Tucker Psychotherapy · Privacy

Privacy policy

How we handle information about your care, your appointments, and your use of this website.

Effective date: October 13, 2026. This policy covers Tucker Psychotherapy’s practice and tuckerpsychotherapy.com. Your practitioner’s informed-consent discussion and any service-specific privacy notice provide further details. Visiting this website does not constitute consent to treatment or unrelated uses of your health information.

1. Responsibility and applicable standards

Personal health information is governed by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). Our practitioners must also meet their own professional obligations: the College of Registered Psychotherapists of Ontario (CRPO) for Registered Psychotherapists, and the Ontario College of Social Workers and Social Service Workers (OCSWSSW) for Registered Social Workers.

The College of Psychologists of Ontario (CPO) is now the College of Psychologists and Behaviour Analysts of Ontario (CPBAO). Its confidentiality and recordkeeping standards apply when services are provided by its registrants; mentioning those standards does not mean every practitioner here is a psychologist. Federal private-sector privacy law (PIPEDA) may also apply to non-health commercial information and applicable interprovincial or international activities.

Royce Tucker, Registered Psychotherapist, is the health information custodian for Tucker Psychotherapy. Direct privacy inquiries and requests for access or correction to Royce Tucker using the contact details below. A substitute custodian to act in the event of his death or incapacity is on record with the College of Registered Psychotherapists of Ontario (CRPO). This arrangement supports continuity of record custody, access and required retention.

2. What information is collected and why

Depending on your services, information may include contact and identifying details; appointment and attendance information; consent and communication preferences; relevant health history, assessments, treatment plans and clinical notes; and invoices, receipts and payment records. We collect information directly from you or an authorized representative, and from others when authorized or permitted by law.

Information is used to respond to inquiries, arrange and provide care, document services, communicate with you, process payments, maintain required records, and meet legal and professional duties. Collection, use and disclosure must be limited to what is reasonably necessary for the purpose. Clinical information must not be used for unrelated marketing without the consent required by law.

3. Consent and limits of confidentiality

Your consent must be knowledgeable and relate to the information and purpose involved. PHIPA allows implied consent in some health-care circumstances; express consent is required in others. You may ask questions, restrict sharing, or withdraw consent by notifying your practitioner or our privacy contact. Withdrawal does not undo earlier lawful uses or disclosures, or override legal duties. We will explain any implications for care.

Confidentiality has legal limits. Information may be disclosed when permitted or required by law, for example for mandatory child-protection or professional-regulatory reporting, a legally binding court order, or to reduce or eliminate a significant risk of serious bodily harm. Only the information necessary for the lawful purpose should be disclosed. Where appropriate and lawful, your practitioner will discuss the disclosure with you.

For couples, families and groups, your practitioner will explain who the clients are, how shared records are handled, and the confidentiality arrangements before services begin. A parent or another participant does not automatically receive unrestricted access to another person’s information.

4. Access, correction and privacy choices

You may request access to your personal health information or ask for correction of inaccurate or incomplete factual information. Contact us to arrange a written request and secure identity verification; do not send a detailed clinical history through the website form.

Access requests are answered as soon as reasonably possible and within 30 days, unless PHIPA permits an extension. If extended, we will provide written notice of the length and reason. Access can be limited only as the law allows; we will explain any refusal and complaint rights. Any permitted access fee will be explained through an estimate before it is charged.

Correction rights do not require removal of good-faith professional opinions or observations. If a correction is refused, you may request a statement of disagreement and other remedies available under PHIPA. Required health records cannot always be deleted on request. Closing an online account does not cancel the duty to retain clinical records.

5. Safeguards, retention and incidents

PHIPA requires reasonable administrative, physical and technical safeguards against loss, theft and unauthorized access, use, disclosure, copying, alteration or disposal. Access must be limited to authorized people who need information for their duties, and service providers must be subject to appropriate confidentiality obligations. No internet service can guarantee absolute security.

CRPO clinical, appointment and financial record standards generally require retention for at least 10 years after the last interaction, or 10 years after the client’s 18th birthday, whichever is later. CPBAO individual service records have a corresponding minimum based on last professional contact. OCSWSSW requires at least 10 years after the last entry, or 10 years after a minor turns or would have turned 18. Longer retention may be required for legal proceedings or other lawful reasons. Records must be securely transferred or disposed of when appropriate; practice closure does not remove retention obligations.

If health information is stolen, lost, or used or disclosed without authority, we will take steps to contain and investigate the incident, notify affected individuals at the first reasonable opportunity, and report to the Information and Privacy Commissioner of Ontario (IPC) and professional regulators when required.

6. Appointments and information in Jane

Our booking and virtual-appointment links lead to Jane, a clinic-management service operated by Jane Software Inc. We use Jane for online booking, appointment management and reminders, intake forms, clinical documentation, payments and virtual appointments. Information handled there includes your profile, appointment history, intake responses, billing information and clinical records. Jane acts as a service provider for clinic patient data; the clinic or practitioner remains responsible for that data. Jane separately manages Jane ID authentication information for its client mobile app.

Jane describes encryption for data transmission and storage, backups, individual accounts, permission controls and activity logs. These platform features do not replace our own responsibilities for consent, appropriate access and record management.

Jane says the region selected for a clinic account determines its primary data-storage location, with Canadian-region data centres in Montreal and Calgary. Its privacy notice also identifies cross-border processing for some services. Please contact us for the configuration relevant to your care; we do not promise that all processing remains in Canada.

If payment information is entered through Jane, its payment partners handle card details; Jane describes using tokens and retaining limited card-identification information rather than plain card numbers on its servers. Clinic records and Jane account information remain subject to their respective retention requirements.

Virtual appointments

Use a private location, headphones where appropriate, and a device and account you control. Electronic communication and shared devices create privacy risks. Tell your practitioner if someone can overhear or access your session.

Your practitioner discusses electronic-care arrangements and any additional session-specific technology consent directly with you. This website notice does not replace those conversations or any consent required for your care.

For access or correction of clinic records in Jane, contact us. For Jane ID or Jane’s own privacy practices, consult Jane’s Privacy Notice. Further information: Jane Security FAQ, Protecting Patient Data.

7. Website forms, cookies and analytics

The website uses WordPress.com and Jetpack services. Contact forms collect the name, email address, optional phone number and message you provide, to respond to your inquiry. Form submissions may be processed and stored through website and email service providers. Please use forms for scheduling or general questions, not detailed health information. Ordinary email and website messaging are not equivalent to a clinical record portal.

Website services may process technical information such as IP address, browser or device details, referring page, pages visited and access times for site operation, security and usage measurement. Cookies and similar technologies support functions and statistics. WordPress/Jetpack and Google Analytics code are present on the site. Google’s services can receive information about the pages visited and the device accessing them. Analytics settings affect collection, sharing and retention.

You can block or remove cookies through your browser, although some functions may be affected. Google offers an Analytics opt-out browser add-on. These controls do not necessarily prevent every server log or data transfer. Using private browsing does not make visits anonymous. You may contact us by phone rather than through the website.

Provider details are available in Automattic’s website-visitor privacy notice, its cookie policy, and Google’s explanation of information from partner sites. Provider processing may take place outside Ontario or Canada and may be subject to laws in those locations.

8. Communications and external links

Tell us your preferred contact method and whether messages may be left. Appointment reminders can reveal that you receive services to someone with access to your phone or email. Your practitioner will discuss suitable electronic communication arrangements. Do not send payment credentials, passwords or detailed clinical information through public comments, social media or routine contact forms.

Links to Jane, maps, regulators and other websites take you to separate services with their own privacy practices. Public comments or other information you choose to publish may be visible to others. Website information is general information and does not establish a therapeutic relationship or replace individual care. Forms are not an emergency service; in immediate danger, call 911 or your local emergency number.

9. Questions, requests and complaints

You may also contact the Information and Privacy Commissioner of Ontario about a PHIPA concern, without first obtaining our permission: 416-326-3333 or 1-800-387-0073. For matters within federal jurisdiction, contact the Office of the Privacy Commissioner of Canada. Professional-conduct concerns may be directed to your practitioner’s regulator: CRPO, OCSWSSW, or CPBAO, as applicable.

10. Policy changes

We will update this notice when information practices or relevant requirements change and identify the effective date. A change to this notice does not replace any new consent that the law requires. Contact us if you need an accessible copy or an explanation.