Privacy notice

Who is responsible

What is collected

• From the referral: the child's name, date of birth, sex, health card number and version code, address and preferred language; the parent or guardian's name, relationship, email address and phone number; the reason for referral, history, medications, treatments tried and other providers; any attached documents; and the referring clinician's name, role, clinic, billing number, fax, phone and email.
• From the intake questionnaire: the family's answers about bowel and bladder history, fluids and diet, routines, school and development, family history, prior treatments and goals, and a record of the consents given (with the time and a hashed network address).
• From visits and billing: appointment dates, attendance, invoices for uninsured services, and the clinical notes kept in the clinic's electronic medical record.
• From the website: a technical log of requests (a hashed network address, browser type and time) kept for security, and cookieless page statistics that do not identify anyone.
• From the referral opening sign-up and the contact form: the name, email address, role and clinic or organisation of people who sign up or write to the clinic, the message itself, and a record of the consent given (for the sign-up, the wording version, the time and a hashed network address).

Why it is used

• To decide whether the clinic can accept the referral, to contact the family, to validate the health card, to book and provide care, to communicate with the referring clinician and other providers involved in the child's care, and to bill OHIP or invoice uninsured services.
• To keep the records the law requires, to meet CPSO and CMPA expectations on tracking referrals and results, and to review and improve the clinic's own processes using counts and timings that do not identify anyone.
• To send the referral opening announcement, and clinician network updates, to people who asked for them, and to reply to messages. Addresses are never shared or sold.

Where information is stored and processed

• The application and its database run on servers in Toronto, Ontario (Fly.io and its managed PostgreSQL service). Personal health information is encrypted in the database with a key held by the clinic, and attachments are stored encrypted in Toronto.
• Referral review: the physician reviews every referral using the clinic's written referral criteria. Software on the clinic's own servers checks referrals for completeness and flags answers that may need urgent care. Referral text is not sent to any artificial intelligence service.
• Invoices for uninsured services are issued through Stripe, which processes card payments. Stripe receives the payer's name, email address and the invoice description, never clinical information.
• Email is sent through Google Workspace. Emails carry reference codes and links only; the one exception is the child's first name in messages addressed to a parent or guardian.
• Cloudflare provides the domain's DNS, protection against automated abuse of the public forms, and, when enabled, network security in front of the site.
• Plausible provides cookieless page statistics that do not identify visitors and are never collected on the staff or intake pages.
• Clinical notes and OHIP billing live in the clinic's electronic medical record, which is a separate Ontario-hosted system covered by its own privacy documentation.

How information is protected

• Encryption in transit and at rest, field-level encryption of personal health information, and encrypted attachments.
• Staff access requires a password and a second factor, sessions expire after inactivity, and every access to a referral is recorded in a tamper-evident audit log.
• Access is limited to the physician and to administrative staff who need it, and administrative staff cannot read clinical content.
• The clinic's software vendors are bound by written agreements covering confidentiality and security.

How long information is kept

• Clinical records are kept for at least 10 years after the last entry, or, for a child, until the child turns 28, whichever is later, as CPSO requires.
• Website security logs are kept for 90 days. Statistics are kept in aggregate only.
• Sign-up records are kept while the person stays on the list. After an unsubscribe the address is no longer emailed, and the record of the sign-up and the consent is kept as proof of that consent.

Your rights

• Parents and guardians, and capable young people, may ask to see or receive a copy of the record, ask for a correction, and ask how information has been used or shared.
• You may withdraw consent for future uses that are not required by law, and you may ask that information not be shared with a particular provider. The clinic will explain any effect on care.
• Requests and questions go to referrals@bbdclinic.ca. Please do not include health details in ordinary email; the clinic will arrange a secure way to exchange them.
• If you are not satisfied with the clinic's response, you may contact the Information and Privacy Commissioner of Ontario.

If something goes wrong

If personal health information is lost, stolen or accessed without authority, the clinic will notify the affected individuals at the first reasonable opportunity, notify the Information and Privacy Commissioner of Ontario where required, and record the incident. To report a privacy concern, contact referrals@bbdclinic.ca.

Changes to this notice

This notice is reviewed when the clinic's systems or vendors change. The current version is always the one published on this page.