Privacy Policy
Last updated: August 5, 2026 · Effective: August 5, 2026
Confidentiality is at the heart of the therapeutic relationship. This policy explains what personal information and personal health information we collect, why we collect it, who we share it with, how long we keep it, and the rights you can exercise. It applies to our website, our communications, and the psychotherapy, counselling and consultation services we provide, whether in person or remotely.
Contents
1. Who we are
The Francophone Psychotherapy Clinic of Toronto ("the Clinic", "we", "us") brings together therapists in private practice who provide individual psychotherapy, couple and family counselling, and psychological support in French and English, in Toronto and remotely.
Our practitioners are members in good standing of their respective Canadian regulatory colleges, namely:
-
the College of Psychologists and Behaviour Analysts of Ontario (CPBAO);
-
the College of Registered Psychotherapists of Ontario (CRPO);
-
the Ontario College of Social Workers and Social Service Workers (OCSWSSW).
Each practitioner works independently and acts as a health information custodian under PHIPA in respect of her own clients' records. This policy describes the practices we all apply in common.
Clinic contact information
Offices located in several Toronto neighbourhoods along the Bloor subway line (Runnymede and Bathurst areas).
Isabelle Bonsaint: 416-629-5499
Catherine Desjardins: 647-293-0832
Nadia Brabant: 647-782-2516
Website: www.psychotherapietoronto.com
2. Privacy Officer
We have designated a Privacy Officer. She serves both as the contact person under section 15(3) of Ontario's PHIPA and as the person in charge of the protection of personal information under section 3.1 of Quebec's Law 25. She oversees compliance with this policy, responds to access and correction requests, and handles complaints.
This document also serves as the written public statement required by section 16 of PHIPA.
Privacy Officer
Catherine Desjardins
Email: cdesjardins.psychologist@gmail.com
Phone: 647-293-0832
We respond to written requests within 30 days.
3. Applicable laws and professional standards
Our practices are governed by:
-
Ontario's Personal Health Information Protection Act, 2004 (PHIPA), which governs the personal health information we hold as health information custodians;
-
the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to non-health personal information collected in the course of commercial activity — notably through our website — and to interprovincial disclosures. Note: Ontario custodians governed by PHIPA are exempt from Part 1 of PIPEDA in respect of personal health information handled within Ontario (Order SOR/2005-399);
-
Quebec's Law 25 (Act to modernize legislative provisions as regards the protection of personal information), to the extent we carry on business activities in Quebec, including where we provide remote services to people residing there;
-
Canada's Anti-Spam Legislation (CASL) for our electronic communications;
-
Ontario's Child, Youth and Family Services Act, 2017 (CYFSA) and the Regulated Health Professions Act, 1991 (RHPA), which impose certain mandatory reporting duties;
-
the practice standards and codes of ethics of the CPBAO, the CRPO and the OCSWSSW.
Where more than one of these regimes applies to the same situation, we follow the rule that is most protective of you.
4. Information we collect
4.1 Website visitors
-
Browsing data collected automatically by our host: IP address (truncated or full, depending on the tool), device and browser type, operating system, language, pages viewed, time spent, referring site.
-
Information you provide voluntarily through a contact form or by email: name, email address, phone number, and any information you choose to include in your message.
Important: our contact forms and email are not intended for detailed clinical information. Please limit yourself to your contact details and a brief description of your request. Never send sensitive medical information, health card numbers or financial details through these channels.
4.2 People who receive our services
-
Identification and contact information: name, date of birth, address, email, phone, emergency contact, language preference.
-
Personal health information: reason for consultation, relevant medical and psychological history, medication, assessment results, session notes, treatment plan, correspondence with other health professionals, appointment dates and times.
-
Administrative and financial information: fees, receipts, payment history, insurer or benefit plan details when you request reimbursement, signed service agreements and consent forms.
-
Communications: emails, voicemails and text messages exchanged with your therapist.
We collect this information directly from you. We obtain it from a third party (family physician, another professional, a family member, an insurer) only with your written consent, unless the law permits or requires otherwise.
5. Why we collect it
InformationPurposes
Contact detailsTo reach you, confirm and reschedule appointments, send administrative documents, and contact you in an emergency.
Health informationTo assess your situation, develop and adjust a treatment plan, ensure continuity and quality of care, and maintain the clinical record required by our regulatory college.
Financial informationTo bill our fees, issue receipts, produce the documents needed for an insurance claim at your request, and meet our tax and accounting obligations.
Browsing dataTo keep the website functioning and secure, measure traffic in aggregate form, and improve page content and readability.
Contact formsTo respond to your request for information or an appointment.
We collect only the information necessary for these purposes. We never use your information for another purpose without first obtaining your consent.
We do not sell, rent or trade your personal information to anyone, under any circumstances. We do not use your information for targeted advertising, and we make no decisions about you based solely on automated processing.
6. Your consent
Consent to receive services. Before therapy begins, your therapist explains the nature and limits of the services and how confidentiality works. Your consent is obtained freely and on an informed basis, generally in writing.
Circle of care. Under PHIPA (s. 20), your consent for your therapist to use your health information for the purpose of providing your care may be implied. However, any disclosure to a professional outside your care requires your explicit written consent, subject to the legal exceptions described in section 9.
Express instructions ("lockbox"). You may at any time give us express instructions restricting the disclosure of specific information, even within the circle of care. We must then notify the recipient that relevant information has been withheld, without revealing its content.
Website and forms. By submitting a contact form, you consent to our using the information provided to respond to your request. No box is pre-checked and consent is never assumed.
Withdrawing consent. You may withdraw your consent at any time, in whole or in part, by writing to the Privacy Officer. We will explain the possible consequences for your services. Withdrawal is not retroactive and does not release us from the legal retention obligations described in section 10.
7. Who we share your information with
Your information stays confidential. We disclose it only in the following circumstances:
-
With your written consent — for example to your family physician, a psychiatrist, another therapist, a lawyer, or a family member you designate.
-
To our service providers, only to the extent necessary for their mandate and under written confidentiality agreements (see section 8).
-
For clinical supervision or professional consultation, a recognized practice required by our colleges. In such cases, information is anonymized or reduced to the strict minimum, and the person consulted is also bound by professional secrecy.
-
Where the law requires it — see section 9.
We never disclose your information to an insurer, an employer or a third-party payer without your specific written authorization.
8. Service providers, hosting and transfers outside Canada
We use a small number of technology tools. Here is what they are, why we use them, and where the data is hosted:
ProviderUseHosting
Wix.com Ltd.Website hosting, contact forms, website traffic statistics.Servers located in the United States and Ireland, with possible processing in other countries through its subcontractors and global delivery network. Wix acts as a processor and has no right to use your information for its own purposes.
Owl Practice (Owl Practice Inc.)Electronic clinical records, appointment scheduling, billing, secure messaging and, where applicable, video sessions.Canada. The provider attests that Canadian client data is hosted in Canada on a platform designed for PHIPA compliance. We require written confirmation of data residency from the provider and review it periodically.
Google (Gmail / Google Workspace)Administrative email: initial contact, appointment confirmations, transmission of administrative documents.Servers in the United States and other countries. We deliberately limit the clinical content sent by email.
Transfers outside Ontario and outside Canada. Some of these providers store or process data outside Canada, primarily in the United States and Ireland. Information hosted there may be accessible to authorities in that country under local law, despite the contractual protections in place.
Before using such a provider, we carry out a privacy impact assessment (Law 25, s. 17) covering the sensitivity of the information, the purposes, the protective measures and the legal framework of the receiving country, and we enter into a written agreement reflecting that assessment. Any disclosure of personal health information outside Ontario also complies with section 50 of PHIPA.
Your clinical record is hosted in Canada. We deliberately chose a Canadian platform for the most sensitive information. If you prefer that none of your information pass through a U.S. provider, tell your therapist: we can communicate with you exclusively by phone and through Owl Practice's secure messaging.
9. Limits to confidentiality: when the law requires disclosure
Professional secrecy is the rule. The law does, however, provide narrow exceptions where we must disclose information without your consent. Your therapist discusses these with you at your first meeting:
-
Duty to warn. Where there is a significant risk of serious bodily harm to you or to another person, PHIPA (s. 40(1)) permits us to disclose the minimum necessary to those able to eliminate or reduce that risk (emergency services, police, the person at risk).
-
Child protection. We have a legal duty to report ourselves, immediately and directly, to a children's aid society any reasonable grounds to suspect that a child under 16 is in need of protection (CYFSA, s. 125). The duty is ongoing and renews each time new grounds arise. For a 16- or 17-year-old, reporting is permitted but not mandatory, unless the young person is already subject to a protection order.
-
Sexual abuse by a regulated health professional. Mandatory written report to the registrar of the relevant college within 30 days — or immediately if the abuse is likely to continue or to affect others (Health Professions Procedural Code, Schedule 2 to the RHPA, ss. 85.1 and 85.3). Your name is never disclosed without your consent.
-
Court order, subpoena or warrant (PHIPA, s. 41). We disclose only what is expressly required and inform you to the extent the law permits.
-
Investigation by a regulatory college concerning one of our practitioners, or a mandatory report to a college regarding a member's incapacity, incompetence or misconduct.
-
Reporting abuse of a vulnerable adult living in a long-term care home or retirement home, where required by law.
-
Report to a coroner or other disclosure expressly authorized by law.
In every case, we limit disclosure to what is strictly necessary and document the step in the record.
10. Retention periods
CategoryPeriod
Clinical record (adult client)At least 10 years after the last professional contact — or, for OCSWSSW members, after the last entry in the record — as required by CPBAO, CRPO and OCSWSSW standards.
Clinical record (minor client)At least 10 years after the client's 18th birthday, or 10 years after the last contact — whichever is later.
Extended retentionSome records are kept beyond these periods where future access is reasonably foreseeable: records of minor clients, matters involving sexual abuse, and current or anticipated litigation.
Financial and tax records6 to 7 years, per Canada Revenue Agency requirements.
Form or email enquiries with no follow-upMaximum 12 months, then deleted.
Website traffic statisticsMaximum 26 months, in aggregate form.
Once the retention period has passed and no legal obligation stands in the way, information is securely destroyed: paper records are shredded, and electronic files and backups are permanently deleted. Each destruction is logged in a register recording the nature of the documents, the period covered, the method used and the date.
Continuity of records. Each practitioner has a written plan designating a successor custodian (PHIPA, s. 42) so your records remain protected and accessible in the event of death, incapacity or closure of practice. You would be informed of who holds custody of them.
11. Safeguards
We protect your information with physical, organizational and technological measures proportionate to its sensitivity:
-
paper records, where they exist, kept locked in a secured room;
-
electronic clinical records hosted in Canada, encrypted in transit and at rest;
-
two-factor authentication and strong passwords on all professional accounts;
-
device encryption (computers, phones) with automatic locking;
-
access limited on a need-to-know basis: each practitioner accesses only her own clients' records;
-
HTTPS (TLS) across the entire website;
-
written confidentiality agreements with every provider or collaborator;
-
virtual sessions conducted from a closed room on a private network, never over public Wi-Fi;
-
periodic review of our practices and ongoing privacy training.
No method of transmission or storage is 100% secure. We therefore cannot guarantee absolute security, but we commit to maintaining safeguards consistent with our professional standards and to responding promptly to any incident.
Recordings and artificial intelligence tools
We do not record sessions, in person or remotely, and we do not use any AI transcription or note-taking tool without your express, separate, advance written consent. Were such a tool ever contemplated, we would first explain how it works, where the data is hosted and how you can decline, and we would complete the privacy impact assessment the law requires. Declining has no effect whatsoever on the services you receive.
We also ask that you not record sessions without first discussing it with your therapist.
12. Electronic communications: risks and choices
Ordinary email and text messages are not secure channels. They can be intercepted, forwarded in error, or read by anyone with access to your device.
If you choose to communicate with us by email or text, you accept that risk. On our side:
-
we limit these messages to administrative matters (scheduling, billing, forms to complete);
-
we never include detailed clinical content in ordinary email;
-
we prefer Owl Practice's secure messaging or the telephone for anything clinical.
In a crisis or emergency, do not use email. Call 9-1-1, go to your nearest emergency department, or reach the Suicide Crisis Helpline at 9-8-8 (call or text, 24/7, in English and French). Our email inboxes and voicemail are not monitored continuously.
Newsletters and commercial messages. If we ever send non-essential messages, it will be only with your consent, in accordance with CASL, and every message will include a working unsubscribe link.
13. Cookies and website analytics
Our site is hosted on the Wix platform, which places cookies on your device. These fall into the following categories:
TypeRoleConsent
Essential cookiesKeep the site working, maintain security, balance server load and remember your consent preferences.Not required (strictly necessary)
Analytics cookiesAggregate traffic statistics: pages viewed, time on site, traffic sources.Required — placed only after you accept
Advertising cookiesWe do not use any. No advertising tracking pixel (Meta, Google Ads, TikTok, LinkedIn) is installed on this site.Not applicable
No non-essential cookie is placed before you have given free and informed consent for each purpose, as required by sections 8.1, 9.1 and 14 of Law 25 — which also require us to tell you about any identification, location or profiling technology in use and to offer you a means of deactivating it. You can change or withdraw your choice at any time through the "Cookie preferences" link at the bottom of every page, or by clearing cookies in your browser settings.
"Do Not Track" signals. Our site places no advertising trackers, so Do Not Track signals sent by your browser have no practical effect here.
14. Your rights
You have the following rights regarding the information we hold about you:
-
Access — obtain a copy of your record and learn how your information has been used and disclosed.
-
Correction — have inaccurate, incomplete or ambiguous information corrected. Where we cannot alter a clinical note already recorded, you may require that a statement of disagreement be added to the record.
-
Withdrawal of consent — at any time, going forward.
-
Portability (Law 25, s. 27) — receive, in a structured and commonly used technological format, the computerized information you yourself provided to us, or ask us to transfer it to another professional. This right does not extend to information we created or inferred, such as session notes and assessment reports; those remain available through the right of access above.
-
Deletion or de-indexing — request that dissemination of information cease, or that it be de-indexed, in the cases provided for by Law 25.
-
Complaint — to our Privacy Officer and, if needed, to the appropriate oversight authority (section 18).
How to exercise a right. Send a written request to the Privacy Officer (section 2). We will verify your identity before responding, then reply as soon as possible and no later than 30 days. That period may be extended by up to a further 30 days in the circumstances the law allows; we would notify you in writing, with reasons.
Fees. Viewing your record is free. Reasonable fees may apply to reproducing lengthy documents; where estimated fees exceed $30, we provide a written estimate before proceeding, and you may withdraw or narrow your request.
Limits. In rare cases the law permits or requires us to refuse access to part of a record — in particular where disclosure could reasonably be expected to result in a risk of serious harm to your treatment or recovery, a risk of serious bodily harm to you or another person, the identification of a confidential source, or the disclosure of information about a third party (PHIPA, s. 52). Where the problematic passage can reasonably be severed, access to the remainder of the record is granted. Any refusal is given in writing with reasons and informs you of your right to complain to the Information and Privacy Commissioner of Ontario.
15. Children and adolescents
Our website is not directed at children and we do not knowingly collect information about them through it.
In Ontario there is no fixed age for consenting to health care: capacity is assessed case by case, based on the young person's ability to understand the relevant information and appreciate the consequences of a decision.
-
A young person found capable consents to their own services and controls their record, including as against their parents.
-
For a child under 16, both the parent (or guardian) and the capable child may consent; where they disagree, the capable child's decision prevails (PHIPA, ss. 23(1) and 26).
-
A parent has no automatic right of access to information about treatment the child consented to alone, or to counselling received under the CYFSA.
-
Where a child is not capable, consent is given by a substitute decision-maker, who then exercises the access rights set out in PHIPA.
In all cases, your therapist clarifies from the outset, with the young person and the family, what will be shared and what will remain confidential.
16. Privacy breaches
We maintain a register of all privacy incidents, kept for at least five years as required by Law 25. In the event of a breach (loss, theft, unauthorized access, accidental disclosure), we:
-
promptly take reasonable steps to limit the harm;
-
notify you at the first reasonable opportunity if your personal health information was lost, stolen, or used or disclosed without authority. Under PHIPA (s. 12(2)) this notice does not depend on any harm threshold;
-
notify the Information and Privacy Commissioner of Ontario in the circumstances set out in O. Reg. 329/04 (theft, deliberate unauthorized use, a pattern of similar breaches, a significant breach, and others), and file the annual statistical report of breaches;
-
notify the Commission d'accès à l'information du Québec and the individuals concerned promptly where the incident presents a risk of serious injury (Law 25, s. 3.5) — the Quebec threshold differs from Ontario's;
-
notify the Office of the Privacy Commissioner of Canada where the incident involves information governed by PIPEDA and creates a real risk of significant harm;
-
report the breach to the relevant regulatory college where its rules require it.
17. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The version in force is always the one published on this page, with its update date. If a significant change affects how we use your information, we will inform you directly and, where the law requires, seek your consent again.
18. Questions and complaints
Please write to our Privacy Officer first (section 2). We take every concern seriously and aim to resolve it quickly.
If our response does not satisfy you, you may file a complaint with the appropriate authority:
Information and Privacy Commissioner of Ontario (health information, PHIPA)
2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8
Toll-free: 1-800-387-0073 · Toronto: 416-326-3333 · TTY: 416-325-7539
ipc.on.ca
Office of the Privacy Commissioner of Canada (PIPEDA)
30 Victoria Street, Gatineau, Quebec K1A 1H3
1-800-282-1376 · priv.gc.ca
Commission d'accès à l'information du Québec (Law 25, if you reside in Quebec)
Québec: 525, boulevard René-Lévesque Est, bureau 2.36, Québec, Quebec G1R 5S9
Montréal: 2045, rue Stanley, bureau 900, Montréal, Quebec H3A 2V4
Toll-free: 1-888-528-7741 · cai.gouv.qc.ca
You may also file a complaint with the regulatory college your therapist belongs to: the CPBAO, the CRPO or the OCSWSSW.
© 2026 Francophone Psychotherapy Clinic of Toronto. All rights reserved.
This policy is published in French and English. In the event of any discrepancy between the two versions, the French version prevails.
Version française
Having said that, a privacy policy is a statement that discloses some or all of the ways a website collects, uses, discloses, processes, and manages the data of its visitors and customers. It usually also includes a statement regarding the website's commitment to protecting its visitors' or customers' privacy, and an explanation about the different mechanisms the website is implementing in order to protect privacy.
Different jurisdictions have different legal obligations of what must be included in a Privacy Policy. You are responsible to make sure you are following the relevant legislation to your activities and location.
Generally speaking, a Privacy Policy often addresses these types of issues: the types of information the website is collecting and the manner in which it collects the data; an explanation about why is the website collecting these types of information; what are the website's practices on sharing the information with third parties; ways in which your visitors and customers can exercise their rights according to the relevant privacy legislation; the specific regarding practices minors' data collection; and much much more.
To learn more about this, check out our article “ Creating a Privacy Policy ”.