Privacy Policy

How we collect, use, and protect your personal information.

Privacy Policy

Date of Last Amendment: January 30, 2022

1000251423 Ontario Inc. c.o.b. Elit Care (“Elit Care” “the Clinic,” “we,” “us,” “our”), located at 412 Front Street East, Toronto, ON M5A 0H8, provides therapeutic (physiotherapy, massage therapy, chiropractic) care.

Elit Care’s obligations with respect to the confidentiality of Patients’ Personal Health Information are governed by the Personal Health Information Protection Act (“PHIPA”), Ontario’s health-care-specific privacy legislation.

PHIPA governs how Personal Health Information is collected, used, and disclosed. This Privacy Policy explains how we collect, use, disclose, safeguard, and dispose of Personal Health Information in compliance with PHIPA.

“Custodians” are (1) organizations that provide healthcare, and (2) healthcare practitioners, including chiropractors, massage therapists, and physiotherapists. Elit Care and its therapists are Custodians. With some limited exceptions, only Custodians can collect, use, and disclose Patients’ Personal Health Information.

“Agents” are individuals or companies authorized by a Custodian to perform services or activities in respect of Personal Health Information on the Custodian’s behalf. Agents include administrative employees working for healthcare organizations.

“Electronic Service Providers” are companies that supply services that enable Custodians to collect, use, modify, disclose, retain, or dispose of Personal Health Information electronically (i.e., third-party IT providers). Electronic Service Providers are prohibited from using any Personal Health Information to which they have access in the course of providing services to Custodians, except as necessary in the course of providing services, and an Electronic Service Provider cannot disclose Personal Health Information. An Electronic Service Provider must ensure its employees and any other persons acting on its behalf comply with the Electronic Service Provider’s legal obligations to protect the privacy of Personal Health Information.

“Patients” are individuals who receive healthcare. In this Privacy Policy, Patients means individuals who receive therapeutic care at our Clinic.

“Users” are visitors to our Website. A User is not a Patient unless and until they receive therapeutic care at our Clinic. The limited information a User provides to us by way of our Website (name, email address, telephone number) is not Personal Health Information unless and until the User becomes an Elit Care Patient and a record (i.e., Patient File) is created for that Patient. At that point, because the Patient’s contact information would be included in the Patient File, it would be Personal Health Information.

“Personal Health Information” is “Identifying Information” about an individual if the information

  • Relates to the individual’s physical or mental condition, including family medical history.
  • Relates to the provision of health care to the individual.
  • Is a plan of service for the individual.
  • Relates to payments, or eligibility for, healthcare or for coverage for healthcare.
  • Is the individual’s health number.
  • Identifies a healthcare provider or a substitute decision-maker for the individual.

“Identifying Information” includes information that identifies a person or could be used, either alone or with other information, to identify a person.

For PHIPA purposes, “collect” and “use” have their commonly understood meanings

  • “Collect” is the gathering, acquiring, receiving, or obtaining of Personal Health Information by any means from any source.
  • “Use” means to handle or deal with (read, refer to, add to, consult with a Patient or another Elit Care therapist with respect to, etc.) Personal Health Information in the course, or for the purpose, of providing care or carrying out administrative tasks necessary to provide care (booking appointments, processing payments, etc.).

The Personal Health Information we collect and use includes everything in the Patient’s File: the Patient’s name, address, email address, and telephone number (i.e., contact information), as well as Elit Care therapists’ clinical notes, and any notes or correspondence from, for example, a Patient’s family or referring physician or a therapist who previously provided care.

Information related to how a Patient pays for care (e.g., credit card information) and appointment dates (both in the Patient File and the Clinic’s booking system) are also Personal Health Information.

We collect and use Personal Health Information to provide healthcare to Patients. We do not collect or use more Personal Health Information than is reasonably necessary to satisfy the purpose of the collection or use, i.e., to provide care.

We also use Patients’ contact information for general administrative purposes such as processing payments and contacting Patients to confirm or reschedule appointments or provide information beneficial to Patients such as healthcare tips and Clinic events they may benefit from attending. Patients can opt out of any email marketing material we may send them.

Our use of Personal Health Information includes the creation of Personal Health Information in the form of, for example, therapists’ clinical notes entered in a Patient File.

In limited circumstances, as permitted by PHIPA, we may use Personal Health Information without consent for the following purposes

  1. Planning or delivering programs or services.
  2. Risk management, error management, or activities to improve or maintain the quality of care or any related program or service.
  3. Educating Agents about their roles in support of the provision of healthcare.
  4. Obtaining payment or processing, monitoring, verifying, or reimbursing healthcare claims.
  5. Research, if specific requirements and conditions are met.
  6. If otherwise permitted or required by law.

The general rule is that a Custodian must obtain a Patient’s consent to collect, use, and disclose Personal Health Information, although PHIPA allows the collection, use, or disclosure without consent in some limited circumstances.

A Patient’s consent to the collection, use, or disclosure of Personal Health Information by a Custodian may be express or implied.

Express consent is consent that has been given explicitly (clearly and unmistakably), either verbally or in writing.

Implied consent is consent that a Custodian concludes has been given based on a Patient’s action or inaction in particular factual circumstances.

Example 1: If a Patient completes a questionnaire to facilitate consultation with a therapist about treatment, the therapist can infer consent to the Clinic’s collection and use of the Personal Health Information provided in the questionnaire.

Example 2: If a Patient proffers a credit card to pay for services, that implies consent to the disclosure of the information on the credit card (which is Personal Health Information) to the credit card payment processor.

All consent, whether express or implied, must be

  • Knowledgeable, which means the Patient knows why the Custodian collects, uses, and discloses their Personal Health Information, and that they may give or withhold this consent
  • Voluntary (not obtained through deception or coercion)
  • Related to the information in question, and
  • Given by the Patient him/herself (there are exceptions to this that do not normally arise in the context of the healthcare provided by Elit Care).

Express consent is always required when

  • Personal Health Information is disclosed to a person or an organization that is not a Custodian, such as an insurance company
  • Personal Health Information is disclosed by one Custodian to another Custodian for a purpose other than providing or assisting in providing healthcare.
  • A Custodian wishes to use Personal Health Information for fundraising, marketing, advertising, or research purposes.

Except as permitted by PHIPA and as disclosed in this Policy, Elit Care only collects, uses, and discloses Personal Health Information with the requisite Patient Consent.

In addition to our responsibility to obtain consent before collecting Personal Health Information, as a Custodian, Elit Care is required to

  1. Develop and implement practices that comply with PHIPA’s requirements, including taking reasonable steps to ensure that Personal Health Information is protected against theft, loss, and unauthorized use or disclosure, as well as against unauthorized copying, modification or disposal.
  2. Ensure that personal health information is as accurate, up-to-date, and as complete as is necessary for the purposes for which it is used.
  3. Ensure that Personal Health Information records (i.e., Patient Files) are retained, transferred, and disposed of in a secure manner.
  4. Retain Personal Health Information for as long as needed to allow a Patient to exhaust any legal recourse regarding an access request. (PHIPA does not establish specific retention periods for Personal Health Information.)
  5. Designate a contact person who is authorized to facilitate compliance with PHIPA, ensure Agents are appropriately informed of their PHIPA duties, respond to inquiries about the Custodian’s information practices, respond to access and correction requests, and receive complaints.
  6. Provide a written statement that is readily available to the public and describes the Custodian’s information practices, how to reach the contact person, how to obtain access to or request a correction of a record of Personal Health Information, and how to make a complaint to the Custodian and to the Information and Privacy Commissioner of Ontario.

This Privacy Policy is how Elit Care complies with no. 6. Elit Care complies with nos. 1 through 5 as outlined in this Policy. (Note, however, that Elit Care does not publicly disclose the methods and resources it uses to protect electronically-stored Personal Health Information from theft, loss, and unauthorized use (e.g., hacking) because doing so would undermine the security of the Personal Health Information.)

We use healthcare-standard administrative, electronic (HTTPS over TLS encryption), and physical security measures to prevent unauthorized access to your Personal Health Information.

We make all reasonable efforts to ensure that Personal Health Information is accurate, complete, and up to date. This includes that every appointment, and the treatment provided, is recorded in Patient Files. Care-related information relayed by Patients is recorded by therapists in Patient Files, as are test results, and therapists’ clinical observations, impressions, etc.

For purposes of accuracy, we may require Patients to confirm/update information from time to time. We are not responsible for the inaccuracy or incompleteness of information if a Patient fails to update us in a timely manner.

We retain Personal Health Information as required by PHIPA, i.e., for as long as a Patient remains a Patient of the Clinic and then for a period of time sufficient to ensure the information is available to be transferred to another clinic or the Patient’s physician. We will also retain Personal Health Information for as long as necessary to allow a Patient to exhaust any legal recourse regarding an access request or if the information may be required in a legal proceeding, as long as, in the latter case, we are advised of that possibility.

When we dispose of Personal Health Information, we do so in a way that prevents a privacy breach, i.e., by securely shredding paper files and completely and permanently deleting electronic records.

The Director is Elit Care’s Designated Contact Person authorized to facilitate compliance with PHIPA, ensure Agents are appropriately informed of their duties, respond to inquiries about the Clinic’s information practices, respond to access and correction requests, and receive complaints.

The Director may be contacted by email to admin@elit.care. (State “Personal & Confidential for the Director - PHIPA” in the subject line.)

Note that although Elit Care and individual therapists are all Custodians, the Clinic has overall and ultimate responsibility for PHIPA compliance. This has a number of consequences, of which the most relevant to Patients is that only the Clinic through the Director can disclose a Patient’s Personal Health Information to anyone, including the Patient and the Patient’s physician, not a Clinic therapist or Agent.

All requests for the disclosure of a Patient’s Personal Health Information must be made in writing (email) to the Director. All requests must include proof of the Patient’s consent to the disclosure. THERAPISTS ARE NOT AUTHORIZED TO DISCLOSE PERSONAL HEALTH INFORMATION, I.E., THE CONTENTS OF A PATIENT FILE, TO ANYONE, INCLUDING THE PATIENT.

Patients have the right to review the contents of their Patient Files and to request, in writing, that inaccurate or incomplete information is corrected.

The Clinic will correct Personal Health Information in a Patient’s file where the Patient demonstrates, to the satisfaction of the Director, that the Information is inaccurate or incomplete for the purposes for which the Clinic uses the information and the Patient provides the information necessary to correct the record.

The Clinic may refuse to correct Personal Health Information in a Patient’s file if, among other reasons, the particular piece of Information consists of a therapist’s professional opinion or an observation that the therapist made in good faith. If a correction is refused, the Director will inform the Patient of the refusal, the reasons for the refusal, the Patient’s right to file a complaint regarding the refusal to the Office of the Information and Privacy Commissioner, and the Patient’s right to attach a statement of disagreement to the Patient File.

Complaints that Elit Care’s collection, use, or disclosure of Personal Health Information is not PHIPA-compliant may be made in writing to the Director or the Office of the Information and Privacy Commissioner of Ontario, 2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8.

PHIPA permits Custodians to disclose Personal Health Information (1) with the Patient’s express consent, (2) on the basis of implied consent in certain circumstances, and (3) without consent in others.

Other than in extraordinary situations (see section M) or as described in this Policy, Elit Care does not and will not disclose Personal Health Information to anyone who is not an Elit Care therapist, Agent, or Electronic Service Provider. (Note that Elit Care does not disclose Personal Health Information to Electronic Service Providers. Rather, in order to maintain the security, etc. of the Clinic’s electronic Patient Files, incidental access to Personal Health Information by an Electronic Service Provider may be inevitable. Also note that Electronic Service Providers are legally bound by PHIPA’s confidentiality obligations.)

ALL REQUESTS FOR DISCLOSURE OF A PATIENT’S PERSONAL HEALTH INFORMATION MUST BE MADE IN WRITING TO THE DIRECTOR AT ADMIN@ELIT.CARE (STATE “PERSONAL & CONFIDENTIAL FOR THE DIRECTOR - PHIPA” IN THE SUBJECT LINE) BY THE PATIENT OR WITH THE PATIENT’S EXPRESS (EXPLICIT, NOTARIZED) WRITTEN CONSENT. Without the Patient’s consent, Elit Care will only disclose Personal Health Information if required or permitted to do so by law.

We do not disclose more Personal Health Information than is reasonably necessary to satisfy the purpose of the disclosure.

We do not sell Patients’ Personal Health Information.

Access to Personal Health Information is limited to Elit Care therapists and Agents (i.e., employees) who require it to (i) provide care, (ii) schedule, reschedule, or cancel appointments, (iii) administratively maintain Patient Files, (iv) process payments and operate our business, and (v) provide such other Patient support as may be appropriate. The Personal Health Information made available to employees is limited to what they need to do their jobs.

Other than in compliance with PHIPA and as detailed in this Policy, Elit Care does not disclose Personal Health Information to third parties.

Elit Care does not disclose Personal Health Information to Electronic Service Providers. However, in order to maintain the security, etc. of the Clinic’s systems and electronic Patient Files, incidental access to Personal Health Information by an Electronic Service Provider is often inevitable. Note that Electronic Service Providers are legally bound by PHIPA’s confidentiality obligations.

Disclosure of Personal Health Information without consent is permitted by PHIPA when a regulated health professional* believes disclosure is necessary to eliminate or reduce a significant risk of serious bodily harm to themselves or others. The following circumstances may warrant the disclosure of information to reduce or eliminate the risk of harm

  • There is a clear risk to an identifiable person or group of persons,
  • There is a risk of serious bodily harm or death, and
  • The danger is imminent.

* Elit Care therapists are regulated health professionals.

While we take industry-standard steps to secure Personal Health Information, no security measures are perfect or impenetrable, and no method of data storage or transmission can be guaranteed against any interception or other misuse. In particular, any information stored online is vulnerable to interception and misuse by unauthorized parties.

In the event of a data breach that poses a real risk of significant harm to Patients, we will take the following steps

  • Notify Patients of the breach if their Personal Health Information was or may have been accessed or affected.
  • If known, advise Patients of the specific Personal Health Information that was or may have been accessed or affected.
  • Advise Patients of steps they can take to reduce the risk of harm from the breach, e.g., changing passwords or monitoring accounts.
  • Advise Patients when the breach has been addressed, and the risk to data has abated.
  • Advise applicable government authorities of the breach if required to do so by law.

PHIPA empowers capable minors to consent to a Custodian’s collection, use, and disclosure of Personal Health Information, regardless of age. “Capable” in this context means the minor is able to understand information relevant to deciding whether or not to consent to the collection, use, or disclosure of their Personal Health Information, and to appreciate the reasonably foreseeable consequences of giving/not giving, withholding, or withdrawing their consent.

In the case of minors under the age of 16, a parent or other person who is lawfully entitled to give or refuse consent may also give, withhold, or withdraw consent. However, if there is a conflict between a capable minor under 16 years of age and the person entitled to act as the child’s substitute decision-maker, the decision of the capable child regarding giving, withholding, or withdrawing consent prevails.

Because the care Elit Care provides is not often a source of controversy or dispute between a minor and a parent or legal guardian, we only collect, use, and disclose Personal Health Information from and about minors with parental consent. Cases of minors requesting care and not wishing to provide parental consent will be considered on an individual basis.

Each time a User visits our Website or otherwise connects with us electronically, we collect information about the User’s preferences or device that is used to make our Website work as Users expect it to.

Examples of the information we collect or may collect include the date and time of a visit or connection, the User’s browser type, the User’s Internet Service Provider and IP address, the site the User visited before or after our Website (“navigation history,” “referring site”), and the pages on our site that were viewed. In isolation, a single piece of such information does not identify a User but, in some cases, it could be used in combination with other information to identify an individual user, particularly if the user provided us with contact information at the time of their visit or connection.

Website Users who are not Patients consent, by their continued use of our Website, to the collection of information that does not identify them (but could identify them if combined with other information). In no circumstances, however, would any of that identifying information relate to the User’s healthcare or state of health, i.e., it would not be Personal Health Information.

Website Users who are not Patients and who do not want us to collect or use information of any kind are instructed not to browse our Website. A Website User unable to find an acceptable alternative to one of our services and having no choice but to use our services, but who still does not wish to provide us with Personal Health Information, may contact the Director at admin@elit.care. (State “Personal & Confidential for the Director - PHIPA” in the subject line.) Note, however, we cannot provide care without collecting and using Personal Health Information, so to become a Patient of the Clinic, consent will be required.

Website Users who are also Patients cannot, by using our Website, provide us with Personal Health Information that they have not previously provided to us with consent.

In addition to using non-Personal Health Information to optimize our Website, we use this information for our internal security audit log, usage and trend analysis, system administration, and to gather aggregate demographic information about our Website User base for market identification and related purposes. We may share this information with Electronic Service Providers that provide services to us, including analysis, storage, and data aggregation/organization.

Cookies

Cookies are small text files that are placed on users’ computers by websites. They are widely used to allow websites to work properly and be more user-friendly, remember user preferences, improve user experience, and provide website owners with information they use for legitimate business purposes. A description of what cookies are and how they work can be found here.

We use cookies for all of the reasons listed.

Some cookies placed by our Website may be from Electronic Service Providers that provide us with analytics and other services. The information collected helps us understand how Users interact with our Website.

Google

We use the Google Analytics suite of tools. Google (Alphabet Inc.) uses cookies to help us better understand how our Website is being used including the number of users, session statistics (the pages visited, how long users stay on the site), approximate geolocation, and browser and device information.

In particular, we use Google Tag Manager, a Google Analytics tool, to manage tags. Marketing tags are segments of code on a website that track user actions and collect data. Specific actions on a website trigger tags to collect data about the activity and send it to an analytics tool. Different tags serve different functions: Pageview Tags monitor visits to pages on a website; Conversion Tags track, for example, each time a sale is made or a form is filled out.

We use the Google Search Console to obtain search-engine-related data to help us optimize traffic to our Website. Examples of search-engine-relate data include user queries and the number of times our site’s URLs appear in search results (impressions), along with post-click data about site engagement like bounce rates and e-commerce conversion rates.

Google Maps also uses cookies to help us understand the general geographic locales visitors to our Website are from (but not individual addresses or other personally identifying information).

Google policies require that no data be passed to Google that Google could use or recognize as personally identifying information. More information about Google’s policies is here.

Ad Services

We use Google Ads to highlight our Website when users use Google’s search engine. We do not disclose personally identifying information when we use Google Ads.

We do not now but in future may use Meta Ads to advertise on, for example, Facebook and Instagram. We may disclose aggregate, anonymous data about visits to our Website to Meta but we do not disclose personally identifying information.

Other Service Providers

In addition to Google, the following companies provide services to us:

  • Jane provides our booking portal and other electronic administrative services, including storing contact information that is Personal Health Information in the case of Patients.
  • Amazon Web Services (AWS) hosts our Website and email server.

We provide these service providers with Personal Health Information. Both are Electronic Service Providers. We acknowledge that we are ultimately responsible for the security of Personal Health Information provided to us. We are satisfied that these providers properly protect and lawfully use Personal Health Information in their possession. You can read each company’s privacy policy by clicking on their names.

Other User-Tracking Technologies

We do not now but in future may use web beacons (sometimes called trackers). Web beacons allow the owner of a website to count the number of users who click on an advertisement for its product or service on a third-party site (in order to assess the value of advertising on that third-party site). Web beacons collect only specific information, such as a cookie number, time and date of visit, and a description of the page on which the web beacon is installed. Personal information is not collected.

It is not possible to opt out of web beacons used on web pages. However, because web beacons are used together with cookies, their use can be limited by deleting cookies or changing your browser’s cookie settings.

Managing Cookies Settings

You can manage your cookies settings to clear or block specific cookies or all cookies. However, if you block all of the cookies that we use, it may affect your user experience or result in our Website becoming unusable. You can access your cookie settings via your browser settings. Please keep in mind that by clearing all cookies, all website preferences will be lost.

We amend this Privacy Policy from time to time. If the Date of Last Amendment is later than the last time you read it, please review this Policy again. Continued use of our website and/or the purchase of services from us constitutes your consent to the collection, use, and disclosure of your Personal Health Information in accordance with this Policy.