Privacy Policy and Statement of Information Practices

Last updated: August 20, 2026
 

Important Notice for Patients and Website Visitors

This Privacy Policy also serves as Active Ridge Physiotherapy’s public Statement of Information Practices under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). It explains how we collect, use, protect, retain, and disclose personal information and personal health information from your first interaction with us through the course of your physiotherapy care.
 

Who We Are and Who Is Accountable

Active Ridge Physiotherapy (“Active Ridge,” “we,” “us,” or “our”) is a physiotherapy practice located at 4087 Harvester Road, Unit 17, Burlington, Ontario L7L 0C1.

Robert (Rob) Vareta, Registered Physiotherapist and owner of Active Ridge Physiotherapy, is the Health Information Custodian and Privacy Contact responsible for the personal health information held by the practice. Any staff member, contractor, or service provider who handles information on behalf of Active Ridge must do so only as authorized and in accordance with applicable privacy obligations.

This policy applies to individuals who visit our website, contact the clinic, book an appointment, complete clinic forms, or receive physiotherapy services from us. We handle personal health information in accordance with PHIPA, applicable provisions of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the standards of the College of Physiotherapists of Ontario, and other applicable laws.
 

Information We Collect

General personal information

When you visit our website, contact the clinic, or request an appointment, we may collect information such as:

• Your name, email address, telephone number, and preferred method of contact

• Information you choose to provide about the reason for your inquiry

• Appointment requests and communication preferences

• Technical information such as IP address, browser type, device information, referral source, advertising interactions, and website activity collected through cookies or similar technologies, including Google Analytics and Google Ads measurement tools

• Payment and transaction information processed through Jane Payments and its authorized payment processor; Active Ridge does not directly store complete payment-card details
   

Personal health information

When you seek or receive physiotherapy services, we may collect personal health information such as:

• Identifying and contact information, date of birth, and emergency-contact details

• Relevant medical, health, injury, surgical, medication, activity, occupational, and family history

• Symptoms, functional limitations, goals, and information about the reason for seeking care

• Assessment findings, clinical impressions, outcome measures, treatment plans, consent discussions, treatment provided, exercise programs, progress notes, and discharge information

• Referrals, reports, correspondence, images, or other records relevant to your care

• Appointment, billing, payment, insurance, and direct-billing information

• Communications relevant to your condition or the physiotherapy services provided

Even basic information showing that a person has contacted or attended a physiotherapy clinic may be sensitive. We therefore limit collection to information reasonably necessary for the identified purpose.
 

How We Collect Information

We may collect information:

• Directly from you through the Active Ridge website, telephone calls, email, SMS, online booking, intake and consent forms, or in-person interactions

• Through Jane App, our clinic-management and electronic-record platform

• From a referring practitioner, family member, substitute decision-maker, insurer, lawyer, or another person, where you have authorized the collection or where the law permits it

• Through Jane Payments when you choose to save a payment method or make a payment

• Through TELUS eClaims within Jane App, participating insurers, and related claims-processing services when you request direct billing

• Automatically through website cookies and related technologies, as described below

Please avoid submitting detailed health information through a general website contact form, ordinary email, or SMS. We may ask you to continue a conversation by telephone, in person, or through another more secure method.
 

Why We Collect and Use Information

We may collect and use information to:

• Respond to inquiries and determine whether our services may be appropriate

• Schedule, confirm, change, and remind you about appointments

• Verify identity and maintain accurate contact information

• Assess your condition and provide, coordinate, document, and evaluate physiotherapy care

• Communicate with you about your care and provide requested resources or home-exercise information through an appropriate channel

• Obtain and document consent

• Process payments, issue receipts and invoices, and submit insurance or direct-billing claims at your request

• Meet legal, professional, quality-assurance, safety, accounting, and regulatory obligations

• Manage, secure, and improve clinic operations and the website

• Send marketing communications only where separate consent has been obtained or another lawful basis applies

We do not sell or rent personal information or personal health information. We do not use personal health information for marketing without express consent.
 

Consent

Consent under PHIPA must be knowledgeable, relate to the information and purpose involved, and be given voluntarily without deception or coercion. Depending on the circumstances, consent may be express or implied. We obtain express consent where required by law or where appropriate because of the sensitivity of the information or the nature of the proposed use or disclosure.

You may withhold or withdraw consent, or place certain restrictions on how your information is used or disclosed, by contacting us. A withdrawal cannot apply retroactively and may be subject to legal, professional, or contractual restrictions. If a restriction would affect our ability to provide safe or effective care, process a requested claim, or meet a legal obligation, we will explain the likely consequences.

Consent to receive SMS messages is optional and is separate from consent to receive physiotherapy services. Declining SMS does not affect your eligibility for care; you may communicate with us by telephone or email instead.
 

Children, capacity, and substitute decision-makers

Active Ridge provides services to patients of different ages. The ability to consent is based on capacity rather than age alone. A capable patient, including a capable minor, may make decisions about their personal health information. Where a patient is not capable of making a particular information decision, consent may be obtained from an authorized substitute decision-maker in accordance with Ontario law.
 

Information Practices During Your Relationship With Us

Before or while arranging care

When you make an inquiry or request an appointment, we may use your contact information and the limited details you provide to respond, determine next steps, and arrange care. Information submitted through general website, email, or SMS channels may be processed by the communication service providers identified below and should not include unnecessary clinical detail.
 

During and after physiotherapy care

Jane App is used as Active Ridge’s primary electronic clinical and financial record. Relevant consent, assessment, treatment, billing, and communication information is documented in the patient record as required by law and professional standards.

Administrative messages may remain temporarily within email or messaging systems. If an email or text exchange contains information relevant to your condition or care, the relevant information may be transferred to your official patient record. Duplicate copies are retained only as long as reasonably necessary for operational, legal, or security purposes and are then securely deleted where the platform allows.
 

Email, SMS, and Electronic Communications

SMS purposes and opt-in

With your affirmative consent, Active Ridge may send conversational SMS messages concerning:

• Responses to inquiries you have made

• Appointment scheduling, confirmation, reminders, changes, or cancellations

• Requested follow-up and other non-promotional administrative matters

You may opt in by selecting an SMS consent checkbox, completing a written or electronic communication consent, or initiating an SMS conversation with the clinic. If you initiate a text exchange, your consent extends to conversational replies related to that request; it does not enroll you in unrelated marketing messages. Merely providing a telephone number, without another affirmative action, does not by itself enroll you in SMS messaging.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for assistance. After opting out, you may receive one final message confirming that the request was processed. For complete details, review our SMS Terms and Conditions.
 

SMS Questions and Support

If you have questions about SMS communications, consent, or your communication preferences, contact Active Ridge Physiotherapy at (289) 907-3444, email info@activeridgephysio.com, or visit https://www.activeridgephysio.com/contact-us. You may also reply HELP for assistance or STOP to withdraw from SMS communications.
 

SMS Data Sharing, Access, and Safeguards

Active Ridge Physiotherapy does not sell, rent, transfer, share, disclose, or otherwise provide consumer data to external organizations for those organizations’ own use, including marketing or promotional purposes, under any circumstances, even with user consent, except where strictly required by applicable law.

Mobile telephone numbers and SMS opt-in or consent data are never shared with third parties or affiliates for their own marketing or promotional purposes. Limited SMS-related information may be processed by authorized service providers—including Grasshopper/GoTo, telecommunications carriers, and their subprocessors—solely as necessary to deliver, support, secure, and maintain the messaging service. These providers are not permitted to use SMS opt-in information for their own marketing purposes.

Access to SMS-related information is limited to authorized Active Ridge personnel and authorized service providers who require access for legitimate operational purposes. We protect this information using reasonable administrative, technical, and physical safeguards, including access restrictions, password-protected accounts and devices, multi-factor authentication where available, secure workspaces, confidentiality obligations, data-minimization practices, and procedures for responding to suspected privacy or security incidents.
 

Privacy limitations

Ordinary email and SMS are not guaranteed to be private, encrypted, timely, or error-free. Messages may be viewed by anyone with access to your device or account, sent to an outdated or incorrect address, intercepted in transit, or processed by service providers outside Canada.

To reduce these risks:

• We keep ordinary email and SMS communications brief and limit the amount of personal health information included

• We may verify your identity or contact information before communicating

• We do not use ordinary SMS for detailed assessment findings, diagnoses, treatment records, sensitive images, or extensive clinical advice

• We may redirect a conversation to telephone, in-person discussion, Jane App, or another appropriate channel

• We document clinically relevant communications in the patient record

Do not use SMS or email for emergencies or urgent medical concerns. These channels may not be monitored continuously. Call 911 or seek appropriate emergency assistance when necessary.
 

Marketing messages

Consent to administrative or care-related communications does not constitute consent to marketing. Promotional SMS or email messages, if offered, require a separate opt-in and include the required unsubscribe method.

We do not sell or share mobile telephone numbers or SMS opt-in information with third parties or affiliates for their own marketing or promotional purposes. We may disclose limited information to communication service providers solely to deliver messages, operate the service, maintain security, or comply with law.
 

When We Disclose Information

We disclose only the information reasonably necessary for the permitted purpose.
 

Providing and coordinating health care

Where permitted by PHIPA, we may rely on implied consent to share relevant personal health information with other health information custodians involved in providing or assisting in providing your care, unless you have instructed us otherwise. Depending on the circumstances, this may include a referring physician or another regulated health professional.
 

Insurance, payment, legal, and other disclosures

We may disclose information:

• To insurers, claims administrators, or benefits providers when you request or authorize direct billing, reimbursement, or related services

• To a person or organization you have expressly authorized, such as a lawyer, employer, family member, coach, or other third party

• To service providers acting on our behalf under appropriate privacy and security obligations

• Where disclosure is permitted or required by law, including a court order, mandatory report, regulatory investigation, or circumstances involving a significant risk of serious bodily harm

Express consent is obtained where required. We do not disclose information outside the permitted circle of care merely because another person requests it.
 

Service Providers and Processing Outside Canada

Active Ridge uses third-party services to operate the practice. These may include:

• Jane App: online booking, intake and consent forms, scheduling, clinical documentation, billing, secure messaging, and related clinic-management functions

• Jane Payments and its payment processor: payment-card processing, saved payment methods where authorized, refunds, and transaction administration; Active Ridge does not directly receive or store complete payment-card numbers

• TELUS eClaims through Jane App: insurer eligibility checks, electronic claim submission, direct billing, and claim responses when requested or authorized by the patient

• Wix: website and domain hosting functions, contact forms, security, cookies, and website functionality

• Google Workspace: business email, domain administration, document handling, and administrative communication

• Google Analytics and Google Ads: website analytics, advertising measurement, aggregated reporting, and conversion measurement, subject to the website’s cookie and consent settings

• Grasshopper/GoTo: business telephone and SMS communications

• Financial institutions and participating insurers: payment, direct billing, reimbursement, and claim administration when requested or authorized

We assess service providers based on the nature and sensitivity of the information involved and use reasonable contractual, administrative, and technical safeguards. Providers may use their own subprocessors where permitted by their terms.

Jane stores patient data in the regional data centre selected for the clinic; certain features, including some SMS and communications functions, may involve temporary processing outside Canada. Google, Wix, Grasshopper/GoTo, Jane Payments’ payment processor, telecommunications carriers, or their subprocessors may also store or process limited information outside Canada, including in the United States. TELUS eClaims and participating insurers process the insurance and claim information necessary to provide the direct-billing service requested by the patient.

Information processed outside Canada may be subject to the laws of the country where it is processed and may be accessible to courts, law-enforcement agencies, or government authorities in accordance with those laws. We limit the information sent through these services and select more secure channels when the sensitivity or circumstances require it.
 

Safeguards and Privacy Breaches

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, which may include:

• Role-based or need-to-know access to patient information

• Password-protected devices and accounts, multi-factor authentication where available, and current security software

• Encryption and security controls supplied by authorized service providers

• Private workspaces, secure disposal practices, and procedures for verifying recipients

• Data minimization and restrictions on sensitive information sent by ordinary email or SMS

• Privacy training and confidentiality expectations for anyone authorized to access information

• Procedures for responding to suspected privacy or security incidents

No system or method of transmission is completely secure. If a privacy breach occurs, we will contain and investigate it, reduce the risk of harm, notify affected individuals, and report to the Information and Privacy Commissioner of Ontario, the College of Physiotherapists of Ontario, or others where required by law.
 

Retention and Secure Disposal

Clinical and financial patient records are retained for at least the period required by the College of Physiotherapists of Ontario:

• Adult patients: at least 10 years from the date of the last patient encounter

• Patients who are children: at least 10 years from the date the patient reached, or would have reached, 18 years of age

Where more than one retention requirement applies, we follow the longer applicable period.

General inquiry information that does not become part of a patient record is retained only as long as reasonably necessary for the inquiry, clinic operations, legal requirements, or security. As a general practice, we aim to delete or anonymize inactive inquiry information within 24 months of the last meaningful interaction unless there is a lawful reason to retain it longer.

Website and communication-system information is retained in accordance with operational needs, legal requirements, and provider settings. When information is no longer required, we securely delete, destroy, or anonymize it, subject to technical limitations and backup-retention cycles.
 

Your Privacy Rights

Subject to limited exceptions under PHIPA and other applicable law, you may:

• Ask whether we hold personal health information about you

• Request access to, or a copy of, your patient record

• Request correction of information you believe is inaccurate or incomplete

• Withdraw consent for certain future uses or disclosures

• Ask us not to disclose part of your record to certain health care providers, sometimes referred to as a consent directive or “lock box”

• Ask questions about how your information is collected, used, stored, or disclosed

• Complain about our privacy practices without affecting your access to appropriate care

We will respond to formal access or correction requests within the timelines required by law, generally within 30 days, subject to permitted extensions and exceptions. We may need to verify your identity and may charge a reasonable, cost-based fee where permitted.

To exercise a privacy right, contact the Privacy Contact listed below. If you are not satisfied with our response, you may contact the Information and Privacy Commissioner of Ontario.
 

Cookies and Website Technologies

Our Wix website uses essential cookies and may use Google Analytics, Google Ads tags, and similar technologies for security, navigation, form functionality, audience measurement, advertising attribution, and conversion reporting. These technologies may collect IP address, approximate location, browser or device information, referring pages, advertising interactions, and interactions with the website.

We do not intentionally place patient charts, treatment notes, insurance details, or other clinical records into Google Analytics, Google Ads, or other website analytics or advertising tools. We do not upload Jane patient lists or use personal health information from patient records to create advertising audiences. Website forms and analytics tags should be configured so that names, email addresses, telephone numbers, free-text health details, and other directly identifying or sensitive information are not sent to Google Analytics or Google Ads.

Non-essential analytics and advertising technologies are used subject to applicable consent requirements and the cookie controls offered on the website. You can also manage cookies through your browser settings. Declining or disabling non-essential cookies may affect website measurement or some website functionality but does not prevent you from contacting the clinic or receiving physiotherapy services.
 

Changes to This Policy

We may update this policy to reflect changes in law, professional standards, technology, service providers, or clinic practices. The current version will be posted on our website with its “Last updated” date. Where a change materially affects how we handle personal health information, we will provide additional notice where appropriate or required.
 

Contact Us

Questions, concerns, privacy requests, or complaints may be directed to:

Rob Vareta, Registered Physiotherapist
Health Information Custodian and Privacy Contact

Active Ridge Physiotherapy
4087 Harvester Road, Unit 17
Burlington, Ontario L7L 0C1

Telephone/SMS: (289) 907-3444
Email: info@activeridgephysio.com
Website: https://www.activeridgephysio.com/
 

You may also contact:

Information and Privacy Commissioner of Ontario
Website: https://www.ipc.on.ca/
Telephone: 1-800-387-0073

 

This document serves as Active Ridge Physiotherapy’s public Statement of Information Practices under section 16 of PHIPA.

​