Download the Privacy Policy (PDF, 110 KB)
Date established: December 8, 2012. Last revised and reviewed: April 2026.
1. Purpose
To provide specialized clinical services, AlphaBee must collect, use, and disclose personal information to develop and deliver individualized support plans.
This Privacy Policy outlines how AlphaBee manages personal information in compliance with applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario’s Personal Health Information Protection Act (PHIPA), where applicable.
Where required, AlphaBee operates as either a Health Information Custodian or an Agent, as defined under PHIPA, depending on the nature of the services provided and contractual relationships.
2. Commitment to Privacy
AlphaBee is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us.
We will:
- Clearly explain why and how personal information is collected, used, and disclosed
- Obtain consent where required
- Limit collection to what is necessary for service delivery
- Safeguard all personal information using appropriate security measures
- Provide individuals with access to, and the ability to correct, their personal information
3. Scope
This policy applies to all individuals acting on behalf of AlphaBee, including:
- Employees
- Contractors and consultants
- Students and volunteers
- Third-party service providers
All individuals with access to personal information are required to comply with this policy and applicable privacy legislation.
4. Definitions
Personal Information
Information about an identifiable individual, including but not limited to name, contact information, age, health information, and service history.
Personal Health Information (PHI)
Identifying information relating to an individual’s physical or mental health, or the provision of health care, as defined under PHIPA.
Privacy Officer
The individual designated to oversee compliance with this policy and applicable privacy legislation.
Consent
Voluntary agreement to the collection, use, or disclosure of personal information. Consent may be express or implied, depending on the circumstances and legal requirements.
Use
The handling of personal information within the organization.
Disclosure
The release of personal information outside the organization.
5. Accountability
5.1 Leadership Responsibility
The CEO or designate is responsible for approving this policy and ensuring appropriate processes, training, and oversight are in place to support compliance.
5.2 Staff Responsibility
All individuals acting on behalf of AlphaBee must:
- Protect personal information
- Access only the information necessary for their role
- Report any actual or suspected privacy breaches immediately
- Comply with this policy and applicable legislation
All staff are required to sign a confidentiality agreement. These obligations continue after employment or affiliation ends.
6. Collection of Personal Information
AlphaBee collects personal information only as necessary to:
- Assess client needs and determine service suitability
- Develop individualized support plans
- Assign appropriately trained staff
- Ensure health, safety, and regulatory compliance
We will:
- Identify the purpose of collection before or at the time of collection
- Collect only the minimum amount of information required
- Use approved forms and standardized processes
Examples of information collected may include:
- Identification and contact information
- Service preferences and goals
- Behavioural and clinical information
- Health and safety information (e.g., emergency contacts, relevant medical details)
Participation in quality improvement activities (e.g., surveys) is voluntary and based on express consent.
7. Consent
AlphaBee obtains consent for the collection, use, and disclosure of personal information in accordance with applicable legislation.
- Express consent is obtained when required, particularly for disclosure to third parties
- Implied consent may be relied upon where appropriate and permitted by law (e.g., for service delivery within the circle of care)
- Consent may be withdrawn at any time, subject to legal or contractual limitations
Where an individual lacks capacity, consent will be obtained from a substitute decision-maker.
AlphaBee will explain the implications of refusing or withdrawing consent where it may impact service delivery.
8. Use, Disclosure, and Retention
Personal information will only be used or disclosed:
- For the purposes for which it was collected
- With consent, where required
- As permitted or required by law
Information may be shared internally on a need-to-know basis for service delivery, supervision, and quality assurance.
Personal information may also be disclosed:
- To authorized third parties with consent
- In situations involving risk of serious harm
- Where required by law or regulatory authorities
Retention
Records are retained in accordance with AlphaBee’s Records Retention Schedule and applicable legal, regulatory, and contractual requirements. When no longer required, records are securely destroyed or de-identified.
9. Accuracy
AlphaBee takes reasonable steps to ensure that personal information is accurate, complete, and up to date as necessary for its intended use.
Individuals may request corrections to their information at any time.
10. Safeguards
AlphaBee implements appropriate safeguards to protect personal information, including:
- Physical safeguards: secure storage, restricted access areas
- Technical safeguards: password protection, encryption, secure systems
- Administrative safeguards: policies, training, and access controls
These safeguards apply to both physical and electronic records, including remote and mobile access where applicable.
11. Privacy Breaches
A privacy breach includes unauthorized access, use, disclosure, loss, or theft of personal information.
In the event of a breach, AlphaBee will:
- Contain and assess the breach
- Notify affected individuals where appropriate
- Report to regulatory authorities where required under law
- Take steps to prevent recurrence
12. Openness and Transparency
This policy is available upon request and may be published on the organization’s website.
Questions or concerns about privacy practices may be directed to the Privacy Officer.
13. Individual Access
Individuals have the right to request access to their personal information.
Requests must:
- Be submitted in writing
- Include sufficient detail to identify the records requested
AlphaBee will respond within 30 days, unless an extension is permitted by law.
Access may be limited where disclosure:
- Could result in harm
- Involves another individual’s information
- Is otherwise restricted by law
Identity verification may be required prior to release.
14. Challenging Compliance
Individuals may raise concerns regarding AlphaBee’s privacy practices.
All complaints will be reviewed by the Privacy Officer. Where necessary, corrective action will be taken, including updates to policies and procedures.
Individuals may also contact the appropriate regulatory authority if concerns are not resolved.
15. Services Provided to Third Parties
Where AlphaBee provides services on behalf of another organization (e.g., school, hospital, or agency):
- The handling of personal information will be governed by applicable agreements and legislation
- AlphaBee will comply with the privacy requirements of the contracting organization
- Responsibility for personal information will be defined within service agreements
16. Records and Documentation
- Client intake forms
- Clinical and service records
- Confidentiality agreements
- Third-party service agreements