Privacy Policy

Luceris Psychotherapy Clinic – Based in Ontario

Effective Date: December 2024 | Last Updated: June 2026

This Privacy Policy governs the manner in which Luceris collects, uses, maintains and discloses information collected from users (each, a “user”) of the https://lucerisclinic.ca website (“Site”).

Who We Are and Our Legal Role

Luceris is a psychotherapy practice founded and operated in Ontario, Canada. Under Ontario’s Personal Health Information Protection Act (PHIPA, 2004), we are considered a Health Information Custodian (HIC), meaning we are legally responsible for the personal health information you share with us.

Clinic Name: Luceris Psychotherapy Clinic

Privacy Officer: Francesco Addesi, Registered Psychotherapist 

Location: Richmond Hill, Ontario (virtual services offered province-wide)

Contact: contact@lucerisclinic.ca

Regulatory Body: College of Registered Psychotherapists of Ontario (CRPO) and Member, Canadian Counselling and Psychotherapy Association (CCPA)

Governing Laws

This policy is designed to comply with the following legislation and regulatory frameworks:

Ontario: PHIPA (Primary Law)

The Personal Health Information Protection Act (S.O. 2004, c. 3) is Ontario’s health-sector privacy law and governs how all personal health information is collected, used, and disclosed. PHIPA has been deemed ‘substantially similar’ to Canada’s federal privacy law (PIPEDA), meaning compliance with PHIPA satisfies federal obligations for health records in Ontario.

Federal: PIPEDA

The Personal Information Protection and Electronic Documents Act applies to non-health personal data collected through our website and administrative processes (e.g., newsletter subscriptions, contact form submissions). Where PIPEDA and PHIPA overlap on health records, PHIPA takes precedence in Ontario.

Regulated Health Professions Act (RHPA), Ontario

The practice of psychotherapy in Ontario is governed by the RHPA. All identifiable information collected in the course of providing psychotherapy services is classified as personal health information under PHIPA, including your name, contact details, and all clinical records.

As of January 1, 2026: PHIPA Amendment

Under the More Convenient Care Act, 2025 (S.O. 2025, c. 7), an individual’s Digital Health Identifier (DHI) is now classified as personal health information. We will update our practices accordingly if Ontario Health’s digital health services become part of our service delivery.

Personal identification information

We may collect personal identification information from Users in a variety of ways, including, but not limited to, when Users visit our site, register on the site, respond to a survey, and in connection with other activities, psychotherapy services, features or resources we make available on our Site. Users may be asked for, as appropriate, name, email address, mailing address, phone number. We will collect personal identification information from Users only if they voluntarily submit such information to us. Users can always refuse to supply personal identification information, except that it may prevent them from engaging in certain Site related activities.

As defined under PHIPA, PHI includes any identifying information related to your physical or mental health. We may collect:

  • Your name, date of birth, and contact information
  • Reason for seeking therapy and presenting concerns
  • Session notes, treatment plans, and clinical progress records
  • Insurance or benefits information (if applicable)
  • Emergency contact information
  • Information about other health providers involved in your care

Non-personal identification information

Luceris may collect non-personal identification information about Users whenever they interact with our Site. Non-personal identification information may include the browser name, the type of computer and technical information about Users means of connection to our Site, such as the IP address and browser data (via website analytics), the Internet service providers utilized and other similar information and payment information processed securely through Jane App’s PCI-DSS compliant payment system; we do not store card numbers.

Web browser cookies

Our Site may use “cookies” to enhance User experience. User’s web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. Users may choose to set their web browser to refuse cookies, or to alert you when cookies are being sent. If they do so, note that some parts of the Site may not function properly.

Contact Form and Newsletter

If you submit an inquiry through our contact form or subscribe to our newsletter, your name and email address are collected for the sole purpose of responding to your inquiry or sending you relevant mental health resources and clinic updates. This is non-health personal information governed by PIPEDA.

We may use an email marketing platform for the newsletter. You may unsubscribe at any time using the link included in every email as compliant with the Canada Anti-Spam Legislation (CASL). We will never sell or share your contact information with third parties for marketing purposes.

How we use collected information

Luceris may collect and use Users personal information for the following purposes:

  • To run and operate our site: we may need your information to display content on the Site correctly.
  • To personalize user experience: we may use information in the aggregate to understand how our Users as a group use the services and resources provided on our Site.
  • To send periodic emails: we may use the email address to send User information and updates pertaining to their order. It may also be used to respond to their inquiries, questions, and/or other requests.
  • To book, manage, and document psychotherapy appointments; communicate about care; process billing and insurance claims (where applicable); and improve the quality of our services.

How we protect your information

We implement physical, organizational, and technological safeguards to protect your PHI, consistent with the 10 Fair Information Principles under the CSA Model Code (CAN/CSA-Q830-96) incorporated into PHIPA:

  • Electronic records are stored within Jane App’s encrypted, Canadian-based servers
  • Access to client records is restricted to authorized clinical personnel only
  • Passwords and two-factor authentication protect our clinical software accounts
  • Paper records, if any, are stored in locked, restricted areas
  • All staff or future associates are bound by confidentiality agreements and independent PHIPA obligations

As of January 1, 2024, the Information and Privacy Commissioner of Ontario (IPC) has the authority to impose administrative monetary penalties of up to $500,000 per organization for PHIPA violations. We take this responsibility seriously.

Sharing your personal information

We do not sell, trade, or rent Users personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above.

Consent

Your consent is the foundation of how we handle your information. In Ontario, consent under PHIPA must be:

  • Knowledgeable: you are informed of the purpose before consenting
  • Voluntary: you are never pressured or coerced
  • Related to the stated purpose: consent is not a blanket authorization

Express consent (written) is required for the collection, use, or disclosure of personal health information for any purpose beyond your direct care, including marketing communications and email newsletters. You may withdraw consent at any time by contacting us in writing. Withdrawal will not affect the quality of care you receive.

We Will Not Disclose Without Your Consent, Except:

Under PHIPA, your personal health information may be disclosed without your consent only in the following circumstances:

  • Risk of Harm to Self: if your therapist has reasonable grounds to believe you are at imminent risk of suicide or serious physical harm to yourself
  • Risk of Harm to Others: if there is an imminent risk of serious physical injury to another person, and disclosure would reduce or eliminate that risk
  • Child Abuse or Neglect: if there are reasonable grounds to suspect a child under 16 is at risk of abuse or neglect (mandatory reporting under the Child, Youth and Family Services Act)
  • Sexual Abuse by a Health Professional: if your therapist has reasonable grounds to believe a regulated health professional has sexually abused a client
  • Legal Order or Statute: if disclosure is required by a court order or permitted under applicable law
  • CRPO Audit: the College of Registered Psychotherapists of Ontario may access records as part of a regulatory audit; all participants are legally bound to maintain confidentiality

We will inform you of any required disclosure wherever legally permitted to do so.

Third-Party Service Providers

We work with the following service providers, each bound by their own privacy obligations consistent with Canadian law:

  • Jane App (Jane Software Inc.): EHR, booking, virtual sessions, PHIPA & PIPEDA compliant, Canadian servers
  • Stripe (via Jane App): Payment processing; PCI-DSS compliant
  • MailChimp/Jane App: Newsletter distribution
  • Google Analytics and Google Search Console: Aggregated, anonymized traffic data

We do not sell, rent, or trade your personal information to any third party. Service providers are permitted to use your information only to deliver the services contracted.

Jane App – Our PHIPA-Compliant Platform

All clinical booking, charting, virtual sessions, and communications are managed through Jane App (Jane Software Inc.), an electronic health record and virtual care platform with privacy compliance for clinics in Ontario.

Jane App’s Compliance Status

  • Fully compliant with PHIPA and PIPEDA
  • End-to-end encrypted video sessions. No session content is recorded or stored unless explicitly arranged
  • Data is stored on Canadian servers
  • Jane App is classified as our agent under PHIPA Section 17; they act on our instruction and do not use your information for their own purposes
  • PCI-DSS compliant payment processing built on Stripe

Jane App acts strictly as a technology service provider. Luceris remains the Health Information Custodian; we determine what is collected, how it is used, and how long it is retained. Jane App does not have independent access rights to your clinical information.

You may access Jane App’s Privacy Policy directly at: jane.app/legal/privacy-policy

Virtual Sessions: Technology and Confidentiality

Virtual psychotherapy sessions are conducted through Jane App’s encrypted video platform. To protect your confidentiality during online sessions:

  • Sessions are conducted over a secure, end-to-end encrypted connection
  • No session is recorded without your prior written consent
  • You are encouraged to attend sessions in a private space using a personal device
  • Use of headphones is recommended to protect your confidentiality in shared spaces
  • Our therapist(s) conducts sessions from a private, secure environment

Our videoconferencing platform is PIPEDA-compliant with servers located in Canada, as required by the Canadian Counselling and Psychotherapy Association (CCPA) standards for inter-provincial virtual practice.

Confidentiality

Confidentiality is respected at all times. No information will be communicated, directly or indirectly to a third party without your written informed consent. Although unlikely, the following conditions are legal obligations to break confidentiality:

  1. Inform a potential victim of violence of the client’s intention to harm them
  2. Inform an appropriate health professional of a client’s intention to end his/her life
  3. Release a client’s file if mandated to do so by a court of law
  4. Inform Children’s Aid Society if a client discloses that a child is being abused or is at risk of abuse
  5. Report a health professional who has abused a client or patient to their regulatory college

Retention of Records

Clinical records are retained in accordance with Ontario regulations for psychotherapy:

  • A minimum of 10 years from the date of last contact with an adult client
  • For minor clients: records are retained until the individual turns 18, plus a minimum of 10 years
  • After the retention period, records are securely destroyed

Records are retained only as long as necessary to fulfill the purposes for which they were collected and to meet our legal obligations.

Your Rights Under PHIPA

As a client, you have the right to:

  • Access your personal health information held by Luceris Psychotherapy Clinic
  • Request corrections to inaccurate or incomplete records
  • Withdraw consent for the use or disclosure of your PHI at any time (subject to legal and professional obligations)
  • Be informed of the existence, use, and disclosure of your PHI
  • Lodge a complaint with the Information and Privacy Commissioner of Ontario

If we decline to correct a record, you will be notified in writing. You have the right to submit a statement of disagreement, which will be attached to your record and released whenever that information is disclosed.

To exercise any of these rights, please contact our Privacy Officer in writing at: contact@lucerisclinic.ca

Changes to this privacy policy

Luceris has the discretion to update this privacy policy at any time. If and when Luceris expands to offer in-person services at a physical location in Ontario, this Privacy Policy will be updated accordingly. All the same PHIPA protections will apply. When we do, we will post a notification on the main page of our Site. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications.

Privacy Breaches

In the event of a privacy breach involving your personal health information, Luceris will:

  • Take immediate steps to contain the breach
  • Assess the nature, scope, and risk of harm
  • Notify you as soon as reasonably possible if there is a real risk of significant harm
  • Notify the Information and Privacy Commissioner of Ontario where required
  • Document and review the breach to prevent recurrence

Your acceptance of these terms

By using this Site, you signify your acceptance of this policy. If you do not agree to this policy, please do not use our Site. Your continued use of the Site following the posting of changes to this policy will be deemed your acceptance of those changes.

Contacting us

If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please send us an email to contact@lucerisclinic.ca.

Share this: