Skip to content
    Canada Therapy & Wellness
    Sign in

    PHIPA and PIPEDA

    Privacy policy

    What we collect, who sees it, how long we keep it, and what you can ask us to do with it. Written to the standard PHIPA and PIPEDA set, in language you should not need a lawyer to read.

    The short version

    • We do not sell or trade your information, ever.
    • Nothing goes to anyone outside Canada Therapy & Wellness without your written consent, except where the law requires it.
    • You can see your record, ask us to correct it, and be told who has seen it.
    • Clinical records are kept for ten years, then securely destroyed.
    • A site account is needed to use the products. It holds study and subscription data, never clinical records. You can download it or delete it yourself.
    • Olive Grove never sends clinical content. Its subscription check sends a licence id, a scrambled computer identifier and the app version.
    • We count visits to this site and the CRPO Exam Lab without cookies: the page, the site you came from, your device type and country. Your IP address and browser details are not stored; they are only mixed into a code that changes every day, so a visit is counted once and you cannot be followed from day to day. Counts are kept in Canada for 13 months. Browsers set to Global Privacy Control or Do Not Track are not counted. When you arrive through a share link, its offer code and channel tag are counted with the visit and, if you subscribe, recorded with your subscription, so we know which offers work. Your browser also keeps where its first visit came from (the link’s tags and the site it came from, nothing else), and if you open an account within two days, that is recorded with the account, so we know where new members come from.
    • The retired self-help tools kept what you wrote in your own browser only. We never received it.
    • The site assistant keeps no record of your questions. They go to Anthropic only to write the answer.
    • You can complain to the Information and Privacy Commissioner without going through us.

    Effective 27 October 2026.

    Information collection and use

    Personal health information we collect

    • Contact information (name, email, phone number)
    • Health information relevant to your care
    • Session notes and treatment records
    • Insurance and billing information
    • Technical data from our secure platform

    How we use your information

    • To provide mental health services and treatment
    • To communicate about appointments and care
    • To process payments and insurance claims
    • To comply with legal and regulatory requirements
    • To improve our services (in anonymized form)

    Information sharing and disclosure

    We do not share your personal health information except in the following limited circumstances:

    • With your written consent: We may share information with other healthcare providers as authorized by you
    • Legal requirements: When required by law, court order, or regulatory bodies
    • Safety concerns: When there is imminent risk of harm to you or others
    • Business operations: With service providers who support our work (under strict confidentiality agreements)

    Data security and protection

    • End-to-end encryption for all communications
    • Secure, PHIPA/PIPEDA-compliant data storage
    • Regular security audits and updates
    • Access controls and staff training
    • Secure destruction of records when appropriate

    Your rights over your record

    Under PHIPA and PIPEDA the record is about you and you have standing rights over it. You can:

    • Ask to see it. Write to us and we will respond within 30 days. There is no charge for a first request.
    • Ask us to correct it. If something in the record is wrong, we correct it. If we disagree, we attach your statement of disagreement to the record and it travels with it.
    • Withdraw consent. You can withdraw consent to a particular disclosure at any time. It does not apply retroactively to what has already been sent, and a small set of disclosures required by law cannot be withdrawn.
    • Ask who has seen it. We will tell you what has been disclosed, to whom, and on what basis.

    Access can be refused in narrow circumstances the legislation sets out, mainly where release would create a risk of serious harm or would reveal another person's information. If we refuse, we tell you why in writing and we tell you how to challenge it.

    How long we keep records

    • Clinical records: ten years after your last session, or ten years after your eighteenth birthday if you were a minor at the time. This is the retention period the OCSWSSW and CRPO require and we do not shorten it on request.
    • Billing and insurance records: seven years, as required for tax purposes.
    • Enquiries, and referral requests received before that service ended on 27 October 2026: twelve months, then deleted.

    At the end of the retention period records are securely destroyed. Messages sent through the contact form and waiting-list sign-ups are stored with Supabase in a database hosted in Canada (Montreal, ca-central-1).

    Your site account

    Signing in, with Google or an email code, is needed for everything in the CRPO Exam Lab except its study library. It creates one account for the whole Canada Therapy & Wellness site, so your study progress is saved and follows you to any device. An account holds study and subscription data, not clinical records: client health information and session records are never stored in the site's account databases.

    • What is stored: your email address, your name (and picture, from Google), how you sign in, and when the account was created and last used; and the study data of the products you use. Today that is the CRPO Exam Lab: your exam date, daily study time and weekly target, attempts and scores, mock exams, card reviews, lesson progress, reading, milestones and the takeaways you write after a case; and for Olive Grove, your subscription and the computers you activate (below). Any product added later is described here before it keeps anything in your account.
    • Google: signing in with Google shares only your name, email address and profile picture with us. We ask for nothing else from your Google account.
    • Where: with Supabase, in a database hosted in Canada (Montreal). Your data is kept private and other users never see it.
    • How it is used: to run the products for you, such as planning your study sessions, showing your progress and keeping your devices in step. We also learn from how they are used, including study activity and progress, to improve them and your experience and to support you. It is never sold, never used for third-party advertising and never shared with advertisers.
    • Email updates: only if you say yes. Study tips, new features and the occasional special offer from Canada Therapy & Wellness. Turn them off at any time on your Account page or with the unsubscribe link in any email.
    • How long: for as long as you keep your account. When it is closed at your request, everything is removed from the database at once; routine backups then age out on their normal cycle.
    • Your controls: on your Account page you can download all your data as a file and sign out of every device. Signing out leaves nothing personal in the browser. To close your account and delete everything in it, email [email protected] from the address you sign in with: we close it, cancel any subscription and confirm by email.

    Questions about your account or your data: [email protected].

    Olive Grove subscriptions

    Olive Grove is Windows software for clinicians. Recordings, transcripts, notes and client records stay on the clinician's own computer. The app never sends clinical content to this site or anywhere else. A subscription adds only what is listed here.

    • What the app sends, and when: when you activate it on a computer, a scrambled identifier of that computer (a one-way hash: it cannot be turned back into anything about the machine), a name for the computer (its Windows computer name unless you change it; sent once, at activation), and the app version. After that, about every ten days while online, it sends its licence id, the same scrambled identifier and the app version, to renew its licence. Nothing else.
    • What this site stores: the email address and name of your site account; your plan, the subscription's status and its dates, as Stripe reports them; and for each computer you activate, the name you chose, the scrambled identifier, the app version, and when it was activated and last checked in. The code a computer shows while it waits for approval lasts ten minutes and is deleted within a day.
    • Payments: processed by Stripe. Your card details go to Stripe and never reach this site; we keep only the Stripe references that match a payment to your account. Stripe's own privacy policy (opens in a new tab) covers what it holds.
    • Where: in the same site account database, with Supabase in Montreal (Canada). You can read your own subscription, signed in; the site's server reads it only to run the subscription and renew licences.
    • Your controls: on your Olive Grove account page you can rename or deactivate a computer, update your card, and cancel. Your Olive Grove data is included when you download your account data, and deleting your site account deletes it and, within a day, cancels any subscription with Stripe.
    • How long: for as long as you keep your site account. A computer you deactivate stays in your account's history, marked as deactivated, until you delete the account.

    Self-help tools

    The self-help tools were retired on 17 October 2026. While they were offered, everything entered in them was saved in the visitor's own browser storage, on their device, and none of it was sent to us or to anyone else, so we never collected, held or saw it.

    Entries made then are still in that browser until they are erased. The self-help page now lets you download them in readable form (opening the passcode lock first, if you set one) or erase them. Clearing your browser’s site data also removes them. The installed app removes itself the next time it opens. Your self-help entries

    Read-aloud

    Read-aloud (the Listen buttons) uses your browser's built-in speech: the site sends nothing anywhere to make it work, and your speed and voice are kept only in this browser. A voice marked “online” in the voice list is produced by your browser maker's own service; choose any other voice to keep speech on your device.

    The site assistant

    The Canada Therapy Guide (“Ask the Guide”) on this site and in the CRPO Exam Lab is an AI that answers questions about the site, the exam labs and Olive Grove, and can explain the page you are on. It is not therapy, it is not monitored by a person, and it is not for emergencies: in crisis, call or text 9-8-8, or call 911.

    We keep no record of what you ask. Your conversation is held only in this browser tab and is cleared when the tab closes or when you start a new conversation. To write each answer, your question, the conversation so far in that tab, the address of the page you are on and, unless you untick “Use this page”, the text shown on that page are sent to Anthropic, the company that makes the AI model, which processes them in the United States. The text of account pages, of the self-help pages and of a mock exam in progress is never sent. Under its commercial terms Anthropic does not use them to train its models and deletes them within 30 days. Our server logs only the size of each answer, never its content.

    If you use the guide's Feedback tab, or let it send a report it drafted for you, we store what you send, the page, your email only if you add it, your browser description and a random id made in your browser, as described for exam lab feedback below.

    Please do not type health details, names or other personal information into the assistant. For anything else, write to [email protected]. If you need personal support, contact a registered therapist; in a crisis, call or text 9-8-8, or call 911.

    CRPO Exam Lab: feedback and privacy

    Without an account, the CRPO Exam Lab at /crpo keeps study progress in your own browser and sends none of it to us; with one, it is kept as described above. When you choose to send feedback there, we store what you write, the page and question it is about, an optional rating, your email only if you add it for a reply, the site version, your browser description and a random id made in your browser. It is stored with Supabase in Canada and used only to improve the exam lab. To have it deleted, write to [email protected]. Read the exam lab's feedback and privacy page.

    Questions and complaints

    Questions and complaints go to the Privacy Officer, Canada Therapy & Wellness. Write to [email protected] with anything about your record, this policy, or how your information has been handled. We respond within 30 days.

    If you are not satisfied with our response, you can complain to the regulator directly, and you do not need our permission or involvement to do so:

    • Information and Privacy Commissioner of Ontario, for health information under PHIPA: 1-800-387-0073, or ipc.on.ca
    • Office of the Privacy Commissioner of Canada, for information under PIPEDA: 1-800-282-1376, or priv.gc.ca
    • Your clinician's college, the OCSWSSW or the CRPO, for anything about professional conduct.

    Effective 27 October 2026. We will post any change here and date it. Material changes affecting current clients are sent by email as well.