1. Purpose and Scope
McKenzie Psychology (“the Clinic”) is committed to protecting the privacy, accuracy, and security of all personal information and personal health information (“PHI”) entrusted to us. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in accordance with Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and, where applicable, the Personal Information Protection and Electronic Documents Act (PIPEDA).
This Policy applies to all clinicians, psychometrists, students, administrative staff, and third-party service providers who act on our behalf.
This Policy replaces all previous versions.
2. What Is Personal Information and Personal Health Information?
Personal Information means information about an identifiable individual as defined under PIPEDA, including name, contact details, and other identifying information.
Personal Health Information (PHI) has the meaning under PHIPA and includes information about an individual’s physical or mental health, health history, clinical records, diagnostic information, and health insurance number.
In this Policy, “personal information” includes PHI unless otherwise specified.
Information that has been irreversibly de‑identified is not considered personal information or PHI.
3. When Inquiry-Stage Information Becomes PHI
If an individual contacts the Clinic (e.g., by phone, email, online form, or voicemail):
- If they provide only contact information, it is treated as personal information under PIPEDA.
- If they disclose symptoms, concerns, or therapy-related details, that information becomes PHI at the point of disclosure and is handled in accordance with PHIPA.
This applies whether the individual becomes a client or not.
4. Who We Are
McKenzie Psychology is a private psychology practice comprising psychologists, psychologists in supervised practice, psychological associates, registered psychotherapists, master’s level clinicians, psychometrists, students, and administrative personnel. We also engage third-party service providers (e.g., bookkeepers, software vendors, payment processors, insurers, IT providers, legal counsel) who may have limited access to personal information strictly for the purposes of fulfilling their contractual roles. All such providers are required to maintain appropriate confidentiality and privacy protections.
5. Consent
Consent for Inquiry-Stage Communications
When you contact the Clinic to inquire about services, whether through our website, email, telephone, or an online form, you may voluntarily provide personal information or PHI. We collect and use the information you provide for the purpose of responding to your inquiry. This collection is based on your implied consent, which occurs when you choose to submit information for that purpose.
Consent for Clinical Services (Informed Consent)
Once you become a client of the Clinic, we obtain your informed consent before collecting, using, or disclosing your personal information or PHI for assessment, treatment, administration, or other purposes described in this Privacy Policy.
You may withdraw or modify your consent at any time by contacting the Privacy Officer, subject to applicable legal requirements, clinical obligations, the professional standards set by the relevant regulatory college, and reasonable notice.
Situations Where Consent Is Not Required
Your clinician may disclose information without consent in circumstances permitted or required by law, including:
- To reduce or eliminate a serious risk of significant bodily harm to yourself or others
- To report suspected child abuse or neglect
- To report suspected abuse in long-term care or retirement homes
- To report sexual abuse by a regulated health professional
- To comply with the Missing Persons Act, 2018
- To facilitate timely health‑care delivery where implied consent applies
- To comply with regulatory college quality assurance activities
- To comply with investigations, search warrants, or court orders
- For legal proceedings where the Clinic is a party or witness
- To the Public Guardian and Trustee, Children’s Aid Society, or Children’s Lawyer
- To disclose information about a deceased individual where permitted by law
Whenever possible, we will discuss such disclosures with you unless doing so would compromise safety or legal obligations.
6. Types of Personal Information We Collect
We collect information required to deliver psychological services and manage administrative operations, including:
- Contact information and date of birth
- Presenting concerns
- Health and mental health history
- Insurance and billing information
- Appointment details
- Communications with the Clinic
- Clinical notes and assessment data
- Psychometric testing results
- Payment and administrative records
- Inquiry-stage information (see Section 3)
7. Collection, Use, and Disclosure of Personal Information
Primary Purposes
We collect, use, and disclose personal information to:
- Provide psychological assessment and treatment
- Communicate with you about appointments or care
- Prepare reports or share information with third parties when you provide consent
- Coordinate services with authorized third parties (e.g., insurers, WSIB)
On our website, we collect only the information you voluntarily provide, except for cookies (addressed in our separate Website Privacy Policy).
Secondary Purposes
We may collect, use, or disclose information to:
- Invoice for services and collect unpaid accounts
- Obtain payment from third-party payers
- Engage in professional supervision or training
- Comply with regulatory oversight and audits
- Report practitioner misconduct where legally required
- Respond to lawful requests from government authorities
- Consult legal or financial professionals
- Provide optional service-related updates with your permission
We do not use personal information for marketing nor sell personal information.
8. Electronic Communications
The Clinic communicates with clients using electronic means, which may include email, text messaging, secure online portals, and videoconferencing platforms.
Electronic communications may be used for administrative purposes and, where appropriate, for clinical communication. Such communications may be stored, retained, or integrated into the client’s record and may be accessed by Clinic staff or agents involved in the provision or administration of care, subject to confidentiality obligations.
The Clinic uses reasonable administrative, technical, and contractual safeguards to protect electronic communications. However, no method of electronic transmission is entirely secure, and privacy risks cannot be eliminated entirely.
Electronic communications and voicemail messages are not monitored continuously and must not be used for emergencies or urgent situations.
9. Use of Software and Third-Party Service Providers
The Clinic uses practice management software (including Jane) and other technology tools for secure communication, scheduling, billing, and records management. These providers may process limited personal information to perform contracted services.
Where information is processed outside Canada, the Clinic implements contractual and technical safeguards to ensure PHIPA comparable protection.
10. Use of AI-Enabled Tools
The Clinic may use AI-enabled tools solely to improve administrative efficiency, document organization, and internal workflows. AI tools:
- Do not make clinical decisions
- Operate under human oversight
- Are limited to what is necessary
- Undergo privacy and security evaluations before use
- Are subject to contractual confidentiality obligations
11. Safeguards
We use physical, administrative, and technological safeguards appropriate to the sensitivity of the information, including:
- Staff training
- Access controls and least-privilege practices
- Encryption, firewalls, MFA, and malware protection
- Secure storage and destruction protocols
No system is entirely risk-free, but we use commercially reasonable measures to protect information.
12. Storage, Retention, and Destruction
We use physical, administrative, and technological safeguards appropriate to the sensitivity of the information, including:
- Staff training
- Access controls and least-privilege practices
- Encryption, firewalls, MFA, and malware protection
- Secure storage and destruction protocols
No system is entirely risk-free, but we use commercially reasonable measures to protect information.
13. Access and Correction
You may request:
- Confirmation of whether we hold your information
- Access to your record
- Correction of factual inaccuracies
Requests should be directed to the Privacy Officer. If a correction is denied, we will add a statement of disagreement to your file.
Administrative fees may apply.
14. Questions or Complaints
Privacy Officer
Dr. Sandra McKenzie
McKenzie Psychology
186 Albert Street, Suite 305, London, ON N6A 1M1
1096 Goyeau Street, Windsor, ON N9A 1J1
Tel: 519‑432‑6600
Email: info@mckenziepsychology.ca
You also have the right to make a complaint to the Information and Privacy Commissioner of Ontario at any time. Information about how to do so is available at: www.ipc.on.ca.
15. Changes to This Policy
We may update this Policy to reflect legal, technological, or organizational changes. Continued interaction with the Clinic signifies acceptance of the updated Policy.
Last revised: September 28, 2026
