Privacy Policy — Therapua Physiotherapy & Rehab

This Privacy Policy applies to Therapua Physiotherapy & Rehab Inc. ("Therapua", "we", "us", or "our"), a physiotherapy clinic regulated under the Regulated Health Professions Act, 1991 (Ontario) and the Physiotherapy Act, 1991 (Ontario).

This policy governs the collection, use, disclosure, and protection of personal health information and personal information by Therapua in connection with the provision of physiotherapy services, operation of our website, and all related communications.

Our physiotherapists are registered members of the College of Physiotherapists of Ontario (CPO) and adhere to the CPO's Standards of Practice, Code of Ethics, and Privacy Guidelines. We are also guided by the Canadian Physiotherapy Association (CPA) Code of Ethics and privacy best practices.

We comply with the following Canadian and Ontario privacy laws and professional standards:

• Personal Health Information Protection Act, 2004 (PHIPA) — Ontario's primary legislation governing the collection, use, and disclosure of personal health information by health information custodians
• Personal Information Protection and Electronic Documents Act (PIPEDA) — Federal legislation governing personal information in commercial activities
• Regulated Health Professions Act, 1991 (Ontario) — Governs the conduct of regulated health professionals
• Physiotherapy Act, 1991 (Ontario) — Governs the practice of physiotherapy in Ontario
• College of Physiotherapists of Ontario (CPO) Standards of Practice and Privacy Guidelines
• Canadian Physiotherapy Association (CPA) Code of Ethics — Ethical obligations regarding patient confidentiality and information handling

As a health information custodian under PHIPA, Therapua has specific legal obligations regarding your personal health information that go beyond general privacy law.

We collect personal health information and personal information only to the extent necessary to provide safe, effective physiotherapy care. This may include:

• Identifying information — full name, date of birth, health card number, and government-issued ID where required
• Contact details — home address, phone number, and email address
• Health history — past and current medical conditions, medications, allergies, surgical history, and relevant family health history
• Physiotherapy records — initial assessment findings, clinical notes, treatment plans, progress notes, discharge summaries, and outcome measures
• Referral information — referral letters from physicians or other health professionals
• Consent documentation — signed consent forms, treatment agreements, and authorization records
• Billing and insurance information — insurance provider name, policy and group numbers, employer information, and payment records
• Appointment data — booking history, attendance records, and scheduling preferences
• Website usage data — pages visited, browser type, device type, and anonymised IP address (via cookies, with your consent)

We collect only the minimum information necessary for the identified purpose, consistent with the principle of data minimization under PIPEDA and PHIPA.

In accordance with PHIPA and PIPEDA, we collect, use, and disclose your personal health information only with your knowledge and consent, except where the law permits or requires otherwise.

Express consent is obtained in writing at the time of your initial assessment and covers the collection and use of your health information for the purpose of providing physiotherapy treatment. Implied consent applies where the collection or use of information is reasonably necessary for treatment and you have voluntarily sought our services.

You have the right to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Please be aware that withdrawal of consent may limit our ability to provide you with ongoing care. To withdraw consent, please contact our Privacy Officer in writing.

We will not make the provision of services conditional on consent to uses of personal information beyond what is necessary to provide those services.

We use your personal health information and personal information for the following purposes:

• Providing physiotherapy assessment, diagnosis, treatment, and rehabilitation services
• Developing, implementing, and monitoring individualized treatment plans
• Communicating with you about your care, appointments, and follow-up
• Processing insurance claims, direct billing, and payment transactions
• Fulfilling our professional and legal obligations as regulated health professionals under Ontario law
• Coordinating care with other regulated health professionals involved in your treatment (with your consent)
• Quality assurance, peer review, and continuing professional development activities (using de-identified data where possible)
• Responding to complaints or legal proceedings
• Complying with reporting obligations to public health authorities where required by law

We do not use your personal health information for marketing, advertising, or any purpose unrelated to your care without your explicit consent. We do not sell, rent, or trade your personal information to any third party.

We may disclose your personal health information only in the following circumstances:

• To other regulated health professionals directly involved in your circle of care, where disclosure is necessary for your treatment and you have provided consent (express or implied)
• To insurance companies, third-party payers, or employers, for billing and claims purposes — only with your written authorization
• To our booking and practice management platform (Jane App) for appointment scheduling and clinical record management — Jane App is bound by a data processing agreement and complies with applicable Canadian privacy law
• To the College of Physiotherapists of Ontario (CPO) or other regulatory bodies, as required by law or professional standards
• To legal counsel, courts, or law enforcement agencies, where required by a court order, subpoena, or applicable legislation
• To public health authorities, where disclosure is required under the Health Protection and Promotion Act or other public health legislation
• In a medical emergency, to the extent necessary to prevent serious harm to you or another person

We do not disclose your personal health information to family members, employers, or other third parties without your express written consent, except as required by law.

All third-party service providers who handle your information on our behalf are required to maintain confidentiality and comply with applicable privacy legislation.

We retain patient health records in accordance with the requirements of the College of Physiotherapists of Ontario (CPO) and Ontario law:

• Adult patient records are retained for a minimum of 10 years from the date of the last entry in the record
• Records for patients who were minors at the time of treatment are retained until the patient reaches the age of 28, or for 10 years from the date of last entry — whichever is longer
• Records related to a patient who has died are retained for a minimum of 10 years from the date of death

After the applicable retention period, records are destroyed in a secure manner that protects patient confidentiality, consistent with CPO guidelines.

Non-health personal information (e.g., contact details for website inquiries from non-patients) is retained only as long as necessary for the purpose for which it was collected, and is then securely deleted.

We implement physical, administrative, and technical safeguards appropriate to the sensitivity of the information we hold, consistent with PHIPA requirements and CPO Standards of Practice:

• Physical safeguards — locked filing cabinets, restricted access to clinical areas, and secure disposal of paper records
• Administrative safeguards — staff privacy training, confidentiality agreements, role-based access controls, and written privacy policies and procedures
• Technical safeguards — encrypted electronic health records, password-protected systems, secure data transmission (TLS/HTTPS), and regular security assessments

In the event of a privacy breach involving your personal health information, we will notify you and the Information and Privacy Commissioner of Ontario (IPC) as required under PHIPA, and take immediate steps to contain and remediate the breach.

As a patient and as an individual whose personal information we hold, you have the following rights:

• Right of access — you may request access to your personal health information held by Therapua. We will respond within 30 days of receiving a written request, as required by PHIPA
• Right to correction — if you believe information in your record is inaccurate or incomplete, you may request a correction. If we decline, you may require that a statement of disagreement be attached to your record
• Right to withdraw consent — you may withdraw consent to certain uses or disclosures of your information, subject to legal and professional obligations
• Right to complain — you may file a complaint with the Information and Privacy Commissioner of Ontario (IPC) if you believe we have violated PHIPA, or with the Office of the Privacy Commissioner of Canada (OPC) for PIPEDA matters
• Right to know about breaches — you have the right to be notified if a privacy breach involving your personal health information creates a real risk of significant harm to you

To exercise any of these rights, please submit a written request to our Privacy Officer using the contact details in Section 11 below.

When providing services to patients under the age of 16, we generally obtain consent from a parent or legal guardian. However, consistent with the Health Care Consent Act, 1996 (Ontario), a minor who is capable of understanding the nature and consequences of treatment may provide their own consent.

Where a capable minor has consented to treatment independently, we respect the minor's right to confidentiality and will not disclose their health information to a parent or guardian without the minor's consent, except as required by law.

Our website uses cookies and similar technologies to improve your browsing experience and understand how visitors use our site. We obtain your consent before placing non-essential cookies on your device.

Types of cookies we use:

• Essential cookies — required for the website to function correctly; these cannot be disabled
• Analytics cookies — used to collect anonymised data about how visitors use our site (pages visited, session duration, device type); this data does not identify you personally

You may withdraw consent to non-essential cookies at any time by adjusting your preferences through our cookie consent banner or your browser settings. Disabling cookies may affect some website functionality.

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or to exercise your rights under PHIPA or PIPEDA, please contact our Privacy Officer:

• Privacy Officer — Therapua Physiotherapy & Rehab Inc.
• 1103 Cobble Hill Dr, Nepean, ON K2J 5S4
• Email: info@therapuaphysio.com
• Phone: (613) 614-4816

We will acknowledge your request within 2 business days and respond fully within 30 days, as required by PHIPA.

If you are not satisfied with our response, you may contact:

• Information and Privacy Commissioner of Ontario (IPC) — for PHIPA matters: www.ipc.on.ca | 1-800-387-0073
• Office of the Privacy Commissioner of Canada (OPC) — for PIPEDA matters: www.priv.gc.ca | 1-800-282-1376
• College of Physiotherapists of Ontario (CPO) — for professional conduct matters: www.collegept.org | 1-800-583-5885