Privacy Policy

Effective date: October 16, 2026

Holistic Medical Clinic (“the Clinic”) is committed to protecting the privacy and security of the personal information and personal health information entrusted to us.

This policy explains how we collect, use, disclose, store and protect information in connection with patient care, clinic administration and our website. We follow Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and other applicable privacy laws.

Accountability

Peyman Cham, owner of Holistic Medical Clinic, is the Health Information Custodian responsible for personal health information within the Clinic’s custody or control, as required by PHIPA.

Peyman Cham is also the Clinic’s designated Contact Person and coordinates our privacy practices, responds to privacy questions and complaints, and handles requests for access to or correction of records. Staff, practitioners and contractors who handle personal health information on the Clinic’s behalf must comply with their applicable privacy obligations.

Information We Collect and Use

Depending on how you interact with us, we may collect:

  • Your name, date of birth and contact information
  • Emergency-contact or substitute decision-maker information
  • Medical history, symptoms, assessments, treatment plans and clinical notes
  • Referrals and reports from other health care providers
  • Appointment and communication records
  • Billing, payment, insurance and claim information
  • Information related to MVA, WSIB or other third-party benefit claims
  • Information submitted through our website, email, telephone or online-booking system
  • Website, cookie and advertising-measurement information described below

We collect only the information reasonably necessary to:

  • Assess, provide, document and coordinate care
  • Schedule appointments and communicate with you
  • Process payments, insurance claims and direct billing
  • Maintain clinical and financial records
  • Support patient safety and clinic operations
  • Meet legal, regulatory and professional obligations
  • Understand website use and measure advertising results, subject to applicable consent requirements

We do not sell or rent personal information.

Consent and Disclosure

We obtain consent to collect, use and disclose personal health information as required by law. Consent may be express or implied, depending on the circumstances.

We obtain express consent before disclosing personal health information to insurers, lawyers or other persons or organizations that are not health information custodians, or to another health information custodian for a purpose other than providing or assisting in providing health care, unless disclosure without express consent is permitted or required by law. Express consent may be given verbally or in writing, as appropriate.

You may withdraw or limit your consent by contacting us. This cannot apply retroactively and may affect our ability to provide or coordinate certain services. If a patient cannot provide consent, an authorized substitute decision-maker may act on their behalf.

We may disclose information:

  • To health care providers involved in your care, subject to applicable consent requirements
  • To insurers, WSIB, auto insurers, lawyers or other payors with express consent or other applicable legal authority
  • To service providers supporting records, scheduling, billing, communications or clinic operations, as authorized by law
  • When permitted or required by law
  • To reduce a serious risk of harm where legally permitted
  • As otherwise authorized by you

We limit disclosure to the information reasonably necessary for the applicable purpose. Staff, practitioners, contractors and service providers may only access information needed for their authorized responsibilities.

Electronic Records and Service Providers

We use Jane for clinical records, scheduling, billing and certain patient communications. Jane provides security features such as encryption, access controls, activity monitoring and audited infrastructure.

Jane and other service providers may access information only as needed to provide authorized services, address technical issues or comply with the law.

For more information about Jane, visit Jane’s Security and Reliability page and Jane’s Privacy Notice.

Email Telephone and Text Communications

We may use your email address or telephone number for appointment reminders, schedule changes, billing, administration and follow-up related to your care.

Ordinary email, text messaging and website forms may not be fully secure. Please do not use them for emergencies, urgent concerns or highly sensitive medical information. Contact the Clinic by telephone when more secure or timely communication is needed.

Website Cookies and Analytics

We use Google Analytics, Google Ads and Google Tag Manager to understand website use and measure advertising results, including completed online bookings. Our advertising and analytics reports do not display patient names.

These services use cookies and similar technologies to collect technical and interaction information, such as IP addresses, device and browser details, pages visited, cookie identifiers and booking-completion events. Google processes this information for analytics and advertising measurement. Learn more about Google’s use of this information.

We obtain consent for non-essential analytics and advertising technologies where required by law. You can manage your cookie preferences through our website’s consent controls or your browser settings.

Security and Record Retention

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information. These include access controls, password protection, authentication, encryption, confidentiality requirements, secure systems, physical security and secure record disposal.

No electronic system can be guaranteed to be completely secure.

In accordance with the College of Physiotherapists of Ontario’s documentation requirements, we retain physiotherapy clinical and financial records for a minimum of 10 years, calculated from whichever of these dates is later:

  • The patient’s last encounter with the Clinic
  • The patient’s 18th birthday, or the date on which they would have turned 18

Records for other services are retained according to applicable laws and professional requirements. Records are securely destroyed or permanently deleted when the required retention period has ended and they are no longer needed.

Accessing or Correcting Your Records

You may request access to or correction of your personal health information by contacting our Contact Person.

We may ask for a written request and proof of identity. A reasonable fee may apply where permitted by law. Access or correction may be limited or refused where permitted or required by PHIPA. If this happens, we will explain the decision as required by law.

Privacy Breaches and Business Changes

If information is lost, stolen, accessed, used or disclosed without authorization, we will investigate, contain the incident and take reasonable steps to reduce the risk of recurrence.

Where notification is required under PHIPA, we will notify affected individuals at the first reasonable opportunity. We will also notify the Commissioner and any applicable regulatory college when required by law.

If the Clinic closes, relocates or changes ownership, records may be transferred to a legally authorized successor or custodian in accordance with applicable law and confidentiality requirements.

Privacy Questions and Complaints

Please contact our Contact Person if you have a question, access or correction request, or concern about our privacy practices. Raising a concern will not affect your entitlement to appropriate care.

Health Information Custodian and Contact Person: Peyman Cham

Email: info@holisticmedclinic.ca

Phone: (647) 350-6655

Address: 1425 Dundas St. East, Unit 4, Mississauga, ON L4X 2W4

If we are unable to resolve your privacy concern to your satisfaction, you may contact the Information and Privacy Commissioner of Ontario:

Information and Privacy Commissioner of Ontario

2 Bloor Street East, Suite 1400

Toronto, ON M4W 1A8

Toronto area: 416-326-3333

Toll-free: 1-800-387-0073

Website: www.ipc.on.ca

Updates to This Policy

We may update this policy when our practices, services, technology or legal obligations change. The effective date above identifies the latest version.