Introduction
This Privacy Policy governs the manner in which Ontario Speech & Language Services (the “Company”, “we” or “us”) operates its websites, and acts as a Health Information Custodian (HIC) under Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”). This policy describes how we collect, use, maintain, and disclose personal information of users (each, a “User”) of any active website belonging to Ontario Speech & Language Services.
This Policy is designed to ensure the Company’s compliance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”), Personal Health Information Protection Act, 2004 (“PHIPA”), the Canada Anti-Spam Legislation (“CASL”), Ontario Regulation 164/15, made under the Audiology and Speech-Language Pathology Act, 1991 and other applicable privacy laws and regulations of Ontario, Canada (the “Applicable Law”).
By using any website operated by the Company, you acknowledge and accept the terms of this Privacy Policy.
Information Collection
The Company collects information through various channels including spoken responses during phone calls, typed inputs via chat interfaces, and written submissions. Regardless of how information is collected, we maintain the same privacy standards and safeguards. The Company collects two main types of information:
- Personal Information: This is any information that can identify you, such as:
- Your name, address, phone number, email address, and date of birth;
- Names and contact details of individuals involved in your care (your “Circle of Care”), such as family doctors, specialists, school staff, and caregivers;
- Names and contact details of substitute decision-makers or legal representatives;
- Contact information of the person arranging appointments, if not the client.
- Health Information: This includes information about your physical and mental health, such as:
- Medical history (e.g., prenatal/perinatal details, developmental milestones, diagnoses, medications, injuries);
- Health assessments, referrals, and treatments from healthcare providers (past and current)
- Family health history (e.g., biological parents, siblings, grandparents, aunts/uncles, first cousins);
- Environmental context affecting health or development (e.g., daycare, school attendance, screen time, social/play activities);
- Educational and behavioural information relevant to speech-language development (e.g., reading ability, social or play skills, concerns from educators);
- Preferred appointment times or availability for therapy.
For Users under the age of 18, we require consent from a substitute decision-maker (typically a parent or legal guardian) who has the legal authority to make decisions about the minor’s personal health information. We take reasonable steps to verify the authority of substitute decision-makers, in accordance with applicable capacity and consent standards under Applicable Law. If the minor is capable of consenting to the collection, use, or disclosure of their personal health information, their consent will be sought directly.
If a user interacts by phone, the conversation may be transcribed in real time or retained in audio form for documentation and quality assurance purposes. Transcripts and audio recordings, if retained, are stored in encrypted systems and handled in accordance with the Company’s Data Retention & Deletion Policy and Applicable Laws. Voice data processed through third-party providers is subject to contractual safeguards and may be temporarily stored for processing before secure deletion.
The method of interaction – spoken or typed – does not alter the type or sensitivity of information collected. All safeguards and legal protections described in this Policy apply equally to both communication channels, including those related to consent, access, security, and disclosure of personal information and personal health information.
Cookies and Tracking Technologies
Our website and online services use cookies and similar technologies to enhance user experience, analyze website usage, and support our marketing efforts. We categorize cookies as essential, analytics, or advertising cookies. Some cookies are strictly necessary for the proper functioning of our website, while others, such as Google Ads tracking cookies or CallRail tracking tools, help us understand how users interact with our services.
Non-essential cookies will only be set if you consent through our cookie banner or browser settings, in accordance with Applicable Law. Users may withdraw cookie consent at any time through our cookie banner or browser settings.
Use of Information
The information collected by the Company from Users, as part of the speech-language pathology screening, assessment, referral, and internal operational processes, is used for the purposes of providing, improving, and personalizing our services, including comprehensive evaluation of speech-language concerns and coordination with the client’s circle of care. This includes, but is not limited to, the following uses:
- Assessing the needs and eligibility of Users for specific services.
- Facilitating the referral process to appropriate services or specialists.
- Improving service delivery and operational efficiency.
- Internal administrative purposes, including but not limited to, data analysis, audits, developing new services, enhancing, improving or modifying our services, identifying usage trends, and determining the effectiveness of our promotional campaigns.
Disclosure of Information
This section outlines the circumstances under which the Company may disclose personal information collected from Users to third parties. The Company is committed to safeguarding the privacy and security of Users’ information.
Information may be shared internally within the Company’s organization for the purpose of providing and improving services, as well as ensuring compliance with legal obligations. With your consent or as permitted by law, personal health information may be shared within your Circle of Care to facilitate coordinated healthcare delivery and referrals. External sharing of information may also occur under the following conditions:
- With service providers and third-party vendors who perform services on behalf of the Company, including healthcare providers and specialists within your Circle of Care who are involved in your assessment, treatment, or referral process.
- In response to legal requests or requirements from government authorities, such disclosure is necessary to comply with the law or protect the rights, property, or safety of the Company, its clients, or others.
- In the event of a merger, acquisition, or sale of all or a portion of the Company’s assets, Users will be notified via email and/or prominent notice on our website of any change in ownership or uses of their personal information, as well as any choices they may have regarding their personal information.
Cross-Border Data Transfers
The Company may, at any time, use may AI, a subsidiary of the Company, which uses artificial intelligence services provided by OpenAI and voice synthesis services provided by Eleven Labs, both of which are based in the United States. In the course of delivering our services, personal health information and other personal data may be processed or temporarily stored in the U.S., including temporary voice data retention by Eleven Labs for processing purposes.
As a Health Information Custodian under Applicable Law, we retain custody and control over this information at all times. However, when data is processed outside Canada, it may be subject to the laws of the foreign jurisdiction, including lawful access by U.S. government authorities.
Security Measures
The Company is committed to protecting the privacy and security of the personal information of the Users. To this end, the Company employs a variety of security measures designed to protect the personal information it collects and maintains. These measures include, but are not limited to, the following:
- Secure data storage: Personal information is stored in secure environments that are protected from unauthorized access, use, disclosure, alteration, or destruction.
- Data encryption: Sensitive personal information is encrypted during transmission over the Internet and while stored on our systems.
- Access control: Access to personal information is limited to personnel who require it to perform their job functions. These individuals are subject to confidentiality obligations and may be subject to discipline, including termination and criminal prosecution, if they fail to meet these obligations.
We regularly review and update our security measures to keep pace with technological advancements. While we take all reasonable precautions to protect your information, it’s important to note that no security system is completely impenetrable. If a privacy breach occurs that impacts personal health information, we follow Applicable Law guidelines by quickly informing affected individuals and notifying the appropriate authorities. We will conduct an internal investigation to strengthen our security measures and reduce the risk of future breaches.
Data Retention and Deletion
Generally, health records are kept for a minimum of 10 years, or for minors, until 10 years after they reach 18. Personal data is retained only as long as necessary for its collection purpose and in compliance with legal obligations. Upon expiration of these periods, data will be securely deleted unless further retention is required by law or justified by ongoing business needs.
Users may request data deletion under certain conditions, and such requests will be processed according to legal requirements. For precise retention periods and deletion procedures, please consult our Data Retention & Deletion Policy.
Rights of Users
Under Ontario privacy laws, you have several important rights regarding your personal information. You have the right to request access to personal information and personal health information about you held by the Company. Upon written request, we will provide you with access to your information, subject to certain legal exceptions (e.g., where disclosure would likely result in harm to another individual or reveal confidential commercial information).
If you believe that your personal information or personal health information in our records is inaccurate or incomplete, you have the right to request a correction. If we do not agree with the correction you request, we will annotate the record to reflect that a correction was requested but not made, as required by law.
We will respond to access or correction requests as soon as reasonably possible and no later than 30 calendar days from the date the request is received. If we require additional time to respond, we may extend the timeline by up to an additional 30 days, as permitted by law, and we will provide you with written notice of the extension and the reasons for it. Any fees charged for providing access to your information will be limited to reasonable cost-recovery fees, as permitted by Applicable Law. You will be informed in advance of any applicable charges.
Users wishing to exercise any of these rights may contact the Company directly using the contact information provided below.
Withdrawal of Consent and Complaints
If you have provided consent for the processing of your personal data to the Company, you have the right to withdraw your consent at any time. Withdrawal of consent applies prospectively and does not affect the use or disclosure of information made before the withdrawal.
Please note that certain information may need to be retained to comply with legal obligations, such as the minimum retention periods for health records, or to protect legitimate business interests. We may continue to retain and use personal health information as required or permitted by law, even after consent is withdrawn.
For detailed instructions on how to withdraw your consent, please consult our Withdrawal of Consent & Complaints Policy.
Policy Updates
We may update this Privacy Policy from time to time as we enhance our services, respond to new legal requirements, or improve how we handle personal information. The Company will post any updated Privacy Policy on our website with a new “Last Updated” date. We encourage Users to review our Privacy Policy whenever they access our services to stay informed about our information practices and the ways they can help protect their privacy. Where required by law, we will seek your consent for any material changes.
Contact Information
If you have any questions about this Privacy Policy or our treatment of your personal information, or if you wish to make a complaint about how your personal data is being processed by the Company, please refer to the contact information provided in our Withdrawal of Consent & Complaints Policy, which contains the most up-to-date contact details for our Privacy Officer.
All inquiries and complaints will be addressed by our designated Privacy Officer as detailed in our Withdrawal of Consent & Complaints Policy. We aim to acknowledge complaints within five (5) business days and respond within thirty (30), where feasible.
You may also lodge a complaint with the Information and Privacy Commissioner of Ontario:
- Website: https://www.ipc.on.ca/
- Phone: 1-800-387-0073
- Mailing Address: 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8