Privacy Policy

Introduction

The following describes how Toriven Health Inc. (“Toriven”, “we”, “our”, or “us”) collects, uses, stores, and under what circumstances discloses your personal information (PI) and personal health information (PHI).

Personal health information (PHI) is governed by the Personal Health Information Protection Act, 2004 (PHIPA).

Personal information (PI) is information about you that is not personal health information and is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and successor legislation.

We are committed to protecting the privacy and confidentiality of all PI and PHI in our care and control that you share with us, or that we learn about, in the delivery of our services.

As a Health Information Custodian (HIC) under PHIPA, we collect, use, disclose, and safeguard PHI strictly in accordance with PHIPA and other applicable laws.

What Personal Information We Collect

We may collect the following types of PI and PHI:

• Name, date of birth, and contact details
• Health and developmental history
• Assessment results and treatment plans
• Clinical session notes and progress reports
• Referral information
• School or support service information (where applicable)
• Billing and payment details
• Emergency contact information

We collect this information directly from you, your substitute decision-maker, or with your consent, or as permitted by law, from third parties involved in your care (e.g., healthcare providers, schools, programs, or caregivers).

We may also collect information to determine eligibility for services, manage service intake, and support administrative operations related to providing care.

We only collect information as reasonably necessary to provide services as described in this policy.

How and Why We Use Your Personal Health Information

We use PHI to:

• Provide assessment and treatment services
• Coordinate care with your healthcare or support team
• Communicate with you or your parent/guardian
• Schedule appointments and manage your file
• Process billing and payments
• Support quality improvement and staff clinical supervision
• Meet legal, reporting, and regulatory requirements

Consent

Toriven generally collects personal information (PI) and personal health information (PHI) directly from you. In some circumstances, with your consent or as permitted or required by law, we may collect information from other individuals or organizations, such as healthcare providers, schools, insurers, family members, caregivers, or other authorized representatives.

We generally collect, use, and disclose your PI and PHI with your express or implied consent, as appropriate and as permitted or required by applicable law.

Within the healthcare “circle of care,” Toriven™ may share relevant personal health information with clinicians, staff, and service providers involved in your care on a need-to-know basis, unless you instruct us otherwise or where express consent is required by law.

Your Express Consent is Required When:

• Sharing information with third parties who are not part of your healthcare team (such as schools, employers, insurers, legal representatives, or community organizations)
• Using information for non-clinical purposes such as education, training, service improvement, or program development activities
• Recording sessions (audio or video) — recording only occurs for a specific purpose with your awareness and written consent

You may withdraw or limit consent at any time, subject to legal and clinical limits. We will explain any implications for your care.

Sharing Your Personal Health Information

As described in Section 4, within the healthcare “circle of care,” Toriven™ may share relevant personal health information with clinicians, staff, and service providers involved in your care on a need-to-know basis as permitted under PHIPA.

We may also share personal health information with other individuals or organizations with your express consent or the consent of your substitute decision-maker, including schools, insurers, community programs, or other service providers not directly involved in your care.

PHI May Be Disclosed Without Consent Where Permitted or Required by Law, Including:

• To reduce a risk of serious harm
• When required by a court order or legal authority
• To report child protection concerns
• To comply with other regulatory or professional obligations

In all circumstances, only the minimum amount of information reasonably necessary will be disclosed.

Virtual Care

The majority of Toriven™ services are delivered virtually across Ontario, with in-person sessions available where clinically indicated. All virtual sessions use privacy-protective, PHIPA-compliant platforms with encryption and access controls.

We Encourage Clients to:

• Participate from a private location where possible
• Use secure devices and internet connections where possible
• Note: Sessions are not recorded unless you provide explicit written consent

How We Protect Your Information

Toriven™ uses administrative, physical, and technical safeguards to protect PHI against loss, theft, unauthorized access, copying, modification, or disclosure.

Safeguards Include:

• Secure electronic medical record systems
• Access controls and log-on procedures
• Encryption of digital records and transmissions where appropriate
• Confidentiality agreements with all staff and third-party providers
• Staff training and privacy awareness
• Internal privacy policies and procedures governing PHI handling

Only our authorized personnel may access PHI.

Retention and Destruction

Records are retained in accordance with PHIPA, applicable regulatory college standards, and other professional requirements. Retention periods vary by record type and regulatory body:

Secure destruction: When records are no longer required, they are destroyed securely to prevent reconstruction, in accordance with PHIPA and applicable college standards.

Your Rights Under PHIPA

You have the right to:

• Request access to your health record
• Request corrections to inaccurate information
• Ask how your PHI has been used or disclosed
• Withdraw or limit consent (where legally permitted)

Requests must be made in writing. We may require verification of identity before releasing information. In rare cases, access may be restricted as permitted by law — if so, we will explain why.

Privacy Breaches

If PHI is lost, stolen, or accessed without authorization, Toriven™ will:

• Take immediate steps to contain and investigate the incident
• Notify affected individuals where required
• Comply with all legal reporting obligations
• Report to the Information and Privacy Commissioner of Ontario (IPC) and applicable regulatory bodies where required

We handle all privacy incidents seriously and transparently.

Website & Communication Technology

If you contact us through our website, please be aware that internet-based communications may carry security risks. We take steps to protect transmitted information, but email may not be a secure method of communication and should not be used for sensitive or personal health information.

Our website may use cookies and similar technologies for essential website functionality and anonymous website analytics. We do not disclose clinical records, assessment information, therapy records, or other personal health information to website analytics providers. Website analytics information is used only in aggregated or de-identified form.

A separate Cookie Policy provides full details of the cookies and third-party tools we use, and how to manage your preferences.

Electronic Communications

If you ask us to communicate with you by email, telephone, text message, or other electronic means, we will use the contact information you provide. Telephone calls may display Toriven Health Inc. (or a similar business identifier), and emails will identify Toriven Health as the sender.

While Toriven takes reasonable steps to protect the security of communications sent from our systems, you are responsible for maintaining the privacy and security of the devices, email accounts, telephone numbers, voicemail services, and other communication methods that you use. If you use a shared, family, employer-managed, school, or public device or account, or if others have access to your email, voicemail, or text messages, they may be able to view or access communications from Toriven.

If you have concerns about receiving electronic communications, please let us know. Alternative communication methods may be available in some circumstances, although they may limit certain services or response times.

Third-Party Service Providers

Toriven™ uses carefully selected third-party service providers to support our clinical and operational services. These may include providers of electronic health record systems, secure IT infrastructure, cybersecurity services, and communication platforms.

In limited situations, these service providers may have access to personal health information only to the extent necessary to operate, maintain, or support the systems we use.

Toriven™ Requires That All Third-Party Providers:

• Sign confidentiality and privacy agreements
• Meet healthcare-related privacy and security standards including under PHIPA
• Use secure handling practices, including encryption and access controls
• Limit access to authorized personnel only
• Maintain appropriate safeguards to prevent unauthorized access, use, or disclosure
• Notify Toriven™ of any privacy or security incidents as required by law

Third-party providers are not permitted to use personal health information for their own purposes.

AI-Assisted Clinical Tools

Toriven™ may use AI-assisted technologies to support clinical documentation, psychometric scoring, data analysis, administrative tasks, and report drafting. These tools are used only to assist clinicians and do not replace professional clinical judgment.

All AI-assisted outputs are reviewed and validated by the supervising clinician, who remains professionally responsible for all clinical decisions, documentation, and reports.

Where AI-assisted tools process personal information or personal health information on Toriven™'s behalf, they are treated as third-party service providers and are subject to Toriven™'s privacy, security, confidentiality, and contractual requirements, including applicable privacy legislation.

Toriven does not disclose de-identified personal information or personal health information to third parties for their own research, commercial purposes, product development, artificial intelligence development, or other independent purposes.

Contacting Our Privacy Officer

If you have questions, concerns, or wish to exercise your privacy rights, please contact our Privacy Officer:

Right to Complain

If you believe your privacy rights have been violated, you have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC):

Scope of This Policy

This Privacy Policy describes how Toriven Health Inc. collects, uses, protects, and discloses personal information and personal health information.

Matters relating to service eligibility, the establishment of a client relationship, and the delivery of care are addressed in separate documents, including our Client Consent materials and Patient Service Agreement.

Recruitment and Candidate Information

Toriven™ collects personal information from job applicants for the purpose of evaluating suitability for employment or contract opportunities.

This may include:

• Contact information
• Professional credentials and licensing details
• Employment history and education
• Regulatory and professional disclosures
• Any additional information provided in resumes, cover letters, or application forms

This information is used solely for recruitment, candidate evaluation, and related administrative purposes. It is not used for clinical service delivery or shared with patients.

Toriven™ may verify information provided by candidates, including professional credentials, regulatory standing, and employment history, where appropriate.

Candidate information is retained only as long as necessary for recruitment purposes or for consideration in future opportunities, unless a request for deletion is received. Candidates may request deletion of their information by contacting privacy@torivenhealth.ca.

All personal information collected through the recruitment process is handled in accordance with applicable Ontario privacy legislation and Toriven™’s data protection practices.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. The “Effective Date” at the top of this page indicates when this policy last changed. Continued use of Toriven™ services following any update constitutes your acceptance of the revised policy.