Mindful Fitness is a free 16-week trauma recovery program delivered online or in person by Registered Nurse Psychotherapists at Becoming Institute Inc. It is open to adults 18 and older who live in our service area in Ontario. Because the program provides psychotherapy, information about your care is personal health information protected by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).
- What we collect: the contact and referral details you or a referring partner give us, and the health information our clinicians record when they provide your care.
- Why: to respond to your referral, provide safe care, and meet our legal and professional obligations.
- Who sees it: only the clinicians, supervisors, supervised trainees and staff who need it for their role, and service providers who work for us under written agreements.
- What we never do: we do not sell your information, use it for advertising, or send you marketing texts.
- Your rights: you can see your records, ask for corrections, limit or withdraw consent, and complain to us or to the Information and Privacy Commissioner of Ontario.
- Not for emergencies: our referral portals and care line are not monitored around the clock. Our care team contacts applicants within 3 business days. If you are in immediate danger, call 911 or go to your nearest emergency department.
1. Scope of this policy
This policy applies to personal information and personal health information collected through the Mindful Fitness program, including:
- the self-referral portal at selfrefer.becominginstitute.ca, where you create an account and complete a short referral form;
- the Partner Connect portal at partnerconnect.becominginstitute.ca, where community and professional health care partners create an account and submit referrals;
- program communications by email, telephone and text message, including our care line;
- individual psychotherapy sessions and group coaching sessions, delivered online or in person; and
- help connecting you with housing, income, health, safety and community supports.
Who the program serves. Mindful Fitness is open to adults 18 years of age or older who live in our service area: Peel Region, the Greater Toronto Area, Simcoe County, Durham Region and Halton Region. Services are delivered in English.
Becoming Institute’s education, admissions, employment and other non-clinical activities are covered by separate policies.
Terms we use
- Personal information means information about an identifiable individual, such as your name, email address or phone number.
- Personal health information means identifying information about your physical or mental health or the health care you receive, including referral, assessment and clinical records. It is governed by PHIPA.
- We, us, our means Becoming Institute Inc.
2. Who is responsible for your information
Becoming Institute Inc. is the health information custodian for personal health information collected and maintained through the Mindful Fitness program. This includes information in our clinical records system (Jane) and information submitted through our self-referral and partner referral portals. Our clinicians, supervisors, trainees and staff act as our agents when they handle this information; they are not separate custodians.
Our Privacy Officer, Joan Samuels-Dennis, President and Clinical Lead, is accountable for our compliance with this policy and with PHIPA, and handles access requests, correction requests and privacy complaints.
Privacy Officer
Joan Samuels-Dennis, President and Clinical Lead
Becoming Institute Inc.
Unit 2 – 80 Devon Road, Brampton, ON L6T 5B3
Email: privacy@becominginstitute.ca
Phone: (647) 265-0804
3. Information we collect
We collect only what we need to run the program and provide safe care.
| Category | Examples | When we collect it |
|---|---|---|
| Referral information | Name and preferred name, email, phone number, preferred contact method, availability, and what you tell us about your needs and safety | When you submit a self-referral, or when a partner refers you through our partner portal |
| Account information | Your email address, password (stored in encrypted form), account settings and sign-in activity. For referring partners: name, organization, role and work contact details | When you or a partner create an account on our self-referral or Partner Connect portal |
| Contact preferences | Whether you prefer email, phone call or text, and whether your phone accepts texts | At referral and whenever you update them |
| Program and administrative information | Scheduling, attendance and other administrative records about your participation | During the program |
| Personal health information | Intake assessments, clinical notes, treatment plans, and records of consent | When you receive clinical services |
| Communications | Emails, messages, call notes, text delivery status and opt-out records | When you contact us or we contact you |
| Technical information | IP address, browser type, device information and security logs | When you use our referral portals or join an online session |
Referrals from partners. Community and professional health care partners may create a Partner Connect account and refer you through that portal. No family doctor or clinical referral is required to take part. Partners should refer you only with your agreement and share only the information needed for the referral. When we receive a partner referral, we will contact you directly to confirm that you want to take part.
If you choose not to provide information. You do not have to answer every question. Some information, such as how to reach you safely and basic safety information, is needed to assess whether the program is right for you and to provide care safely. If we cannot provide care without certain information, we will explain why.
4. How we use information
We use your information to:
- receive, review and triage your self-referral and assign it to a member of our care team;
- contact you about next steps, scheduling and your care;
- assess your needs and provide individual psychotherapy and group coaching, online or in person;
- with your consent, connect you with housing, income, health, safety and community supports;
- confirm partner referrals and, with your consent, update the partner who referred you;
- support clinical supervision of trainees and clinicians, which is part of providing safe, high-quality care;
- send service-related emails and text messages you have chosen to receive;
- maintain clinical records required by PHIPA and our regulatory colleges;
- improve the quality and safety of the program, and prepare aggregated, de-identified reports for program planning and evaluation that do not identify you;
- keep our referral portals secure and working properly; and
- meet our legal and regulatory obligations.
Program evaluation and research. We evaluate the program to show whether it helps participants and to improve it. For this purpose, we use questionnaire results and program information only after removing details that identify you (de-identified information). Results may be shared in reports, presentations, funding applications or publications, but only in de-identified or aggregated form that does not identify any individual. We do not try to re-identify anyone.
We will not use information that identifies you for teaching, training outside your direct supervision, research or publication unless you give express consent or the law permits it.
Automated tools and artificial intelligence (AI). We do not currently use AI tools to review referrals or make decisions about your care. A member of our care team reviews every referral, and our clinicians make all decisions about your care.
We plan to add an AI chatbot in the future to answer general questions. Before we launch it, we will update this policy to explain what information the chatbot collects, how it is used and stored, and how you can choose not to use it. The chatbot will not make decisions about your eligibility or care.
Questionnaires and safety support. As part of your care, we may ask you to complete standard questionnaires about mood, anxiety, trauma and past experiences (such as the PHQ-9, GAD-7, PCL-5 and Adverse Childhood Experiences questionnaire). Your answers help your clinician plan your care and, in de-identified form, help us evaluate the program.
- If your answer to the question about thoughts of self-harm or of being better off dead is anything other than “not at all,” you will see a message directing you to emergency and crisis support, and a designated member of our care team will be notified so they can follow up with you. These notifications are reviewed during our business hours and are not an emergency service, so please use emergency or crisis services if you may be in immediate danger.
- Higher scores on other questionnaires may lead to a suggestion to connect with our team. These suggestions are not a diagnosis.
- We do not scan, analyse or monitor private journal entries, reflections, notes or other free-text content for safety purposes, by software or by people. Safety alerts come only from your answers to structured questionnaire items.
5. Consent
Consent at referral. When you submit a self-referral, you consent to us collecting and using the information you provide to review your referral, contact you and arrange care. The referral form explains this before you submit it.
Consent for care. Our clinicians will explain the care being offered and how your information will be used, and will ask for your consent before starting psychotherapy. Consent is an ongoing process: you may ask questions or change your mind at any time.
Your circle of care. Your health information may be accessed by the regulated clinicians, clinical supervisors and supervised trainees assigned to your care, only to the extent needed for their role. Under PHIPA, we may rely on your implied consent for this, unless you tell us you are withholding or withdrawing consent.
Supervised trainees. Becoming Institute trains Registered Nurses in psychotherapy. Trainees work under the supervision of a regulated clinician and are bound by the same confidentiality obligations as our staff. We will tell you if a trainee is involved in your care. If you have concerns about trainee involvement, please tell us. We will discuss your options and explain any effect on your care.
Limiting or withdrawing consent. You may ask us to limit who sees particular information, or withdraw your consent, at any time. Withdrawal does not affect information already used or disclosed, and it does not apply where the law requires or permits us to act without consent. We will explain any effect a limitation may have on your care.
Group sessions. Group coaching is part of the program. Information you choose to share in a group is heard by other participants. We ask every participant to keep what they hear in the group confidential, but we cannot guarantee that others will do so. You decide what you share in a group, and you can raise sensitive matters in your individual sessions instead.
Connecting you with other supports. If you would like help with housing, income, health, safety or community supports, we will ask for your express consent before sharing information with another agency, and share only what is needed. The same applies to updates for a partner who referred you.
Your permission. We will ask for your permission before sharing your health information with anyone outside your circle of care, except in the limited situations described in Section 8.
Substitute decision-makers. If you are not able to make decisions about your information, a substitute decision-maker recognized under PHIPA, such as a person you have appointed or a family member, may act on your behalf.
How we record consent. We record your consent, any limits you place on it, and any withdrawal in your record, along with the date.
6. Text messages and email
We send text messages and emails only for service-related purposes, never for marketing. These include:
- confirmation that we received your self-referral, including your reference number;
- follow-up messages from our care team about next steps; and
- appointment reminders and schedule updates.
Keeping messages private. To protect your privacy, our messages do not include clinical details. Texts and emails may be seen by anyone with access to your device, so please tell us if you would prefer a different contact method.
How you opt in. You opt in when you choose text messaging as a preferred contact method on a self-referral or service request and give us a mobile number. Consent to receive text messages is not a condition of receiving services.
How you opt out. Reply STOP to any text to stop receiving texts. Reply HELP for help. Every email includes our contact details and a way to stop receiving it. You may also contact us at info@becominginstitute.ca, (647) 265-0804, or our care line at (742) 247-1418. Opting out does not affect your care; we will contact you another way.
Frequency and cost. Messages are sent only as needed for your referral or care. Message and data rates may apply under your mobile plan.
Sender identification. Messages are sent from our registered program number or email address and identify Becoming Institute / Mindful Fitness as the sender, with our contact information.
Your text-message consent is never shared. Text-messaging opt-in data and consent are not shared with any third parties or affiliates for marketing or any other purpose. This information is excluded from all of the sharing described in this policy, other than with our text-message provider, Brevo, which sends messages only on our behalf.
7. Service providers
We use service providers to operate the program:
| Service | What it does | Information involved | Where data is stored |
|---|---|---|---|
| Jane (Jane Software Inc.) | Clinical records, scheduling, appointment reminders, and secure online (telehealth) individual and group sessions | Personal health information, contact details, appointment information | Canada |
| Hostinger International Ltd. | Hosts the self-referral and Partner Connect portals | Account, referral and technical information | United States |
| Brevo | Sends referral confirmations, care-line text messages and service emails | Name, contact details, message content, delivery and opt-out status | European Union (France, Germany and Belgium) |
| Google Analytics (Google LLC) | Measures how our referral portals are used | IP address, device and browser information, pages visited | United States and other countries where Google operates data centres |
These providers act on our behalf under written agreements. They may use your information only to provide services to us. They must protect it with appropriate safeguards, limit access to their staff who need it, notify us of any privacy breach, and return or securely destroy it when the service ends. They may not use your information for their own purposes. We remain responsible for your information while our service providers handle it.
Online sessions are not recorded. Jane’s telehealth platform does not allow video, audio or chat in online sessions to be recorded.
You may ask our Privacy Officer for the names of our current service providers.
Where your information is stored. Your clinical records and online-session information are kept in Jane, which stores our account’s data in Canada. Information you or a partner enter in our self-referral and Partner Connect portals, including account and referral information, is hosted on servers in the United States. Our email and text-message provider, Brevo, stores message and contact information on servers in the European Union.
When information is stored or accessed outside Canada, it may be subject to the laws of that country, including lawful access by its courts, law enforcement and national security authorities. We use contractual and technical safeguards to protect it.
8. Confidentiality and its limits
Everything you share with your clinician is held in confidence under PHIPA and the standards of the College of Registered Psychotherapists of Ontario (CRPO) and the College of Nurses of Ontario (CNO). We disclose your personal health information to third parties only with your permission, except in the following situations, where the law requires or allows us to share information without your consent:
- Abuse or neglect: we have reasonable grounds to suspect that a child is being, or is at risk of being, abused or neglected, or that an older adult living in a long-term care home or retirement home is being harmed or abused.
- Serious risk of harm: there is a serious and imminent threat to your life or to the life or safety of another identifiable person.
- Sexual abuse by a health professional: you disclose sexual abuse by a regulated health professional. Your name is included in the report only with your written consent.
- Court orders and legal demands: a court order, summons, warrant or other legally enforceable demand for records, including an investigation by our regulatory college.
When we must share information, we share only what is necessary and, where it is safe and appropriate, we will discuss it with you first.
Our service providers are not third parties for this purpose. Jane, Hostinger, Brevo and our other service providers act on our behalf under written agreements (see Section 7). They may handle your information only to provide services to us, and giving them access is not a disclosure to a third party.
If we ever use or disclose your health information outside the practices described in this policy without your consent, we will tell you at the first reasonable opportunity, unless the law prevents it, and record it in your file.
9. Website, cookies and analytics
Our referral portals use only the cookies and technical data needed to operate securely, such as session cookies and security logs. We also use Google Analytics to understand how the portals are used, such as which pages are visited and whether forms are completed. Analytics information is used only in aggregated form to improve the portals; we do not use it to identify you or to advertise to you. Google Analytics data is stored by Google in the United States and other countries. We have turned off Google’s advertising features, so analytics information is not used for advertising or shared for Google’s own purposes. You can limit analytics cookies through your browser settings, or install Google’s opt-out browser add-on.
We do not use advertising cookies, tracking pixels or social-media trackers on our referral portals, and we do not build advertising profiles.
10. How we protect information
We use administrative, technical and physical safeguards suited to the sensitivity of health information, including:
- access limited to people who need it for their role, using individual accounts, role-based permissions and two-step verification in our clinical records system;
- encryption of information when it is sent (HTTPS) and when it is stored;
- activity reports that show who has accessed clinical records, which we can review;
- secure data centres and regular encrypted backups provided by our clinical records system;
- a written safety protocol for responding to safety concerns identified through questionnaires;
- confidentiality agreements and privacy training for staff, clinicians, supervisors and trainees;
- written agreements and security reviews for service providers; and
- secure destruction of records that are no longer needed.
No system is completely secure, but we take the protection of your information, and especially your health information, seriously.
11. Privacy breaches
If your information is lost, stolen, or accessed, used or disclosed without authority, we will:
- act promptly to contain the breach and investigate it;
- notify you at the first reasonable opportunity and tell you about your right to complain to the Information and Privacy Commissioner of Ontario;
- notify the Commissioner, our regulatory colleges and others when the law requires; and
- keep a record of the breach and take steps to prevent it from happening again.
12. How long we keep information
| Record | How long we keep it |
|---|---|
| Clinical records | At least 10 years from the date of your last interaction with the program, or 10 years after your 18th birthday, whichever is later, or longer if required by the College of Nurses of Ontario (CNO) or the College of Registered Psychotherapists of Ontario (CRPO). Where requirements differ, we follow the longer period. |
| Referrals that do not proceed to care | 2 years from the date of referral |
| Scheduling and administrative records | Kept with the clinical record where they relate to your care; otherwise 7 years |
| Text-message consent and opt-out records | For the duration of your involvement in the program plus 3 years, so we can honour your choices |
| Support correspondence | 2 years, unless it becomes part of your clinical record |
| Portal accounts | Self-referral accounts: closed and deleted 2 years after your last sign-in or the end of your involvement in the program, whichever is later. Partner accounts: while active, plus 2 years. Referral and clinical information already transferred to your record is kept under the clinical records period |
| Technical and security logs | 12 months |
| Privacy breach records | At least 2 years |
| De-identified evaluation data | As long as needed for program evaluation and research; it does not identify you |
If we receive a request for access or a complaint, we keep the relevant information for as long as needed to respond and to allow you to use any review or appeal available to you.
When information is no longer needed, we securely destroy it or de-identify it.
13. Your rights
Access. You may ask to see or receive a copy of your records.
Correction. You may ask us to correct information you believe is inaccurate or incomplete. We correct clinical records by adding a dated amendment; we do not erase original entries. If we do not agree to a correction, you may ask us to attach a statement of disagreement to your record.
Deletion. You may ask us to delete information we hold about you. We will do so where the law allows. We cannot delete clinical records we are required to keep under PHIPA or our colleges’ record-keeping standards.
Limit or withdraw consent. See Section 5.
Stop text messages. See Section 6.
Close your account. You may ask us to close your self-referral or Partner Connect account at any time by contacting our Privacy Officer. Information already in your clinical record is kept as described in Section 12.
No negative consequences. Exercising your privacy rights or making a complaint will not affect your care.
14. How to make a request
Please send your request in writing to our Privacy Officer (see Section 2), by email or mail. We may ask you to confirm your identity before releasing information.
- Timing: We will respond within 30 days. If we need more time, for example because we must consult others, we will tell you in writing, explain why, and respond within a further 30 days at most.
- Fees: Copies of your records may be subject to a reasonable cost-recovery fee. We will give you a fee estimate first and may waive the fee in some circumstances.
- If we refuse: We will explain why in writing and tell you about your right to complain to the Information and Privacy Commissioner of Ontario.
15. Questions and complaints
If you have a concern about how we handle your information, please contact our Privacy Officer first. We will review your concern and respond in writing.
You also have the right to make a written complaint to the Information and Privacy Commissioner of Ontario:
Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
Phone: 416-326-3333 | Toll-free: 1-800-387-0073
Website: https://www.ipc.on.ca
For concerns about personal information that is not health information, you may also contact the Office of the Privacy Commissioner of Canada:
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376
Website: https://www.priv.gc.ca
16. Children and young people
Mindful Fitness serves adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that a referral was submitted for someone under 18, we will let the person who submitted it know about other services that may help and securely destroy the referral information.
17. Professional standards
Our clinicians are regulated health professionals: Registered Nurses governed by the College of Nurses of Ontario (CNO) and Registered Psychotherapists governed by the College of Registered Psychotherapists of Ontario (CRPO). They follow their colleges’ confidentiality and record-keeping standards in addition to PHIPA. Where this policy and a college standard differ, we follow whichever gives you stronger protection.
18. Changes to this policy
We review this policy at least once a year and when our practices change. We will post the updated policy with a new “last updated” date. If a change materially affects how we handle your health information, we will tell current program participants directly, for example by email or during a session, before the change takes effect.
19. Contact us
Becoming Institute Inc.
Unit 2 – 80 Devon Road, Brampton, ON L6T 5B3
Privacy Officer: Joan Samuels-Dennis, President and Clinical Lead, privacy@becominginstitute.ca
General inquiries: info@becominginstitute.ca | (647) 265-0804
Care line (call or text): (742) 247-1418, Monday to Friday, 9 a.m. to 5 p.m.
Website: https://becominginstitute.ca/
Use of our website and portals is also governed by our Website and Portal Terms of Use.