Privacy Policy

Introduction

The following describes how Toriven Health Inc. (“Toriven”, “we”, “our”, or “us”) collects, uses, stores, and under what circumstances discloses your personal information (PI) and personal health information (PHI).

Personal health information (PHI) is governed by the Personal Health Information Protection Act, 2004 (PHIPA).

Personal information (PI) is information about you that is not personal health information and is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and successor legislation.

We are committed to protecting the privacy and confidentiality of all PI and PHI in our care and control that you share with us, or that we learn about, in the delivery of our services.

As a Health Information Custodian (HIC) under PHIPA, we collect, use, disclose, and safeguard PHI strictly in accordance with PHIPA and other applicable laws.

What Personal Information We Collect

We may collect the following types of PI and PHI:

• Name, date of birth, and contact details
• Health and developmental history
• Assessment results and treatment plans
• Clinical session notes and progress reports
• Referral information
• School or support service information (where applicable)
• Billing and payment details
• Emergency contact information

We collect this information directly from you, your substitute decision-maker, or with your consent, or as permitted by law, from third parties involved in your care (e.g., healthcare providers, schools, programs, or caregivers).

We may also collect information to determine eligibility for services, manage service intake, and support administrative operations related to providing care.

We only collect information as reasonably necessary to provide services as described in this policy.

How and Why We Use Your Personal Health Information

We use PHI to:

• Provide assessment and treatment services
• Coordinate care with your healthcare or support team
• Communicate with you or your parent/guardian
• Schedule appointments and manage your file
• Process billing and payments
• Support quality improvement and staff clinical supervision
• Meet legal, reporting, and regulatory requirements

Consent

Toriven generally collects personal information (PI) and personal health information (PHI) directly from you. In some circumstances, with your consent or as permitted or required by law, we may collect information from other individuals or organizations, such as healthcare providers, schools, insurers, family members, caregivers, or other authorized representatives.

We generally collect, use, and disclose your PI and PHI with your express or implied consent, as appropriate and as permitted or required by applicable law.

Within the healthcare “circle of care,” Toriven™ may share relevant personal health information with clinicians, staff, and service providers involved in your care on a need-to-know basis, unless you instruct us otherwise or where express consent is required by law.

Your Express Consent is Required When:

• Sharing information with third parties who are not part of your healthcare team (such as schools, employers, insurers, legal representatives, or community organizations)
• Using information for non-clinical purposes such as education, training, service improvement, or program development activities
• Recording sessions (audio or video) — recording only occurs for a specific purpose with your awareness and written consent

You may withdraw or limit consent at any time, subject to legal and clinical limits. We will explain any implications for your care.

Sharing Your Personal Health Information

As described in Section 4, within the healthcare “circle of care,” Toriven™ may share relevant personal health information with clinicians, staff, and service providers involved in your care on a need-to-know basis as permitted under PHIPA.

We may also share personal health information with other individuals or organizations with your express consent or the consent of your substitute decision-maker, including schools, insurers, community programs, or other service providers not directly involved in your care.

PHI May Be Disclosed Without Consent Where Permitted or Required by Law, Including:

• To reduce a risk of serious harm
• When required by a court order or legal authority
• To report child protection concerns
• To comply with other regulatory or professional obligations

In all circumstances, only the minimum amount of information reasonably necessary will be disclosed.

Virtual Care

The majority of Toriven™ services are delivered virtually across Ontario, with in-person sessions available where clinically indicated. All virtual sessions use privacy-protective, PHIPA-compliant platforms with encryption and access controls.

We Encourage Clients to:

• Participate from a private location where possible
• Use secure devices and internet connections where possible
• Note: Sessions are not recorded unless you provide explicit written consent

How We Protect Your Information

Toriven™ uses administrative, physical, and technical safeguards to protect PHI against loss, theft, unauthorized access, copying, modification, or disclosure.

Safeguards Include:

• Secure electronic medical record systems
• Access controls and log-on procedures
• Encryption of digital records and transmissions where appropriate
• Confidentiality agreements with all staff and third-party providers
• Staff training and privacy awareness
• Internal privacy policies and procedures governing PHI handling

Only our authorized personnel may access PHI.

Retention and Destruction

Records are retained in accordance with PHIPA, applicable regulatory college standards, and other professional requirements. Retention periods vary by record type and regulatory body:

Secure destruction: When records are no longer required, they are destroyed securely to prevent reconstruction, in accordance with PHIPA and applicable college standards.

Your Rights Under PHIPA

You have the right to:

• Request access to your health record
• Request corrections to inaccurate information
• Ask how your PHI has been used or disclosed
• Withdraw or limit consent (where legally permitted)

Requests must be made in writing. We may require verification of identity before releasing information. In rare cases, access may be restricted as permitted by law — if so, we will explain why.

Privacy Breaches

If PHI is lost, stolen, or accessed without authorization, Toriven™ will:

• Take immediate steps to contain and investigate the incident
• Notify affected individuals where required
• Comply with all legal reporting obligations
• Report to the Information and Privacy Commissioner of Ontario (IPC) and applicable regulatory bodies where required

We handle all privacy incidents seriously and transparently.

Website, Forms, and Analytics

If you contact us through our website, please be aware that internet-based communications may carry security risks. We take steps to protect transmitted information, but email may not be a secure method of communication and should not be used for sensitive or personal health information.

When you visit our website, we may collect limited technical and usage information through cookies and similar technologies. Depending on your consent choices and browser settings, this information may include your IP address, approximate geographic region, browser and device information, pages viewed, referring website, campaign or UTM information, and interactions with website content.

Toriven uses this information to maintain website security, understand website performance, measure general campaign effectiveness, and improve our services. We do not intentionally send names, contact information, form responses, clinical records, assessment results, therapy information, diagnoses, or other PHI to website analytics or advertising providers.

Analytics identifiers and technical information may constitute PI even when they do not directly identify you by name. Some analytics and technology providers may process this information outside Canada, including in the United States.

Toriven does not use website analytics to build clinical profiles, infer diagnoses, make clinical decisions, or conduct targeted advertising based on PHI. We do not use remarketing tools to follow visitors across unrelated websites based on their interest in Toriven's health services.

Online Inquiry and Intake Forms

Toriven may use Jotform or another authorized form provider to collect inquiries, intake information, consent documents, and other information submitted by you. Information submitted through these forms may be stored or processed outside Canada, including in the United States, and may therefore be subject to the laws and lawful-access requirements of those jurisdictions.

Toriven configures forms according to the sensitivity of the information being collected and uses reasonable safeguards such as encrypted transmission, access controls, and restricted notification content. Form submissions containing PI or PHI are not intentionally disclosed to website analytics or advertising providers.

Please provide only the information requested. Where a form is designated as a general callback or inquiry form, do not include detailed symptoms, diagnoses, medical records, or other sensitive health information. Toriven may provide a separate secure method for exchanging clinical information.

A separate Cookie Policy provides more information about the technologies used on our website and how to manage your preferences.

Electronic Communications

If you ask us to communicate with you by email, telephone, text message, or other electronic means, we will use the contact information you provide. Telephone calls may display Toriven Health Inc. (or a similar business identifier), and emails will identify Toriven Health as the sender.

Toriven may communicate with clients through secure messaging within its authorized electronic medical record platform, including Jane. Secure-message content is accessed through the authenticated patient portal or mobile application. An ordinary email or push notification may advise you that a secure message is available, but the secure message itself is viewed within the platform.

Information handled through Jane may be stored in Canada and may also be transferred to or processed in the United States by Jane or its authorized service providers, subject to contractual, organizational, and technical safeguards.

While Toriven takes reasonable steps to protect the security of communications sent from our systems, you are responsible for maintaining the privacy and security of the devices, email accounts, telephone numbers, voicemail services, and other communication methods that you use. If you use a shared, family, employer-managed, school, or public device or account, or if others have access to your email, voicemail, or text messages, they may be able to view or access communications from Toriven.

If you have concerns about receiving electronic communications, please let us know. Alternative communication methods may be available in some circumstances, although they may limit certain services or response times.

Third-Party Service Providers

Toriven™ uses selected third-party service providers to support our clinical and operational services. These may include providers of electronic health record systems, online forms, secure IT infrastructure, cybersecurity services, analytics, payment processing, and communication platforms.

In limited situations, these service providers may have access to personal health information only to the extent necessary to operate, maintain, or support the systems we use.

Toriven assesses service providers based on the sensitivity of the information involved and requires safeguards appropriate to their role and applicable legal requirements.

Safeguards May Include:

• Contractual confidentiality and privacy obligations
• Secure handling practices, including encryption and access controls
• Access limited to authorized personnel
• Measures designed to prevent unauthorized access, use, or disclosure
• Requirements to notify Toriven™ of privacy or security incidents as required by law

Where a provider processes PHI on Toriven's behalf, it may process that information only for authorized service purposes, subject to the applicable agreement and legal requirements.

AI-Assisted Clinical Tools

Toriven™ may use AI-assisted technologies to support clinical documentation, psychometric scoring, data analysis, administrative tasks, and report drafting. These tools are used only to assist clinicians and do not replace professional clinical judgment.

All AI-assisted outputs are reviewed and validated by the supervising clinician, who remains professionally responsible for all clinical decisions, documentation, and reports.

Where AI-assisted tools process personal information or personal health information on Toriven™'s behalf, they are treated as third-party service providers and are subject to Toriven™'s privacy, security, confidentiality, and contractual requirements, including applicable privacy legislation.

Toriven does not disclose de-identified personal information or personal health information to third parties for their own research, commercial purposes, product development, artificial intelligence development, or other independent purposes.

Contacting Our Privacy Officer

If you have questions, concerns, or wish to exercise your privacy rights, please contact our Privacy Officer:

Right to Complain

If you believe your privacy rights have been violated, you have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC):

Scope of This Policy

This Privacy Policy describes how Toriven Health Inc. collects, uses, protects, and discloses personal information and personal health information.

Matters relating to service eligibility, the establishment of a client relationship, and the delivery of care are addressed in separate documents, including our Client Consent materials and Patient Service Agreement.

Recruitment and Candidate Information

Toriven™ collects personal information from job applicants for the purpose of evaluating suitability for employment or contract opportunities.

This may include:

• Contact information
• Professional credentials and licensing details
• Employment history and education
• Regulatory and professional disclosures
• Any additional information provided in resumes, cover letters, or application forms

This information is used solely for recruitment, candidate evaluation, and related administrative purposes. It is not used for clinical service delivery or shared with patients.

Toriven™ may verify information provided by candidates, including professional credentials, regulatory standing, and employment history, where appropriate.

Candidate information is retained only as long as necessary for recruitment purposes or for consideration in future opportunities, unless a request for deletion is received. Candidates may request deletion of their information by contacting privacy@torivenhealth.ca.

All personal information collected through the recruitment process is handled in accordance with applicable Ontario privacy legislation and Toriven™’s data protection practices.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. The “Effective Date” at the top of this page indicates when this policy last changed. Material changes will be communicated where required by law, and consent will be obtained where an updated collection, use, or disclosure requires consent.