDA, you have the right to:
- Receive a copy of your record (s. 53–54).
- Request a correction of inaccuracies in your record (s. 55).
- Receive an accounting of disclosures of your record.
- Make a complaint to us, to the Information and Privacy Commissioner of Ontario (IPC), or to the Office of the Privacy Commissioner of Canada.
We will respond to your access or correction request within 30 days.
7. Retention
We retain your record for at least 10 years after your last visit (or, if you were a minor, 10 years after you turn 18). Some specialties require longer retention; if longer retention applies to your care, we will tell you.
8. Disclosure outside Ontario
We process and store your PHI in Canada. We do not transfer your record outside Canada unless required by law or you have given express consent. If a specific service requires processing outside Canada (for example, a third-party AI vendor), we will identify the vendor, the safeguards in place, and your right to object.
9. Breach notification
If a privacy breach affecting your PHI occurs, we will notify you and the Information and Privacy Commissioner of Ontario as soon as reasonably practicable, in accordance with PHIPA s. 12(2) and IPC reporting expectations.
10. Marketing
We will not send you commercial electronic messages without your prior express consent (Canada's Anti-Spam Legislation, CASL). You may withdraw consent at any time using the unsubscribe link or by contacting us.
11. Contact
To exercise any of the rights above or ask a privacy question, contact the clinic's Privacy Contact Person designated under PHIPA s. 15. The clinic's contact details are shown on its profile and at reception, and privacy questions about the Platform can be sent to privacy@the-clinic.net.
To make a complaint to the regulator:
- Information and Privacy Commissioner of Ontario (IPC) — https://www.ipc.on.ca
- Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca
12. Changes to this policy
We will update this policy as our practices change or the law requires. The effective version is shown at the top. Your continued use of the Platform after a change indicates acceptance of the updated policy where the law permits implied acknowledgment; otherwise we will ask you to re-confirm consent.