Privacy Policy

At the Cognitive & Interpersonal Therapy Centre (CITC), the privacy and confidentiality of personal health information is a foundational principle. This policy outlines how CITC collects, uses, discloses, protects, and provides access to personal information solely as necessary to comply with the Personal Health Information Protection Act (PHIPA, 2004) and applicable privacy laws.

As a client of CITC, you have the right to:

• Understand how your personal and health information is used and shared
• Access and correct your personal records 
• Withdraw consent for data collection or use (where permissible)
• Be informed of any privacy breach affecting your information
• File a complaint with CITC or regulatory authorities

1. What is Personal Information?

The term “personal information” is defined in accordance with the federal Personal Information Protection and Electronic Documents Act, 2011 (PIPEDA), and refers to any information about an identifiable individual. This includes, but is not limited to, details such as name, address, phone number, email address, gender, and date of birth.

The term “personal health information,” as defined under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), includes information related to an individual’s mental or physical health, health history, diagnoses, psychological records, and treatment plans.

For the purposes of this Privacy Policy, personal information is understood to include personal health information. Any information that has been collected in which all personal identifiers have been removed, such that the information could not reasonably be used to identify the individual, is not considered personal information or personal health information.

Business contact information (e.g., business phone or work email) is not considered personal information under PHIPA.

2. Who We Are

CITC is a multidisciplinary psychology practice led by Dr. Carolina McBride, C.Psych., and supported by a diverse team of psychologists, psychological associates, psychotherapists, and administrative professionals, students and volunteers. The team provides assessment and therapeutic services to children, adolescents, adults, couples, and families across a range of presenting concerns. The clinic is committed to clinical excellence, cultural responsiveness, and the ethical use of personal information. As a Health Information Custodian under PHIPA, CITC is responsible for ensuring the protection and proper handling of all personal health information under its custody or control.

CITC also works with a number of consultants and agencies who may, in the course of their duties, have limited access to personal information. These include:

• Bookkeepers and accountants
• Payment processors
• Insurance providers
• Legal and compliance consultants

These providers are contractually obligated to adhere to strict privacy and confidentiality standards.

We restrict their access to any personal information as much as is reasonably possible. We also have their assurance that they follow appropriate privacy principles.

3. Collection of Personal Information: Primary Purposes

Clients: CITC collects the personal information of clients to provide psychological and psychotherapeutic services.

Types of Personal Information We Collect About Clients

We collect the following types of personal information about clients for the purposes of delivering psychological services, billing and administration:

• Name, contact information, date of birth
• Emergency contact information
• Description of concerns/symptoms
• Health history, including family history, physical condition and function and social situation (to help us assess mental health needs)
• Clinician preferences, and the clinician booked with
• Insurance coverage and payment information
• Services received, including number of sessions, attendance status, dates, etc.
• Communications between clients and therapists
• Clinical notes and records of assessment information and data relating to treatment
• Data from self-report measures and other psychological testing
• Other related or similar information

Emergency Situations: In limited circumstances, personal health information may be collected or shared without express consent when permitted by law (e.g., risk of harm). These are outlined explicitly in CITC’s consent form (see below section 11) and are reviewed with a clinician during the intake session.

Website Visitors: The CITC website collects only the personal information provided voluntarily (e.g., contact forms). Cookies are used solely for navigation and performance.

Staff, Students, and Volunteers: CITC collects the personal information of staff, students, and volunteers to manage internal communication, coordinate scheduling, maintain safety protocols, and fulfill human resource responsibilities. This includes contact details, emergency contacts, qualifications, and information related to performance or safety.

4. Collection: Related and Secondary Purposes

Personal information may also be used for:

• Billing and collection of fees
• Service updates, program announcements, or professional development opportunities
• Quality assurance and clinical supervision
• Regulatory compliance with the College of Psychologists and Behaviour Analysts of Ontario or the College of Registered Psychotherapists of Ontario
• Collaboration with third-party funders (e.g., insurance, WSIB)
• Record retention for a minimum of 10 years in accordance with regulatory requirements

5. Administrative Access to Personal Health Information

As part of clinical operations, designated members of the clinical team, including administrative staff, associates, students and volunteers, may access clients’ personal information for the following purposes:

• Managing clinical records
• Determining when files are eligible for secure digital erasure
• Ensuring clinician documentation is complete and up to date
• Coordinating communication between clients and clinicians
• Supporting administrative functions such as scheduling, billing, and audits
• Processing record releases or transfers upon client or authorized third-party request
• Other related tasks

All team members with access to personal information are bound by the same legal and professional confidentiality obligations as treating clinicians.

6. Collection, Use, and Disclosure of Client Information

All therapists and administrative staff at CITC have access to clients’ names and basic identifying information (e.g., address, contact information, and date of birth). However, session notes and additional clinical information are accessible only to the therapist(s) with whom the client has booked appointments—and their supervisors, where applicable.

CITC will only release clinical notes and personal health information to third parties such as insurance companies, case managers, academic institutions, legal professionals, or non-treating healthcare providers with the client’s written informed consent, unless disclosure falls within the scope of implied consent under PHIPA. Clients may withdraw consent at any time in writing; however, this does not apply retroactively to information already disclosed.

In accordance with Ontario’s Personal Health Information Protection Act (PHIPA), implied consent may apply when disclosing relevant health information to other healthcare providers involved in the client’s care, provided the purpose is to deliver or support healthcare and the client would reasonably expect this information to be shared.

Extended health benefit providers may occasionally contact CITC to verify session attendance. In these cases, only confirmation of attendance is provided—never clinical details—as this is standard procedure for claim processing.

To support effective psychological assessment and care, CITC uses secure external platforms based in Canada and the United States to administer and analyze psychometric assessments. These platforms offer valuable clinical insights and adhere to strict privacy and data security standards. Information gathered through these systems is used solely to support psychological assessment and treatment planning.

Participation in the use of these psychometric platforms is voluntary. Clients may decline or withdraw consent for their use at any time without affecting their access to care. By consenting, clients acknowledge and agree to the use of external platforms as part of their psychological services. CITC encourages open communication about any concerns, and alternative options may be discussed when possible.

Clients have the right to review this Privacy Policy and understand how their information is collected, used, and disclosed. They may also request access to their personal records or direct privacy-related inquiries to CITC’s Privacy Officer (see Section 10: Privacy Breaches and Complaints). Rare exceptions to confidentiality may apply when required by law.

7. Use of Electronic Communication & Virtual Care

With the shift to virtual care, CITC uses encrypted platforms (Owl Practice, Microsoft Teams) for remote sessions. Email and text may be used for appointment scheduling or administrative purposes.

The most secure means of communication with our practice is through face-to-face interactions, phone calls, or via the secure Owl Practice platform. While we employ email for administrative purposes such as scheduling and modifying appointments, sending receipts, addressing billing matters, and handling other related issues, it is essential to note that email communication may not be entirely secure. Therefore, we strongly advise against including confidential information in emails and text messages. At times, however, clients may wish to communicate personal health information via email or text despite these risks. In such cases, we will respond appropriately while continuing to encourage secure alternatives for the exchange of sensitive information.

Risks of Electronic Communication:

• Potential unauthorized access
• Delays or misdirected messages

CITC obtains express consent before initiating virtual care and takes reasonable steps to safeguard transmitted information.

8. Safeguards for Personal Information

To ensure privacy:

• Any physical records are stored in locked or restricted areas.
• Electronic records are protected with passwords, encryption, and secure backups.
• Associates, staff, students, and volunteers receive privacy training annually

9. Retention and Destruction

• Client records are retained for at least 10 years after the date of last contact, or in the case of children, 10 years after their 18th birthday, as per regulations. After this period, records are securely destroyed.
• Paper records: shredded
• Digital records: permanently deleted

10. Access and Corrections

Clients have the right to access their personal records with limited exceptions. Upon request, CITC will:

• Confirm identity
• Provide access to information
• Correct factual inaccuracies (not professional opinions)
• Add a statement of disagreement to the file if a correction is not made

A nominal fee may apply for record access.

11. Consent

There are important exceptions to confidentiality, conditions under which personal information may be released about clients with or without their consent. These exceptions may occur under the following circumstances:

1. Harm to self. If a therapist has reason to believe that their client is in imminent danger of physically harming themselves in ways that may be life threatening, they may have to make a referral to a hospital and/or contact a family member, close other, or another person (such as a police officer) who may be able to help protect them.

2. Harm to others. If a therapist has reason to believe that their client is seriously threatening physical violence against another person, or if you have a history of physically violent behaviour, and if they believe that you are an actual threat to the safety of another person, they may take some action (such as contacting the police, notifying the other person, seeking hospitalization, or some combination of these actions) to ensure that the other person is protected.

3. Court order. A client’s records can be subpoenaed by a court order, and a therapist can be required to testify and give information obtained during sessions. This information would never be provided voluntarily without the client’s direct request or permission without the court order.

4. Child (or vulnerable adult) Abuse/Neglect. If a therapist has reason to believe that a child under the age of 18 (or a vulnerable adult) is being abused or neglected, they are legally obligated to report this situation to the appropriate authorities.

5. Abuse by another regulated health professional. All regulated health professionals must report to the appropriate regulatory body the sexual or physical abuse of a client by another health professional.

6. Elderly abuse. The Long-Term Homes Act, Retirement Homes Act, and Residential Homes Act require mandatory reporting of all suspected physical, sexual, emotional, verbal, and financial abuse of a resident. 

7. Missing person. If the police present an Order or a Search Warrant from a judge or justice of the peace or an Urgent Demand in writing, a therapist is required to provide file information/records in order to assist with locating that missing person.

8. Audit. Audit by the College of Psychologists and Behaviour Analysts of Ontario (audits are done by psychologists who are bound to confidentiality).

9. Case consultations (without names given) with other mental health professionals at CITC.

10. Access to records by minors or guardians. If a child or their legal guardian requests access to their own records, we may disclose only what is necessary, share it securely, and inform any affected individuals if required.

In certain cases, clients may choose not to provide us with some or all of their personal information. However, should they choose not to provide necessary personal information to us, that may impact their ability to interact with us or for us to provide them with certain services.

Clients may withdraw their consent at any time in writing. Please contact our Privacy and Information Officer listed below to find out how.

12. Consent for Minors

CITC provides services to children and youth. The ability of a minor to consent to the collection, use, and disclosure of their personal health information depends on their capacity—not their age

If clients are 16 or older and capable of consenting, only they can consent to the collection, use or disclosure of their personal health information unless they have designated a substitute decision-maker.

Circumstances can be different if they are below the age of 16. Generally, their parent, a children’s aid society, or another person who is legally entitled to give consent on their behalf, will act as their substitute decision-maker. That person can consent to the collection, use or disclosure of their personal health information, except in certain circumstances.

For example, if they make a decision on their own about medical treatment, only they can consent to the collection, use or disclosure of personal health information relating to their treatment. This can empower them to receive medical treatment without their parents knowing about it.

If they are capable, they can also disagree with a decision made by their parent about the collection, use or disclosure of their personal health information. In such a case, it is their decision that matters – not their parents’ – allowing them to provide, withhold or withdraw consent to the collection, use or disclosure of their personal health information.

13. Privacy Breaches and Complaints

In the case that personal health information has been accessed, used, disclosed or disposed of in an unauthorized manner, CITC will comply with PHIPA requirements and work with the Information and Privacy Commissioner of Ontario in investigating and responding to the incident, including any reasonable request for information relating to the individual(s) affected in the incident.

For privacy concerns, clients may contact the CITC Privacy Officer:

Dr. Carolina McBride, C.Psych

CITC – Yonge & Eglinton Centre
20 Eglinton Ave. West, Suite 1007, P.O. Box 2019
Toronto, ON M1H 1S3
Phone: (416) 570-5050

If unresolved, clients may contact:

College of Psychologists and Behaviour Analysts of Ontario

110 Eglinton Ave. West, Suite 500, Toronto, ON M4R 1A3
Phone: (416) 961-8817
Email: cpbao@cpbao.ca
Website: https://cpbao.ca

Information and Privacy Commissioner of Ontario

Website: www.ipc.on.ca

Updated May 27, 2025

Disclaimer: This Privacy Information Policy is intended to provide clients and other stakeholders of the Cognitive & Interpersonal Therapy Centre (CITC) with a clear understanding of how personal and health information is collected, used, and protected. While every effort has been made to ensure that this policy reflects current legal and regulatory requirements, it is not a substitute for legal advice. Clients with specific concerns about their privacy rights or obligations under applicable legislation are encouraged to consult the Information and Privacy Commissioner of Ontario or seek independent legal counsel.