Clinical privacy notice

Who is responsible for your information

Norman Rehman, Registered Psychotherapist (Qualifying), CRPO Registration No. 14804, is a health information custodian under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). That means I am personally accountable for the personal health information in this practice.

For any question about your information, contact info@ballastwellbeing.com.

What is collected, and why

I collect only what is needed to provide care and to meet the College's record-keeping requirements:

• Your name, contact details, and preferred contact method
• Confirmation that you are located in Ontario during sessions, which is a condition of practice
• What brought you to the practice, and the clinical notes made during our work
• Appointment dates, session lengths, fees charged, and payments received
• Correspondence between us

I do not collect information for marketing, and I do not sell, rent, or share information with advertisers under any circumstances.

How it is stored

Records are held in a practice management system built for Canadian healthcare, with data stored in Canada, encrypted in transit and at rest, and access protected by individual credentials. Paper notes, where any exist, are held in locked storage.

The pages of this website under /counselling/ carry no analytics, no tracking scripts, and no third-party marketing pixels of any kind, including inside the booking tool. Fonts are served from this site rather than a third-party provider, so visiting these pages does not disclose your visit to anyone else.

Who has access

• You. You can request access to your own record at any time.
• Me. As your treating practitioner.
• My clinical supervisor, a psychotherapist registered with the College of Registered Psychotherapists of Ontario, in the course of supervision. As a qualifying registrant I am required to practise under supervision, which means my clinical work is discussed. Your identifying information is minimised in those discussions, but your care is discussed. You should know this before you disclose anything, not after. Ask me at any point who my supervisor is and I will tell you.
• The practice management system's provider, as the processor holding the records under contract, bound to confidentiality and to Canadian data residency.

How long it is kept

Clinical records are retained for the period the College of Registered Psychotherapists of Ontario requires, which is at least ten years after our last contact, or for a client who was under 18, at least ten years after they turn 18. Records are securely destroyed at the end of that period.

When information may be disclosed without your consent

Ordinarily nothing leaves the practice without your written consent. The exceptions are the limits on confidentiality, which are the same list set out on the main counselling page:

• Discussion with my clinical supervisor, as described above
• Where I believe there is a risk of serious harm to you or to someone else
• Where I suspect a child under 16 is or may be in need of protection, which I am legally required to report
• Where I am required to report the sexual abuse of a client by a health professional to the relevant College
• Where a record is ordered by a court

Access to and correction of your record

Write to info@ballastwellbeing.com to request access to your record. I will respond within 30 days. In rare circumstances PHIPA permits access to be refused, in which case I will tell you why in writing and explain how to challenge that decision.

If you believe something in your record is inaccurate, you can ask for it to be corrected. Where a correction isn't appropriate, your statement of disagreement is attached to the record instead, so your position forms part of it.

Raising a privacy concern

Raise it with me first, at info@ballastwellbeing.com. I would rather hear about it directly and put it right.

You can also complain to the Information and Privacy Commissioner of Ontario, which oversees PHIPA, at any time and regardless of whether you have raised it with me. Concerns about my conduct as a registrant can be raised with the College of Registered Psychotherapists of Ontario.

Breach notification

If personal health information in my custody is stolen, lost, or accessed by someone who shouldn't have it, I am required to tell you at the first reasonable opportunity, and to report it to the Information and Privacy Commissioner of Ontario. I will tell you what happened, what information was involved, and what I am doing about it.