Statement of Information Practices

Privacy Policy & Confidentiality

Regulated under Ontario's PHIPA (2004) & CRPO Standards · Last updated November 2026

1. Health Information Custodianship & Accountability

Under Ontario's Personal Health Information Protection Act, 2004, Mavra Wasim, MA, HBSc, Registered Psychotherapist (Qualifying), operating as Mavra Psychotherapy, serves as the designated Health Information Custodian (HIC). As a HIC, Mavra Psychotherapy is legally and ethically responsible for establishing, maintaining, and monitoring comprehensive practices to protect your personal health information across its entire lifecycle: collection, use, secure storage, disclosure, and eventual destruction.

This policy applies to all current and prospective clients receiving services virtually across Ontario or in-person in Toronto, as well as visitors interacting with our website and consultation forms.

2. Information We Collect

We collect only the personal information and personal health information (PHI) reasonably necessary to assess your needs, deliver high-quality psychological care, and manage practice administration. This includes:

• Identifying & Contact Details: Your full name, email address, telephone number, emergency contact details, and billing address.
• Clinical & Health Information: Mental health history, presenting concerns, medical history, medications, relevant developmental background, clinical assessments, treatment plans, and continuous session progress notes.
• Administrative & Billing Records: Appointment dates and attendance history, payment methods, transaction receipts, and insurance billing documentation.
• Technical Website Data: Non-personally identifiable technical analytics (such as browser type and basic page interaction metrics) used solely to ensure the website functions reliably across devices. We do not sell, rent, or trade your browsing information or personal data to third parties.

3. How & Why Your Information Is Used

Your personal health information is collected and used strictly for legitimate healthcare and administrative purposes, which include:

• Direct Clinical Care: Evaluating your psychological wellness, co-designing tailored therapeutic treatment plans, tracking therapeutic progress, and providing evidence-informed psychotherapy.
• Clinical Supervision & Consultation: As a Registered Psychotherapist (Qualifying) with the CRPO, Mavra Wasim participates in regular clinical supervision with an approved clinical supervisor to ensure rigorous adherence to best clinical practices. During supervisory consultation, all identifying details (names, workplaces, identifying specifics) are masked or anonymized to strictly protect client identity. Clinical supervisors are themselves bound by identical professional confidentiality obligations under Ontario law.
• Administrative & Billing Communications: Scheduling consultations and appointments, sending session reminders, issuing official receipts for insurance reimbursement (e.g., Sun Life, Manulife, Green Shield, Canada Life, Medavie Blue Cross), and collecting session fees.
• Quality Improvement & Compliance: Satisfying mandatory quality assurance reviews and statutory documentation guidelines set out by the College of Registered Psychotherapists of Ontario.

4. Security Safeguards & Virtual Care Privacy

We deploy robust administrative, technical, and physical safeguards designed to prevent unauthorized access, loss, theft, modification, or inadvertent disclosure of your records:

• Electronic Health Record (EHR) Security: Clinical notes and client files are stored inside a dedicated, PIPEDA- and PHIPA-compliant electronic practice management platform. All digital records are encrypted at rest and in transit using bank-level 256-bit SSL encryption, protected behind two-factor authentication (2FA) and role-based access restrictions.
• Virtual Care Telehealth Platforms: Online therapy sessions are conducted via secure, encrypted telehealth video platforms that meet Canadian health privacy standards. Virtual sessions are never recorded, audiotaped, or archived by the clinic. Clients are encouraged to join virtual sessions from a private, enclosed space where they cannot be overheard.
• Device Security: Clinic hardware used for clinical and administrative tasks is encrypted, password-protected, equipped with modern anti-malware software, and never left unattended in unsecured areas.

5. Confidentiality & Legal Limits to Privacy in Ontario

Therapy is a sanctuary where you can speak candidly without fear of judgment or exposure. Everything you disclose in sessions and all clinical records are held in strict confidence. We will never share your information with family members, employers, partners, or third parties without your explicit, informed written consent.

However, under Ontario law and the ethical codes of the CRPO, there are very specific, narrow circumstances where a therapist is legally or ethically mandated to disclose confidential information, even without your consent. These mandatory exceptions include:

1. Imminent Risk of Serious Harm: If there is clear, imminent, and serious danger that a client intends to cause severe physical harm or end their own life, or intends to cause severe physical harm to an identifiable third party, the therapist has a legal duty to intervene to protect safety (which may involve notifying emergency services or the intended individual).
2. Child Protection: Under Section 125 of Ontario's Child, Youth and Family Services Act, 2017 (CYFSA), all regulated healthcare professionals have an immediate legal duty to report suspected abuse, neglect, physical harm, or sexual exploitation involving a person under 16 years of age (or a 16- or 17-year-old in specific circumstances) to a local Children's Aid Society (CAS).
3. Court Orders & Subpoenas: If a formal court order, legal warrant, or summons is issued by an Ontario or Canadian court of competent jurisdiction requiring the release of clinical records or testimony.
4. Regulatory College Inquiries: In the event of a formal investigation, professional conduct audit, or statutory review conducted by the College of Registered Psychotherapists of Ontario (CRPO) pursuant to the Regulated Health Professions Act, 1991.
5. Reporting Professional Misconduct: If a client reports that they have experienced sexual abuse or egregious misconduct by another regulated healthcare professional in Ontario, the therapist is legally mandated to report the incident to the appropriate regulatory college (without disclosing the client's name unless explicit consent is provided).

Should any of these rare situations arise, whenever legally and clinically safe to do so, we will discuss the disclosure with you transparently beforehand.

6. Record Retention & Secure Disposal (10-Year Rule)

In full compliance with CRPO Professional Practice Standards and Ontario healthcare regulations:

• Adult Records: Clinical records for adult clients must be securely retained for a minimum period of ten (10) years following the date of the last clinical appointment or contact.
• Minor Records: For clients who received services while under the age of 18, records must be retained for ten (10) years following the date the client reaches 18 years of age (i.e., until the client's 28th birthday).
• Secure Disposal: Following the expiration of the statutory retention period, all digital records are permanently wiped and cryptographically deleted, and any physical paper documents are shredded using cross-cut confidential destruction methods to prevent any possibility of reconstruction.

7. Website Forms, Cookies & Electronic Communications

When you use the consultation request form on this website, your name, contact details, and optional message are transmitted securely via encrypted HTTPS to our clinic inbox. Please note the following regarding digital communications:

• Not for Crisis Intervention: Website inquiry forms and general practice emails are monitored during regular business hours only. They are not intended for acute psychological emergencies. If you are experiencing thoughts of suicide or immediate crisis, please call or text 988 (Canada's Suicide Crisis Helpline) or dial 911 immediately.
• Email Privacy Considerations: While our clinic inbox and website forms utilize industry-standard encryption, traditional email is not guaranteed to be 100% confidential. We recommend limiting email correspondence to scheduling and administrative matters, reserving personal clinical reflections for live sessions.
• Website Cookies: Our website uses minimal, essential functional cookies necessary to ensure navigation, responsive layout, and form submission integrity. We do not use third-party behavioral advertising trackers.

8. Your Rights: Accessing & Correcting Your Records

Under Ontario's PHIPA, you have comprehensive rights regarding your personal health information:

• Right of Access: You have the right to review, inspect, or obtain a formal copy of your clinical health records. Requests must be made in writing. In accordance with PHIPA, we will respond to written requests within thirty (30) days. A modest administrative fee may apply to cover the actual costs of record reproduction.
• Right to Request Correction: If you believe a factual error exists in your record (such as an incorrect birthdate, billing address, or demographic detail), you may request a formal correction. Please note that clinical opinions and professional observations recorded in good faith by a psychotherapist cannot be erased, but you have the right to attach a statement of disagreement to your file.
• Withdrawing Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your information at any time, subject to legal and regulatory retention requirements.

9. Inquiries, Contact & Complaints (IPC Ontario)

If you have questions about our privacy practices, wish to review your records, or wish to discuss how your information is handled, please contact our Privacy Officer directly:

If your privacy concerns are not resolved to your satisfaction, or if you believe your health privacy rights under Ontario law have been compromised, you have the statutory right to contact the Information and Privacy Commissioner of Ontario (IPC):