Privacy Policy

Our commitment to you

It's easier to open up in therapy when you know that what you share is protected. At Heart of Oak Psychotherapy, we take your privacy seriously. We want you to understand how we handle your information, explained in plain language without the fine print.

This policy explains what information we collect, why we collect it, how we keep it safe, who can see it and what your rights are. It applies to everyone who visits our website, contacts us, books a consultation or receives therapy with us. That includes in-person sessions at our Oakville office and virtual sessions for clients in Ontario, Alberta, Saskatchewan, Manitoba, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut.

If anything here is unclear, please reach out. We're happy to talk it through.

Who is responsible for your information

Katarina Jurriaans, Registered Psychotherapist (Qualifying), is the health information custodian for Heart of Oak Psychotherapy under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). This means she is responsible for the personal health information the practice holds.

Our associate therapists, Mairin Clarke, Michaela DeSimone and Megan Appleton, are also Registered Psychotherapists (Qualifying). They and any administrative support act as agents of Heart of Oak Psychotherapy. They may only collect, use and share your information on the practice's behalf, and only in line with this policy and the law. All client records are kept in the practice's Jane account.

Privacy contact:
Katarina Jurriaans, RP (Qualifying), Privacy Contact
hello@heartofoakpsychotherapy.com · (289) 201-1951
230 Duskywing Way, Oakville, ON L6L 6X5

Two kinds of information, two privacy laws

• Personal health information is anything about your mental or physical health, the care you receive from us, who your therapist is, payment for your care and your substitute decision-maker. PHIPA protects this. In practice, it covers your intake form, your bookings, your clinical notes and almost everything you tell us about yourself.
• General personal information includes things like the basic website data collected when someone browses our site. Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) generally covers this kind of information when it's collected in the course of commercial activity.

If you live outside Ontario, the privacy laws of your province or territory may also apply to your information. Where they do, we follow whichever rules apply.

We treat all of your information with the same care.

What information we collect

We collect only what we reasonably need to care for you and to run the practice.

When you visit our website

• Our website platform, Wix, may automatically set cookies the site needs to work properly and securely. As part of hosting the site, Wix may also log basic technical information, such as your IP address and browser type.
• If you choose "Accept" on our cookie banner, we may also use advertising and measurement tools from Google and Meta. These record basic information, such as the pages you visit, your device and browser, and the fact that a form was sent. They never record what you type into a form or any health information. If you decline, these tools don't set advertising cookies and the site still works; our site may still send Google limited, cookieless signals (such as that a form was sent) without identifying you, so we can measure ad performance. See "Cookies, advertising and measurement" below.

When you fill out a form on our website (our contact form or the optional follow-up form at the end of our matching quiz)
Submissions are delivered to our practice email inbox (hello@heartofoakpsychotherapy.com). They include:

• your name, email, phone number and preferred contact method;
• your age or age range, where you live (province or territory and city) and whether you'd like in-person or virtual sessions;
• a short description of what you're looking for support with, any preferences for a therapist and your availability.
• if you use the optional follow-up form at the end of our matching quiz: your first name (if you give it), your email, your phone number (if you give it), the therapists the quiz suggested, and your quiz answers (who therapy is for, the topics you picked, whether you'd like in-person or virtual sessions and your preferred times).

Our matching quiz. The quiz on our website runs in your browser. Your answers aren't saved, sent to us or recorded by any advertising or measurement tool. They're only sent to us if you choose to use the optional follow-up form at the end, tick the consent box and press Send. We use what you send only to contact you about booking. If you're answering for someone else, such as your child, partner or family, please share only what you're comfortable sharing on their behalf.

When you book through Jane (our online booking and clinical records system)

• Your name, date of birth, contact details, address and emergency contact.
• Your appointment history, intake and consent forms, and any questionnaires you complete.
• Payment and receipt information. We keep a card on file for clients through Jane, for example for late-cancellation fees. Your card is stored and processed securely through Jane's payment processing. We don't see or keep your full card number ourselves.

When you're in therapy with us

• The clinical record your therapist is professionally required to keep, such as session notes, assessments, treatment plans and relevant correspondence.
• With your consent, information from other people involved in your care (for example, your family doctor).

When you email, call or text us

• Whatever you choose to include in your message, plus your contact details.

We don't do direct billing and we don't work with EAPs, so we don't collect insurance policy or EAP information from you. We give you receipts that you can submit to your own insurer.

Why we collect it

We use your information to:

• respond to your inquiry and match you with a therapist who's a good fit for you;
• schedule appointments and send reminders;
• provide, document and plan your therapy;
• process payments and issue receipts for your insurance claims;
• contact you or your emergency contact if there are concerns about your safety;
• meet our legal and professional obligations as members of the College of Registered Psychotherapists of Ontario (CRPO), including record-keeping;
• take part in clinical supervision and consultation, using only details that don't identify you (see below);
• understand, in general terms, how people find our website and whether our ads are working, using advertising cookies only if you accept optional cookies (see "Cookies, advertising and measurement").

We will never sell your information. We will not use your personal health information for marketing or fundraising without your express consent.

Your consent

By contacting us, completing our intake form or booking with us, you're giving us your consent to collect, use and share your information for the purposes above. That includes sharing within your care team at Heart of Oak, for example when Katarina reviews your intake to match you with a therapist.

• We'll ask for your express (written or verbal) consent before sharing your information with anyone outside the practice, such as your doctor, a school, a lawyer or a family member. The exception is when the law permits or requires us to share it without consent (see "When we might share your information without your consent").
• You can withdraw or limit your consent at any time by letting us know. This won't undo anything already done with your consent, and it can't stop us from keeping the records the law and our professional standards require.
• Your therapist will go over confidentiality and its limits with you at the start of therapy, and you're always welcome to ask about it again.

Clinical supervision: As Registered Psychotherapists (Qualifying), our therapists meet regularly with an external clinical supervisor, as CRPO requires. In supervision, we share only details that don't identify you. Supervision conversations are kept confidential.

How we keep your information safe

We take reasonable physical, technical and administrative steps to protect your information against theft, loss, and unauthorized access, use, copying, change or disposal.

• Jane (clinical records and booking). We use Jane, a secure practice management and electronic health record system. Our Jane account is set up in Jane's Canadian region, so it's hosted on Jane's Canadian servers in Montreal, Quebec, and Calgary, Alberta. Data is encrypted in transit and at rest. Jane acts as our service provider (agent) and doesn't control or use your health information for its own purposes. We use two Jane features that involve limited processing outside Canada:
  • Text (SMS) appointment reminders. Jane sends these through U.S.-based providers, so the details in a reminder (such as your name and appointment time) are processed and may be stored temporarily in the United States. If you'd rather not get text reminders, let us know and we'll switch you to email.
  • Virtual (telehealth) sessions. Jane's telehealth service runs through a provider that uses a central data centre, so very limited information (such as your IP address) may be stored temporarily outside Canada. Jane says no video or audio streams or chat messages from telehealth sessions are stored.
• Klarify (AI-assisted note-taking, only with your consent). See "AI-assisted note-taking" below.
• Our website (Wix). Our website is hosted by Wix. Forms on our site send your information over an encrypted (HTTPS) connection, and Contact form and quiz follow-up submissions are delivered to our practice email. Wix may also keep a copy of form submissions in our site account, and Wix may store data on servers outside Canada, including in the United States. Once your information has been moved into your Jane file, we delete the copy from our inbox and from Wix.
• Email. Our practice email runs on Google Workspace (Gmail). Our accounts use strong passwords, and two-factor authentication is turned on. Google may store email data outside Canada, including in the United States.
• People and devices. Only the people who need your information to provide or support your care can access it. Everyone who works with us is bound by confidentiality. Work devices are password-protected and, where available, encrypted.
• Paper. We don't keep paper clinical records.

No system is perfectly secure, but we work hard to protect your information and we review our practices regularly.

How long we keep your records

As required by the CRPO Professional Practice Standards, we keep clinical records for at least 10 years from the date of our last contact with you, or 10 years after your 18th birthday, whichever is later. For example, if a child's last session is at age 7, we keep the record until their 28th birthday.

After that, we securely destroy the records by permanently deleting the electronic files. If there's ever a paper copy of anything, we cross-cut shred it. We keep a log of which records were destroyed and when.

Inquiries and form submissions from people who don't go on to become clients are kept for 1 year and then deleted.

If Katarina is ever suddenly unable to practise, Kelsea Gale has been designated to look after the practice's records as successor custodian. You'll still be able to access your records or have them transferred to another provider.

Virtual therapy

We offer virtual sessions through Jane's built-in telehealth to clients in Ontario, Alberta, Saskatchewan, Manitoba, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut. You join through a secure link from Jane. Jane says no video or audio streams or chat messages are stored. Only very limited technical information, such as your IP address, is stored temporarily, possibly outside Canada (see "How we keep your information safe").

To protect your privacy during virtual sessions:

• your therapist will join from a private, confidential space;
• we will never record a session without your express consent, and we ask that you don't record either (the only recording we'd ever make is for AI-assisted note-taking, and only if you agree; see below);
• we'll confirm your location at the start of each session in case of an emergency;
• we suggest you use a private space, headphones and a secure (not public) internet connection.

AI-assisted note-taking (Klarify)

Some of our therapists may use Klarify, an AI note-taking assistant (an "AI scribe") made for therapists by Klarify Health Inc., a Toronto company. Here's how it works and what it means for your privacy:

• Only with your consent. Klarify is explained in our written consent forms, and your therapist will also go over it with you in conversation before using it. You can say no. Declining won't affect your care in any way; your therapist will simply write notes the usual way. You can also change your mind at any time, including partway through therapy. In couples or family sessions, we'll only use Klarify if everyone in the session agrees.
• What it does. With your consent, Klarify records the audio of the session (in person or virtual) and turns it into a transcript. It then uses AI to draft a clinical note. Your therapist always reviews and edits the final note, and is responsible for it. Klarify doesn't make clinical decisions.
• Where it's stored. Klarify says all session recordings, transcripts and notes are stored in Canada, on Amazon Web Services servers in Montreal.
• Processing in Canada. Our Klarify accounts are set to process session recordings in Canada. Klarify sends information to transcription and AI service providers, which process it temporarily and, Klarify says, don't keep it afterward.
• How long recordings are kept. Our Klarify accounts are set to delete session audio as soon as it has been transcribed. Recordings are encrypted, and only the therapist who made them can access them. Transcripts and draft notes stay in Klarify until the therapist deletes them. The final note is kept in your clinical record for the retention period described above.
• No AI training, no selling. Klarify says it doesn't use session recordings, transcripts or notes to train AI models, that its AI and transcription providers don't train on them, and that it doesn't sell your data. Klarify may use de-identified information internally to improve its service.
• Klarify acts as our service provider. It may only use your information to provide its service to us.

Who we share your information with

With your consent. For example, with your family doctor, psychiatrist, another health provider, a school, a lawyer or anyone else you ask us to share with. We'll share only what's needed for the purpose you agree to.

With our service providers. These are companies that help us run the practice:

• Jane: records, booking, payments, text reminders and virtual sessions;
• Klarify: AI-assisted note-taking, only with your consent;
• Wix: our website and its forms;
• Google: our practice email (Google Workspace) and advertising and measurement tools on our website (with advertising cookies only if you accept optional cookies);
• Meta (Facebook and Instagram): only if you accept optional cookies, advertising and measurement tools on our website;
• AdFlint: a tool we use to manage our Google and Meta ads.

Our service providers may only use your information to provide services to us, and they must keep it secure. We never upload client lists or client contact details to Google or Meta.

When we might share your information without your consent

Confidentiality is the foundation of therapy, but the law sets some limits on it. We would only share information without your consent in situations like these, and we'd share only what's necessary:

• Risk of serious harm. If we believe on reasonable grounds that sharing is necessary to eliminate or reduce a significant risk of serious bodily harm to you or someone else (PHIPA, s. 40).
• Child protection. If we have reasonable grounds to suspect that a child is or may be in need of protection (for example, because of abuse or neglect), Ontario's Child, Youth and Family Services Act, 2017 requires us to report it to a children's aid society right away.
• Court orders and legal proceedings. If we receive a valid court order, summons or subpoena, or as otherwise permitted or required in a legal proceeding.
• Our regulatory College. If CRPO requires information to administer or enforce the laws that regulate psychotherapists, for example during a complaint investigation or quality assurance review (PHIPA, s. 43).
• Sexual abuse by a regulated health professional. If you tell us that another regulated health professional sexually abused you, the law requires us to report it to that professional's college. We won't include your name without your written consent.
• Other legal requirements. When another law specifically permits or requires it.

Whenever it's possible and safe, we'll talk with you first.

Children, teens, couples, families and substitute decision-makers

We work with preteens, teens, adults, couples and families.

• There's no fixed "age of consent" for therapy in Ontario. A young person of any age who understands what therapy involves and its likely consequences (in other words, who is "capable") can consent to their own therapy and decide how their health information is shared.
• Under 16: A parent or legal guardian may also make decisions about the child's health information, except for information about therapy that the young person agreed to on their own. If a capable child under 16 and their parent disagree about sharing information, the child's decision is the one that counts (PHIPA, s. 23).
• 16 and older: Clients 16 and over make their own decisions about their information, unless they're found incapable.
• Parents' involvement: We see parents as important partners. At the start of therapy, the therapist, the young person and their parent(s) will agree together on what will be shared (for example, general progress, attendance and safety concerns) and what will stay private between the young person and their therapist. Safety concerns are always shared as needed.
• Separated or divorced parents: Please let us know about any custody, decision-making or parenting arrangements or court orders. A parent who has only a right of access to a child can't consent on the child's behalf.
• Substitute decision-makers: If a client becomes unable to make decisions about their health information, a substitute decision-maker recognized by PHIPA may make those decisions on their behalf. This could be a guardian, an attorney for personal care, a spouse or partner, or a close family member, in the order the law sets.

Couples therapy. In couples therapy, what's shared in joint sessions becomes part of the couples record.

We generally take a "no secrets" approach. We encourage partners to share openly with each other, because trust grows when you're both working from the same information. Sometimes something important comes up in individual contact with your therapist, such as a phone call, an email or an individual session. If that happens, your therapist will encourage you to share it with your partner in a joint session and will support you in doing so. Your therapist will explain this approach to you both at the start. If you're ever worried that sharing something could affect your safety, please tell your therapist so you can work out a safe way forward together.

Your records in couples therapy. Notes from joint sessions are about both of you, so we treat the couples record as belonging to you both. Your therapist will explain how your records are kept, and how you can see them, at the start of therapy.

• The full couples record is available when you ask for it together, or when one of you asks and the other agrees in writing.
• If only one of you asks, you're still entitled to your own information. That means anything about you, plus the shared parts of your work together, such as the goals you set, the themes in your relationship and how things are progressing. Before we give you a copy, we'll remove anything that's only about your partner, unless they agree to share it. Ontario's privacy law (PHIPA) requires this, and it protects each of you equally.
• If either of you meets with your therapist on your own, those notes are kept separately, in your own file.
• Sharing with anyone outside therapy (for example, a lawyer, an insurer or another health provider) needs written consent from each of you for your own information, unless the law requires otherwise, such as a court order or a serious safety concern.

Your records in family therapy. When several family members meet with your therapist together, the notes are about the family as a whole and about each person in it.

• The full family record is available when everyone who took part asks for it together, or agrees in writing.
• If one family member asks, they're entitled to their own information and to the shared parts of the work, such as family history, how the family relates, the themes explored, the plan and progress. We'll remove information that's only about another family member, unless that person agrees to share it.
• Sessions with one person or a smaller group (for example, just the parents, or one teen) are kept in a separate file. Your therapist will talk with you at the start about what, if anything, from those sessions comes back to the whole family.
• Young people: A young person who is capable of making decisions about their own therapy also controls their own information. We won't share it with a parent without their consent, unless the law requires it (see "Under 16" above).
• Parents with only a right of access to a child can't consent on the child's behalf, including to the release of the child's information.
• Sharing outside therapy needs consent from each person whose information is involved, except where the law requires or allows otherwise, such as a court order, our duty to report child protection concerns or a serious safety risk.

If we ever need to hold something back. In rare cases, the law allows or requires us to hold back some information from a couples or family record, for example if releasing it could put someone's safety at risk. If we ever withhold anything, we'll tell you in writing and explain your right to complain to the Information and Privacy Commissioner of Ontario.

Your rights: accessing and correcting your record

• Access. You have the right to see or get a copy of your personal health information, with limited exceptions set out in PHIPA (for example, if access could reasonably be expected to result in a risk of serious harm). Send your request to our privacy contact. We'll respond as soon as possible and no later than 30 days after we receive it. If we need more time, we may extend by up to 30 more days and will let you know in writing.
• No fee. We don't charge for access to or copies of your record.
• Correction. If you believe something in your record is inaccurate or incomplete, you can ask us in writing to correct it. If we don't agree to make the change, you can add a statement of disagreement to your record.
• If we refuse an access or correction request, you can complain to the Information and Privacy Commissioner of Ontario (see below).

If there's a privacy breach

If your personal health information is stolen, lost, or used or disclosed without authorization, we'll:

• contain the problem as quickly as possible and investigate;
• notify you at the first reasonable opportunity, and let you know that you're entitled to complain to the Information and Privacy Commissioner of Ontario;
• report the breach to the Information and Privacy Commissioner of Ontario when it meets the reporting requirements under PHIPA's regulation;
• take steps to prevent it from happening again.

Email, text messages and video: please know the risks

Email and text are convenient, but they're not completely secure. Messages can be misdirected or intercepted, or seen by others who have access to your phone or computer.

• We mostly use email and text for scheduling and practical matters. Please don't use them for urgent or crisis situations, or for detailed clinical information.
• By emailing or texting us, you accept these risks. If you'd rather we not contact you this way, just tell us and we'll respect that.
• Emails and texts related to your care may become part of your clinical record.
• We don't monitor email or text around the clock. If you're in crisis, call or text 9-8-8 (Suicide Crisis Helpline), call 911 or go to your nearest emergency department.

Social media and online reviews

We have pages on Instagram, Facebook and TikTok, and profiles on Psychology Today, where we share helpful information. To protect your privacy:

• We won't "friend," follow or connect with current or former clients on personal accounts.
• If you follow or interact with our pages, others may be able to see that. Please don't share personal health information in comments or direct messages.
• We won't confirm or deny that anyone is a client, including in response to online reviews.
• We won't search for clients online, except in rare situations involving serious safety concerns.

Cookies, advertising and measurement

Essential cookies (Wix). Our website is hosted by Wix, and Wix may set some cookies (small files stored on your device) that the site needs to function. For example, they help keep the site secure, remember settings and make forms work. You can block or delete cookies in your browser settings, but some parts of the site may not work as expected. Wix's own privacy and cookie policies apply to data that Wix processes as our host.

Optional advertising and measurement tools (Google and Meta). We may use advertising and measurement tools from Google and Meta (Facebook and Instagram) to understand how people find us and whether our ads are working. Here's what that means for you:

• They only set advertising cookies if you choose "Accept" on our cookie banner. You can decline, and the site will still work. If you decline advertising cookies, Google does not set advertising cookies; our site may still send Google limited, cookieless signals (such as that a form was submitted) without identifying you, so we can measure ad performance.
• What they record: basic information such as the pages you visit, your device and browser, and the fact that a form was sent.
• What they never record: what you type into a form, your answers to our matching quiz, or any health information.
• No health-based targeting. We don't target or re-target ads based on which therapy pages you visit or on any health condition.
• No client lists. We never upload client lists or client contact details to Google or Meta.
• We never sell your information.

Google and Meta handle the information these tools collect under their own privacy policies. To learn more or to control the ads you see:

• Google Privacy Policy: policies.google.com/privacy
• How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites
• Google ad settings (My Ad Center), where you can turn off personalized ads: adssettings.google.com
• Meta Privacy Policy: facebook.com/privacy/policy
• Meta ad preferences (sign in to Facebook or Instagram to adjust): accountscenter.facebook.com/ad_preferences
• Opting out of interest-based ads from many companies at once (Digital Advertising Alliance of Canada): youradchoices.ca

Our booking page. Our booking page (heartofoakpsychotherapy.janeapp.com) is run by Jane, and Jane's privacy notice also applies there.

Questions and complaints

Talk to us first. If you have a question or concern about how we've handled your information, please contact our privacy contact above. We'll take it seriously and respond promptly.

Information and Privacy Commissioner of Ontario. You have the right to complain to the IPC about how we've handled your personal health information. Generally, you must file in writing within one year of becoming aware of the issue. If you're complaining about a refused access or correction request, you must file within six months of the refusal.

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
Toronto area: 416-326-3333 · Toll-free: 1-800-387-0073 · TDD/TTY: 416-325-7539
info@ipc.on.ca · www.ipc.on.ca

For non-health personal information (for example, general website data), you can also contact the Office of the Privacy Commissioner of Canada: www.priv.gc.ca · 1-800-282-1376.

If you live outside Ontario, you may also be able to contact the privacy commissioner or ombudsperson for your province or territory.

Concerns about a therapist's professional conduct can be raised with the College of Registered Psychotherapists of Ontario: www.crpo.ca.

Changes to this policy

We may update this policy from time to time, for example if laws change or we start using a new tool. The current version will always be posted on our website with its effective date. If we make a significant change, we'll let current clients know.