Protection of Personal Health Information (PHIPA) Lemons into Lemonade Counselling Services

Christina (Tina) Bendo, MSW, RSW

Registered Business Name: Lemons into Lemonade Counselling

Services Effective Date: April 2026

Lemons into Lemonade Counselling Services is committed to protecting the privacy and confidentiality of your personal health information (PHI) in accordance with the Personal Health Information Protection Act, 2004 (PHIPA), the Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, and the professional standards of the Ontario College of Social Workers and Social Service Workers (OCSWSSW).

As a health information custodian under PHIPA, I, Christina (Tina) Bendo, MSW, RSW, am responsible for the personal health information under my control.

1. What is Personal Health Information (PHI)?

PHI includes any information that identifies you and relates to your physical or mental health, family health history, health care received, or payment for health care. Examples include your name, contact information, intake forms, session notes, diagnosis, treatment plans, and any communications with my practice.

2. What PHI Do I Collect and How?

I collect PHI directly from you (or your substitute decision-maker) when you:

• Book an appointment (online or by phone/email)
• Complete intake or assessment forms
• Attend counselling sessions (in-person or virtual)
• Communicate with me by phone, email, or secure messaging

I may also collect limited information from other sources with your consent or as permitted by law (for example, referral information from another provider). I only collect the minimum information necessary to provide safe and effective counselling services.

3. How I Use and Disclose Your PHI

I use and disclose your PHI only for the purposes to which you have consented, or as allowed or required by law. These purposes include:

• Providing you with counselling, therapy, and related services (including within the “circle of care” with other health professionals when you consent)
• Billing and processing payments (e.g., e-transfer)
• Communicating with you about appointments or care
• Fulfilling legal or regulatory requirements
• Improving services (using fully de-identified data only)

I will never sell your PHI or use it for marketing without your explicit consent.

4. Consent

By booking services and/or attending sessions, you are providing consent for me to collect, use, and disclose your PHI for the purposes outlined above. I will also obtain more detailed written or electronic consent during our intake process. You may withdraw your consent at any time by contacting me in writing. Withdrawal of consent may affect my ability to provide services.

Lockbox Option: You may also instruct me to restrict (“lock”) certain parts of your PHI from use or disclosure. I will honour your instructions unless doing so would compromise your care or violate the law.

5. Limits to Confidentiality (When I May Disclose Without Consent)

Confidentiality is fundamental to counselling, but there are important legal and ethical limits. I may disclose PHI without your consent if:

• There is reason to believe you or someone else is at imminent risk of serious bodily harm
• There is suspected child abuse or neglect (mandatory reporting under the Child, Youth and Family Services Act)
• I am required by court order or other legal authority
• It is otherwise permitted or required under PHIPA or other laws

In these situations, I will disclose only the minimum information necessary. Where possible and lawful, I will notify you afterward.

6. Security and Safeguards for Your Information

I take reasonable steps to protect your PHI against theft, loss, unauthorized access, use, disclosure, copying, or modification (as required by PHIPA section 12).

Important – Email Communication Warning My primary contact email is a standard Gmail account. Gmail is NOT encrypted end-to-end and is not considered a secure method for transmitting sensitive personal health information. Emails sent through Gmail can be intercepted or accessed by unauthorized parties.

For your protection, please do NOT send any sensitive or private information (such as details about your mental health, personal history, or session-related matters) via email. Instead, please call me directly at 289-919-5500 to discuss any sensitive matters. I will then arrange the safest way to communicate or handle the information.

All clinical records are stored in secure, password-protected systems or locked physical files. Only authorized personnel have access.

7. Access and Correction of Your Records

You have the right to:

• Request access to your PHI (with some limited exceptions)
• Request correction of inaccurate or incomplete information

To make a request, please contact me in writing. There may be a reasonable fee for copying or preparing records. I will respond within 30 days as required by PHIPA.

8. Retention and Destruction of Records

I retain your records for at least 10 years after the date of the last service (or at least 10 years after you turn or would have turned 18 if you were a minor at the time of the last service), in accordance with OCSWSSW standards and PHIPA. When records are no longer needed, they are destroyed securely so that the information cannot be reconstructed.

9. Complaints or Questions About Privacy

If you have questions, concerns, or wish to complain about how I have handled your PHI, please contact me directly:

Christina (Tina) Bendo, MSW, RSW Lemons into Lemonade Counselling Services Email: info@lemonsintolemonade.ca Phone: 289-919-5500

You also have the right to complain to the Information and Privacy Commissioner of Ontario (IPC): Website: https://www.ipc.on.ca Phone: 416-326-3333 or 1-800-387-0073

10. Changes to This Privacy Policy

I may update this policy from time to time. The most current version will always be posted on my website (lemonsintolemonade.ca). I will notify you of any material changes that affect how I handle your PHI. By continuing to receive services after changes are posted, you are deemed to accept the updated policy.