MARSHA CARE INC. — PRIVACY POLICY
Personal Information and Personal Health Information Protection Policy
Prepared in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the 10 Fair Information Principles of the Office of the Privacy Commissioner of Canada, harmonized with Ontario's Personal Health Information Protection Act, 2004 (PHIPA).
MARSHA Care Inc. — Psychotherapy & Mental Health Services, Ontario, Canada
Effective Date: August 1, 2026
Last Reviewed: August 1, 2026
Version 1.0
1. Introduction and Purpose
MARSHA Care Inc. ("MARSHA Care," "we," "us," or "our") is a psychotherapy and mental health service provider operating in Ontario, Canada. We are committed to protecting the privacy, confidentiality, and security of the personal information and personal health information entrusted to us by our clients, their families, and other individuals we interact with in the course of providing care.
This Privacy Policy explains how MARSHA Care collects, uses, discloses, retains, and safeguards personal information, and describes the rights individuals have with respect to their own information. It is written to meet the requirements of the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and is organized around the 10 Fair Information Principles established by the Office of the Privacy Commissioner of Canada ("OPC"). Because MARSHA Care provides health care services in Ontario, this Policy is also harmonized with Ontario's Personal Health Information Protection Act, 2004 ("PHIPA"), which governs the collection, use, and disclosure of personal health information by health information custodians in the province (see Section 2, Scope and Application).
This Policy applies to all personal information collected, used, or disclosed by MARSHA Care, including information gathered through our website, client intake forms, telehealth platforms, billing systems, and any other channel through which we interact with clients, prospective clients, referral sources, and business contacts.
2. Scope and Application
2.1 Who This Policy Covers
This Policy applies to MARSHA Care Inc., its owners, employees, contracted psychotherapists, clinical associates, administrative staff, and any third-party service providers who process personal information on our behalf.
2.2 Interaction Between PIPEDA and PHIPA
MARSHA Care is a "health information custodian" as defined under PHIPA in respect of the personal health information it collects, uses, and discloses in the course of providing psychotherapy and mental health services in Ontario. Where PHIPA applies to personal health information, its provisions govern and take precedence over PIPEDA in respect of that information, as PHIPA has been declared substantially similar to PIPEDA for health information custodians in Ontario. For all other personal information collected by MARSHA Care that falls outside the scope of PHIPA (for example, information collected from website visitors, job applicants, vendors, or in the course of commercial activities unrelated to the direct provision of health care), PIPEDA applies directly.
MARSHA Care has designed this Policy so that our practices meet or exceed the standards required under both statutes. Throughout this document, we identify how each practice aligns with the 10 Fair Information Principles under PIPEDA, which are also reflected in the information practices required under PHIPA.
2.3 Information Covered
This Policy covers "personal information" (information about an identifiable individual) and, more specifically, "personal health information" (identifying information relating to an individual's physical or mental health, health history, care, and payment for care) collected or generated in connection with our services.
3. Definitions
Personal Information — Any information about an identifiable individual, including but not limited to name, contact details, date of birth, and financial information.
Personal Health Information (PHI) — Identifying information about an individual that relates to their physical or mental health, family health history, the provision of health care, or payment for health care, as defined under PHIPA.
Health Information Custodian — A person or organization that has custody or control of personal health information as a result of providing health care, as defined under PHIPA. MARSHA Care and its clinicians act in this capacity.
Consent — A voluntary agreement, which may be express or implied, given by an individual (or their substitute decision-maker) authorizing the collection, use, or disclosure of their personal information.
Contact Person / Privacy Officer — The individual at MARSHA Care designated under PHIPA section 15 as the contact person, and who also serves as our Privacy Officer for PIPEDA purposes, accountable for compliance with this Policy and applicable privacy legislation.
Disclosure — The release of personal information to a person or organization other than the individual to whom the information relates.
Substitute Decision-Maker — A person legally authorized to make decisions on behalf of an individual who is incapable of consenting, as determined under Ontario law.
4. Our Commitment to the 10 Fair Information Principles
MARSHA Care structures its privacy practices around the 10 Fair Information Principles set out in Schedule 1 of PIPEDA. These principles form the foundation of our approach to handling personal information and personal health information, and each is addressed in the sections that follow:
Accountability
Identifying Purposes
Consent
Limiting Collection
Limiting Use, Disclosure, and Retention
Accuracy
Safeguards
Openness
Individual Access
Challenging Compliance
5. Principle 1 — Accountability
MARSHA Care is responsible for personal information and personal health information under its custody or control, including information transferred to third-party service providers for processing.
Contact Person / Privacy Officer: MARSHA Care has designated a Contact Person, as required under section 15 of PHIPA, who also serves as our Privacy Officer for PIPEDA purposes. This individual is accountable for the organization's compliance with this Policy, PIPEDA, and PHIPA. Their responsibilities include developing and maintaining privacy policies and procedures, training staff and contracted clinicians on privacy obligations, facilitating compliance with this Policy, responding to privacy inquiries, access and correction requests, and complaints, and overseeing compliance monitoring.
Implementing policies and practices to protect personal information and give effect to this Policy
Establishing procedures to receive and respond to complaints and inquiries
Training staff and communicating information about our policies and practices
Developing information to explain our policies and procedures
Ensuring third-party service providers offer a comparable level of protection while personal information is being processed on our behalf, through written agreements and due diligence
Contact Person / Privacy Officer contact details are provided in Section 17, Contact Us.
6. Principle 2 — Identifying Purposes (Collection of Information)
MARSHA Care identifies the purposes for which personal information is collected before or at the time of collection, whether through this Policy, our intake forms, informed consent documents, or verbal explanation at the start of the therapeutic relationship.
6.1 What We Collect
Depending on the nature of our relationship with an individual, MARSHA Care may collect the following categories of information:
Identifying information: full name, date of birth, address, phone number, email address, and emergency contact details
Clinical information: presenting concerns, mental health and medical history, diagnosis and treatment notes, session notes, treatment plans, risk assessments, and progress records
Billing and insurance information: extended health insurance details, payment card information, billing addresses, and receipts for reimbursement purposes
Referral information: information received from referring physicians, other health care providers, employee assistance programs (EAPs), or family members with the client's consent
Communication records: emails, secure messages, and telehealth session metadata exchanged with our practice
Website and online activity information: information submitted through online contact or booking forms, and information collected automatically through cookies and similar tracking technologies (see Section 6.3, Cookies and Online Tracking)
6.2 Why We Collect It
We collect personal information and personal health information for the following purposes:
To assess suitability for services and conduct intake
To provide psychotherapy, assessment, and mental health treatment services
To maintain accurate clinical records as required by regulatory colleges and Ontario law
To coordinate care with other health care providers, with consent
To process billing, insurance claims, and payments
To communicate with clients about appointments, billing, and administrative matters
To comply with legal, regulatory, and professional college obligations
To conduct internal quality assurance and, where applicable, anonymized aggregate reporting
To operate, measure, and improve our website and marketing, including advertising campaigns
If MARSHA Care wishes to use personal information for a new purpose not previously identified, we will seek the individual's consent before doing so, except where otherwise permitted or required by law.
6.3 Cookies and Online Tracking
Our website may use cookies, pixels (including social media advertising pixels), and similar tracking technologies to operate the site, measure traffic from our marketing campaigns (including paid social media campaigns), and understand how visitors interact with our content. This information is generally not linked to clinical records. Visitors can control or disable cookies through their browser settings; doing so may affect the functionality of certain website features. We do not use these technologies to collect personal health information.
7. Principle 3 — Consent
The knowledge and consent of the individual (or their substitute decision-maker) is required for the collection, use, or disclosure of personal information and personal health information, except where consent is not required by law, such as in circumstances involving risk of serious harm, statutory reporting obligations, or court order.
7.1 Forms of Consent
Express consent: obtained in writing or verbally for the collection, use, and disclosure of clinical records, coordination of care with other providers, and disclosure to insurers or third parties.
Implied consent: may be relied upon within the "circle of care" for the purpose of providing direct treatment, consistent with PHIPA, where an individual's conduct reasonably implies consent (for example, providing information necessary to schedule a follow-up appointment).
7.2 Withholding or Withdrawing Consent Within the Circle of Care ("Lock-Box" Instructions)
Under PHIPA, clients have the right to instruct MARSHA Care to withhold or withdraw consent to disclose their personal health information to other health care providers, including those otherwise permitted to rely on implied consent within the "circle of care." Where a client provides such an instruction ("lock-box" instruction), MARSHA Care will note the instruction on the client's file and will not disclose the specified information to the identified provider(s), except where disclosure is otherwise required or permitted by law without consent (for example, risk of serious harm, statutory reporting obligations, or court order). We will explain to the client, upon request, any reasonably foreseeable implications of withholding or withdrawing consent for their care.
7.3 Capacity and Substitute Decision-Makers
Where a client is a minor or is found to lack capacity to consent to the collection, use, or disclosure of their personal health information, MARSHA Care will obtain consent from an appropriate substitute decision-maker in accordance with Ontario law, including the Health Care Consent Act, 1996, where applicable.
7.4 Withdrawing Consent
Individuals may withdraw or vary their consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting the Contact Person / Privacy Officer. Withdrawing consent may limit or prevent MARSHA Care's ability to continue providing certain services, and we will explain the implications of withdrawal before it takes effect.
7.5 No Coercion of Consent
MARSHA Care will not, as a condition of providing a service, require an individual to consent to the collection, use, or disclosure of personal information beyond what is necessary to fulfill legitimate, identified purposes.
7.6 Consent for Marketing Communications
Where individuals sign up to receive newsletters, wellness tips, or other marketing communications from MARSHA Care (for example, through our website sign-up form), we rely on express consent given at the time of sign-up, in accordance with Canada's Anti-Spam Legislation (CASL). Every marketing communication will include a clear method to unsubscribe, and requests to unsubscribe will be processed promptly. Marketing communications are kept separate from, and do not affect, communications related to clinical care.
8. Principle 4 — Limiting Collection
MARSHA Care limits the collection of personal information to that which is necessary for the purposes identified in this Policy. We do not collect information indiscriminately, and we collect information only by fair and lawful means.
Clinical intake forms request only information relevant to assessment and treatment planning
Billing forms request only information necessary to process payment and insurance claims
We do not collect sensitive information, such as information about family members or third parties, beyond what is clinically relevant and appropriately consented to
Where information is collected indirectly (for example, from a referring physician or family member), we take reasonable steps to ensure the individual is aware of the collection and its purposes, and that appropriate consent has been obtained.
9. Principle 5 — Limiting Use, Disclosure, and Retention
Personal information is used or disclosed by MARSHA Care only for the purposes for which it was collected, unless the individual consents to an additional use or disclosure, or such use or disclosure is required or permitted by law.
9.1 Circumstances of Disclosure
MARSHA Care may disclose personal information and personal health information in the following circumstances:
To other health care providers involved in an individual's care, with consent or within the "circle of care" as permitted under PHIPA, and subject to any lock-box instruction under Section 7.2
To insurers, benefit providers, or employers for the purpose of processing claims, with the individual's consent
To regulatory colleges (such as the College of Registered Psychotherapists of Ontario, the Ontario College of Social Workers and Social Service Workers, or the College of Psychologists and Behaviour Analysts of Ontario) in connection with regulatory oversight or complaints
Where required by law, court order, subpoena, or statutory reporting obligation, including duty-to-report obligations under the Child, Youth and Family Services Act, 2017, and disclosures consistent with common law and professional college standards where there is a risk of serious bodily harm to the client or an identifiable third party
To a substitute decision-maker, where legally authorized to act on the individual's behalf
To third-party service providers who process information on our behalf (see Section 15, Third-Party Service Providers), under contractual confidentiality obligations
In the event of a business transition (such as a sale, merger, or transfer of the practice), subject to appropriate confidentiality protections
9.2 No Sale of Personal Information
MARSHA Care does not sell, rent, or trade personal information or personal health information to third parties for marketing or commercial purposes.
9.3 Retention
Personal information and personal health information are retained only as long as necessary to fulfill the purposes for which they were collected, or as required by law, regulatory college standards, or professional liability considerations. Clinical records are generally retained for a minimum of ten (10) years following the last date of service, or, in the case of a minor client, until ten (10) years after the client reaches the age of majority, consistent with applicable regulatory college retention standards. When no longer required, personal information is securely destroyed, erased, or anonymized in accordance with our Records Retention and Destruction Procedures.
10. Principle 6 — Accuracy
MARSHA Care takes reasonable steps to ensure that personal information and personal health information is as accurate, complete, and up-to-date as necessary for the purposes for which it is used
Clients are asked to confirm and update their contact and billing information at each intake and periodically thereafter
Clinical documentation is reviewed and finalized by the treating clinician in a timely manner following each session
Individuals may request corrections or amendments to their personal information, as described in Section 13, Individual Access Rights
MARSHA Care does not routinely update personal information unless necessary to fulfill the purposes for which it was collected, or upon request from the individual.
11. Principle 7 — Safeguards (Security of Information)
MARSHA Care protects personal information and personal health information with security safeguards appropriate to the sensitivity of the information. Given the highly sensitive nature of mental health records, we apply robust administrative, physical, and technical safeguards.
11.1 Administrative Safeguards
Confidentiality agreements and privacy training for all employees, contractors, and clinicians
Role-based access controls limiting access to personal health information to individuals who require it to perform their duties
Written policies governing the collection, use, disclosure, retention, and destruction of information
Regular privacy and security audits and staff training refreshers
11.2 Physical Safeguards
Locked filing cabinets and restricted-access areas for any physical records
Secure, access-controlled premises for in-person sessions and file storage
11.3 Technical Safeguards
Encryption of electronic personal health information at rest and in transit
Use of PHIPA/PIPEDA-compliant electronic medical record (EMR) and telehealth platforms with encrypted video and messaging, hosted in Canada where reasonably possible, or otherwise subject to appropriate contractual and technical safeguards where PHI may be processed or stored outside Canada (see Section 15, Third-Party Service Providers and Cross-Border Considerations)
Strong password policies, multi-factor authentication, and secure remote access protocols
Regular software updates, malware protection, and firewall protections
Audit logging of access to electronic clinical records
11.4 Breach Response
In the event of a privacy breach involving personal information, MARSHA Care will investigate promptly, take reasonable steps to contain and remediate the breach, and notify affected individuals and, where required, the Office of the Privacy Commissioner of Canada and/or the Information and Privacy Commissioner of Ontario, in accordance with applicable breach notification requirements under PIPEDA and PHIPA. Notification will include a description of the breach, the information involved, steps taken to mitigate harm, and steps individuals can take to protect themselves.
12. Principle 8 — Openness
MARSHA Care makes information about its privacy policies and practices readily available to clients and the public. This Policy is available on our website and will be provided to clients at intake, and upon request in an accessible format.
Individuals who wish to obtain more detailed information about our privacy practices, including the name and contact information of our Contact Person / Privacy Officer, the types of personal information we hold, and how it is used and disclosed, may contact us as described in Section 17, Contact Us.
13. Principle 9 — Individual Access (Patient Access Rights)
Upon written request, an individual has the right to be informed of the existence, use, and disclosure of their personal information and personal health information, and to be given access to that information, subject to limited exceptions permitted or required by law.
13.1 How to Request Access
Requests for access to personal information or a copy of one's clinical record should be made in writing to the Contact Person / Privacy Officer using the contact information in Section 17. MARSHA Care will respond to access requests within thirty (30) days, as required under PIPEDA, or within the timelines prescribed under PHIPA, whichever is applicable, and will explain any extension required for complex requests.
13.2 Reasonable Fees
MARSHA Care may charge a reasonable fee for copying and providing access to records, in accordance with PHIPA and applicable regulatory college guidance. Where a fee applies, an estimate will be provided in advance.
13.3 Limits on Access
In limited circumstances, access to personal health information may be refused or restricted where permitted or required by law, including where disclosure could reasonably be expected to result in a risk of serious harm to the treatment or recovery of the individual or to the safety of another person, or where the record is subject to legal privilege. Where access is refused in whole or in part, MARSHA Care will provide written reasons and inform the individual of avenues to challenge the decision.
13.4 Right to Request Correction
Individuals may request that MARSHA Care correct or amend inaccurate or incomplete personal information. Where we agree a correction is warranted, we will amend the record and, where reasonable, notify any third parties to whom the information was disclosed. Where we do not agree, we will note the individual's requested correction on the file so that it accompanies the record going forward.
14. Principle 10 — Challenging Compliance
Individuals have the right to challenge MARSHA Care's compliance with this Policy and applicable privacy legislation. All such challenges or complaints should be directed, in the first instance, to our Contact Person / Privacy Officer.
14.1 Our Internal Complaints Process
Submit your concern in writing to the Contact Person / Privacy Officer using the contact details in Section 17
The Contact Person / Privacy Officer will acknowledge receipt of your complaint within five (5) business days
MARSHA Care will investigate the concern and provide a written response, generally within thirty (30) days
If the complaint is substantiated, MARSHA Care will take appropriate corrective action and inform the individual of the outcome
14.2 External Recourse
If an individual is not satisfied with MARSHA Care's response, they may escalate their complaint to:
The Office of the Privacy Commissioner of Canada (for matters governed by PIPEDA): www.priv.gc.ca, 1-800-282-1376
The Information and Privacy Commissioner of Ontario (for matters governed by PHIPA): www.ipc.on.ca, 1-800-387-0073
The applicable regulatory college overseeing the treating clinician's professional conduct, where the concern relates to clinical practice
15. Third-Party Service Providers and Cross-Border Considerations
MARSHA Care may engage third-party service providers to support its operations, including electronic medical record (EMR) hosting, telehealth platforms, billing and payment processors, and IT support. Where personal information is shared with a service provider, MARSHA Care enters into contractual agreements requiring the provider to maintain confidentiality and security measures comparable to those described in this Policy, and to use the information solely for the purposes for which it was disclosed.
Where a service provider stores or processes personal information outside Canada, that information may become subject to the laws of the jurisdiction in which it is held, including lawful access by foreign authorities. [CONFIRM CURRENT HOSTING BEFORE PUBLISHING: state plainly whether our EMR, website platform, and email marketing platform store PHI or personal information outside Canada.] MARSHA Care takes reasonable steps to select service providers that offer strong privacy and security protections and, where reasonably possible, prioritizes Canadian-hosted infrastructure for personal health information.
16. Changes to This Policy
MARSHA Care reviews this Policy periodically to ensure it continues to reflect our current practices and legal obligations. We reserve the right to amend this Policy from time to time. Material changes will be communicated to clients through our website and, where appropriate, directly. The "Effective Date" and "Last Reviewed" date on this page indicate the currency of this Policy.
17. Contact Us — Privacy Inquiries and Requests
Questions, requests for access, complaints, or other inquiries regarding this Policy or MARSHA Care's privacy practices should be directed to our Contact Person / Privacy Officer:
Organization: MARSHA Care Inc.
Attention: Amber Sperling
Mailing Address: 80 Bradford St, West Wing 15, Barrie, ON
Phone: (877) 624-7469
Email: amber@marshacare.ca
Website: www.marshacare.ca
External Regulators
Office of the Privacy Commissioner of Canada — www.priv.gc.ca — 1-800-282-1376
Information and Privacy Commissioner of Ontario — www.ipc.on.ca — 1-800-387-0073