Privacy Policy

Who We Are:
Graceway Wellness (“we,” “our,” “the Clinic”) provides psychotherapy services in person at 700–1122 International Blvd, Burlington, ON, and online across Ontario.
Contact: info@gracewaywellness.com | (289) 204-4439

1. Scope & Legal Frameworks

This notice explains how we collect, use, disclose, and safeguard information when you visit gracewaywellness.com or receive services from us.

As an Ontario psychotherapy clinic, we are a Health Information Custodian (HIC) under Ontario’s Personal Health Information Protection Act (PHIPA) and follow the CRPO Professional Practice Standards for Registered Psychotherapists.

We also describe how we use Google Analytics on the website.

2. Definitions

Personal Health Information (PHI): identifying information about your health or health care (e.g., clinical notes, diagnoses, treatment plans, billing information).

Personal Information (PI): identifying information collected on our website (e.g., IP address, device data, contact form entries).

Agents/Service Providers: third parties acting on our behalf, such as Jane™ for booking and records.

3. What We Collect

A. When You Receive Care

Identification and contact details, health history, presenting concerns, session notes and treatment plans, appointment and billing records, correspondence, and consent forms. Collection is limited to what is necessary for assessment, treatment, and regulatory compliance.

B. When You Use Our Website

We collect essential data for site operation and security, and analytics data (Google Analytics 4) such as page views, device/browser type, and approximate location.

Google Analytics is configured not to collect personal identifiers and is used only to improve content and performance.

C. When You Book Online

Scheduling, charting, payments, receipts, and telehealth are provided through Jane™, a practice-management platform compliant with PHIPA and PIPEDA. Jane stores data in the Canadian data centre selected by the clinic.

4. Why We Collect and Use Information

• To deliver psychotherapy safely and effectively

• To maintain clinical, appointment, and financial records

• To manage operations and comply with CRPO and PHIPA requirements

• To operate and improve our website using Google Analytics

5. Consent

We obtain your informed consent for collection, use, and disclosure of PHI, except where PHIPA permits or requires otherwise.

You may withdraw consent at any time, subject to legal and clinical limits, with reasonable notice.

6. Disclosures

• With your consent (for example, to a physician or another provider)

• To service providers who support our operations (e.g., Jane), who are bound by confidentiality

• As required by law, such as court orders, mandatory reporting, or regulatory compliance

We do not sell your information.

7. Google Analytics

We use Google Analytics 4 (GA4) to understand aggregate site usage.

We do not send personal or health information to Google.

You can manage analytics preferences via our cookie banner or your browser settings.

8. Cookies

We use essential cookies for website operation and optional analytics cookies for performance insights.

You can accept or reject analytics cookies through the cookie banner or your browser.

9. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption, secure storage, and restricted access.

Jane implements encryption in transit and at rest, with data stored in Canada.

10. Record Retention & Secure Destruction

Records are retained for at least 10 years from the last contact for adults, or 10 years past the 18th birthday for minors, unless otherwise required.

After this period, records are securely deleted or destroyed.

11. Your Rights Under PHIPA

You have the right to access your records, request corrections, and obtain disclosure information.

If you are unsatisfied with our response, you may contact the Information and Privacy Commissioner of Ontario (IPC).

12. Breach Management & Notifications

If PHI is lost, stolen, or disclosed without authorization, we will notify affected individuals promptly and report to the IPC and relevant regulatory bodies as required.

13. Cross-Border Processing by Service Providers

Some services (such as SMS reminders or Google Analytics) may involve limited data processing outside Canada, such as in the United States.

In such cases, data may be subject to the laws of those jurisdictions.

We select vendors with strong security controls and share only what is necessary.

14. Children & Substitute Decision-Makers

Consent for minors or clients with substitute decision-makers is obtained from the appropriate party as defined by PHIPA.

Retention timelines follow CRPO standards for minors.

15. Email, Texting & Telehealth

Email and SMS are convenient but may carry privacy risks.

Avoid sharing sensitive clinical information by these methods.

SMS Consent & Terms

By clicking SUBMIT on forms that request your mobile number, you consent to receiving SMS messages from Graceway Wellness. Messages and data rates may apply. Message frequency will vary. Reply HELP to get more assistance. Reply STOP to opt-out of messaging.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Telehealth sessions occur through Jane's encrypted platform and are never recorded.

For emergencies, call 911 or go to your nearest emergency department.

16. AI-Assisted Documentation

With your explicit consent, we may use Jane's AI Charting feature to assist with the documentation of session notes. This tool uses artificial intelligence to help transcribe and summarize session content, supporting your therapist in maintaining accurate clinical records. AI-assisted documentation is a tool to support your therapist's work—it does not replace clinical judgment, and your therapist remains fully responsible for the accuracy and content of your records.

How It Works: When enabled, the AI scribe listens to the session in real-time and generates a draft summary that your therapist reviews, edits, and finalizes. No notes are saved to your file without your therapist's review and approval.

Your Consent: We will always request your verbal consent before activating AI-assisted documentation in any session. You may decline or withdraw consent at any time without affecting your care. If you prefer, you may request fully manual note-taking as an alternative—simply let your therapist know. If you withdraw consent, AI documentation will be discontinued for future sessions immediately.

Data Handling & Privacy: Audio is processed in real-time and is not retained after the session summary is generated, according to Jane's current practices. AI-generated drafts are reviewed and edited by your therapist before becoming part of your clinical record. Jane's AI Charting is designed to comply with PHIPA and PIPEDA requirements. Data processing occurs within Jane's secure infrastructure.

Your Rights: You may request to review any AI-assisted notes in your file. You may ask questions about how AI documentation was used in your care. You retain all rights under PHIPA regarding access, correction, and disclosure of your records.

17. Complaints & Questions

For privacy questions or complaints, contact info@gracewaywellness.com or call (289) 204-4439.

You may also contact the Information and Privacy Commissioner of Ontario for further assistance.

18. Changes to This Policy

We may update this policy to reflect legal or operational changes. The “Last updated” date above indicates the most recent revision.