Privacy policy
This policy covers the training and education side of Ballast Wellbeing: enquiry forms, the certificate database, and email.
Looking for the counselling practice? Personal health information in the psychotherapy practice is governed differently, under Ontario's Personal Health Information Protection Act. That is covered by a separate clinical privacy notice.
Who we are
Ballast Wellbeing delivers mental health training and education to schools and workplaces in Ontario. For any privacy question, contact info@ballastwellbeing.com.
We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect, and why
Enquiry forms
When you submit an enquiry we collect your name, role, organization, email address, and optionally your phone number, along with the details you give us about your school or organization: type, size, sector, what you are interested in, your timeframe, and anything you add in the notes field.
We use it to reply to you, to prepare a proposal, and to keep a record of the enquiry. This is business contact information rather than personal information about your private life, and we treat it as such: it is not used for profiling and it is not enriched with data from anywhere else.
Email capture
If you subscribe to article updates we collect your email address and nothing else. Every message includes an unsubscribe link, and unsubscribing removes the address rather than flagging it.
Certificate verification
The database behind certificate verification holds, for each certificate issued: the serial number, the participant's name, the program title, the contact hours, the completion date, and where applicable an expiry date.
It exists so that an employer or school can confirm a certificate is genuine. Anyone with a serial number can look up that record, which is the point of it, and the reason serial numbers include a random component rather than running in sequence. Lookups are rate limited and we do not store the IP addresses that make them.
If you are a participant and you want your record removed, email info@ballastwellbeing.com and we will delete it. You do not need to give a reason. Your certificate will then no longer verify, so tell us if you may need it for professional development records first.
Analytics
We do not use analytics. There is no page-view tracking, no cookies, and no third-party script of any kind on any page of this site.
That includes the counselling pages under /counselling/, and the booking tool embedded on them. Fonts on this site are served from our own server rather than a third-party provider, so browsing does not disclose your visit to anyone else.
What we never do
- Sell, rent, or trade personal information
- Run advertising pixels, retargeting, or third-party marketing trackers
- Add you to a mailing list because you sent an enquiry. Those are separate consents
- Route counselling information through any of the systems described on this page
Where it is stored, and who processes it
Enquiry and certificate data is held in a Supabase Postgres database hosted in Canada, in the Montreal (ca-central-1) region, encrypted in transit and at rest.
| Processor | Purpose | Data location |
|---|---|---|
| Supabase | Enquiry and certificate database | Canada |
| Netlify | Website hosting and form processing | Global content delivery |
| Resend | Sending notification and autoresponder email | United States |
| Google Workspace | Our email inbox | Global |
Email inherently transits third-party infrastructure, some of it outside Canada, and is subject to the laws of the countries it passes through. If that is a concern for something you need to tell us, say so and we will arrange another way.
How long we keep it
| What | How long |
|---|---|
| Enquiries that did not lead to work | 24 months, then deleted |
| Engagement records and contracts | 7 years after the engagement ends, for tax and liability purposes |
| Certificate records | Indefinitely, so certificates remain verifiable, unless the participant asks for removal |
| Email subscribers | Until you unsubscribe |
| Verification rate-limit records | 1 hour |
Your rights
You can ask us to:
- Tell you what personal information we hold about you
- Give you a copy of it
- Correct anything inaccurate
- Delete it, subject to records we are legally required to keep
- Withdraw consent for anything you previously agreed to
Email info@ballastwellbeing.com. We will respond within 30 days. There is no charge.
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Privacy Commissioner of Canada.
Breaches
If personal information in our control is lost or accessed without authorisation and there is a real risk of significant harm, we will notify the affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will tell you what happened and what we are doing about it.
Changes
Last updated 2026. If we change this policy materially we will note the change here rather than quietly replacing the text.