Privacy Policy

1. Introduction

BridgeMed Health Inc. (“BridgeMed Health,” “we,” “us,” or “our”) is a Canadian, psychiatrist-led mental health provider headquartered at 1410-181 University Avenue, Toronto, Ontario M5H 3M7. We deliver Functional Psychiatric Assessments (FPAs) and Return-to-Work (RTW) Function-Focused Psychotherapy to plan members of insurer, group benefit provider, and employer partners across Canada. [VERIFY WITH NIRAL'S COUNSEL]

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information and personal health information when you visit our website, interact with our team, or receive clinical services from us. It is written to align with the Personal Health Information Protection Act, 2004 (Ontario) (“PHIPA”) and the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”). [VERIFY WITH NIRAL'S COUNSEL]

By using bridgemedhealth.com (the “Website”) or receiving services from BridgeMed Health, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any portion of this Policy, please discontinue use of the Website and notify us in writing. [VERIFY WITH NIRAL'S COUNSEL]

2. Who We Are

BridgeMed Health Inc. is an Ontario corporation operating a psychiatrist-led virtual mental health practice. Our clinicians are licensed in the Canadian jurisdictions in which they deliver care. Under PHIPA, our psychiatrists are “health information custodians” with respect to personal health information they collect, use, and disclose in the course of providing clinical services to plan members. [VERIFY WITH NIRAL'S COUNSEL]

Our Privacy Officer is responsible for compliance with this Policy and applicable privacy legislation. Contact details for the Privacy Officer are provided in Section 14 of this Policy. [VERIFY WITH NIRAL'S COUNSEL]

3. Information We Collect

The information we collect depends on how you interact with BridgeMed Health. We endeavour to collect only the information reasonably necessary to provide our services and operate our Website. [VERIFY WITH NIRAL'S COUNSEL]

We do not knowingly collect personal information from individuals who are not plan members referred to our services, except for the contact information of case managers, family physicians, and other authorized parties acting in a professional capacity. [VERIFY WITH NIRAL'S COUNSEL]

4. Lawful Basis For Collection And Use

We collect, use, and disclose personal information and personal health information on the following lawful bases: [VERIFY WITH NIRAL'S COUNSEL]

• Express consent under PHIPA. Plan members provide express consent for the collection, use, and disclosure of personal health information for the purposes of clinical assessment and treatment, including coordination with their case manager and family physician. [VERIFY WITH NIRAL'S COUNSEL]
• Implied consent within the circle of care. Where permitted under PHIPA, we may rely on implied consent for the disclosure of personal health information to other health information custodians for the purpose of providing health care to the plan member. [VERIFY WITH NIRAL'S COUNSEL]
• Consent under PIPEDA. For personal information that is not personal health information, we rely on the consent of the individual, obtained at the time of collection or use, in accordance with PIPEDA. [VERIFY WITH NIRAL'S COUNSEL]
• Statutory authority or court order. We may collect, use, or disclose personal information where required or permitted by law, including by order of a court or tribunal of competent jurisdiction. [VERIFY WITH NIRAL'S COUNSEL]

5. How We Use Your Information

BridgeMed Health uses the information we collect strictly for the purposes for which it was collected and for related, compatible purposes. Specifically: [VERIFY WITH NIRAL'S COUNSEL]

• Clinical care. To conduct Functional Psychiatric Assessments, deliver RTW Function-Focused Psychotherapy, and provide related clinical services to plan members. [VERIFY WITH NIRAL'S COUNSEL]
• Return-to-work reporting. To prepare written reports, functional capacity summaries, and accommodation recommendations for the plan member's case manager and family physician. [VERIFY WITH NIRAL'S COUNSEL]
• Case manager coordination. To communicate with the plan member's assigned disability case manager regarding clinical status, recommended treatment, and return-to-work readiness, in accordance with consent. [VERIFY WITH NIRAL'S COUNSEL]
• Family physician (GP) coordination. To share clinical findings, recommendations, and follow-up communications with the plan member's primary care physician, in accordance with consent. [VERIFY WITH NIRAL'S COUNSEL]
• Service administration. To schedule appointments, deliver virtual care via our telemedicine platform, issue invoices, and maintain clinical records as required by applicable professional and legal standards. [VERIFY WITH NIRAL'S COUNSEL]
• Website operation and improvement. To operate, maintain, and improve the Website and to understand how visitors interact with our content. [VERIFY WITH NIRAL'S COUNSEL]
• Legal and regulatory compliance. To meet our obligations under applicable law, professional regulation, and contractual commitments with partners. [VERIFY WITH NIRAL'S COUNSEL]

We do not use personal information or personal health information for third-party marketing, advertising profiling, or sale to data brokers. We do not sell, rent, or trade plan member information under any circumstances. [VERIFY WITH NIRAL'S COUNSEL]

6. Disclosure Of Information

BridgeMed Health discloses personal information and personal health information only as required to deliver clinical services or as permitted or required by law. Disclosures are limited to the minimum information reasonably necessary for the disclosed purpose. [VERIFY WITH NIRAL'S COUNSEL]

Recipients of disclosed information may include: [VERIFY WITH NIRAL'S COUNSEL]

• The plan member's case manager, as authorized by the plan member's signed consent and reasonably required for case management and return-to-work planning. [VERIFY WITH NIRAL'S COUNSEL]
• The plan member's family physician (GP) or other treating health information custodians within the circle of care. [VERIFY WITH NIRAL'S COUNSEL]
• Authorized service providers retained by BridgeMed Health to support our operations — for example, our telemedicine platform vendor, hosting providers, and professional advisors — each of whom is bound by written confidentiality obligations consistent with this Policy. [VERIFY WITH NIRAL'S COUNSEL]
• Regulatory and professional bodies, where required by law, professional college obligations, or in response to a lawful order. [VERIFY WITH NIRAL'S COUNSEL]
• Successor entities, in the event of a corporate reorganization, merger, or sale of assets, subject to confidentiality and notice obligations. [VERIFY WITH NIRAL'S COUNSEL]

We do not disclose plan member personal health information to employers, insurers, or third parties for purposes of adjudication, underwriting, or marketing, except where the plan member has provided express written consent or such disclosure is required by law. [VERIFY WITH NIRAL'S COUNSEL]

7. Storage, Retention, And Security

BridgeMed Health stores personal information and personal health information on servers located in Canada, except where stated otherwise and disclosed to the plan member at the time of collection. Our telemedicine platform is operated to align with SOC 2 Type II controls and applicable Canadian health privacy standards. [VERIFY WITH NIRAL]

We implement administrative, physical, and technical safeguards to protect against unauthorized access, use, disclosure, alteration, or destruction of information in our custody, including: [VERIFY WITH NIRAL]

• Encryption of personal health information at rest and in transit using current industry-standard cryptographic protocols. [VERIFY WITH NIRAL]
• Role-based access controls limiting access to personal health information to authorized clinicians and staff with a need-to-know. [VERIFY WITH NIRAL'S COUNSEL]
• Multi-factor authentication for clinician and staff access to the BridgeMed Health platform. [VERIFY WITH NIRAL]
• Routine system monitoring, vulnerability management, and security audits. [VERIFY WITH NIRAL]
• Written confidentiality and privacy training requirements for all personnel. [VERIFY WITH NIRAL'S COUNSEL]
• Documented incident response and breach notification procedures. [VERIFY WITH NIRAL'S COUNSEL]

We retain personal health information for the period required by applicable professional regulation and clinical record-keeping standards, and personal information for the period reasonably required to fulfil the purposes set out in this Policy. When information is no longer required, it is securely destroyed or de-identified in accordance with our records retention schedule. [VERIFY WITH NIRAL'S COUNSEL]

No method of electronic transmission or storage is completely secure. While we apply commercially reasonable safeguards to protect information in our custody, we cannot guarantee absolute security. [VERIFY WITH NIRAL'S COUNSEL]

8. Your Rights Under PHIPA And PIPEDA

Plan members and other individuals whose information is held by BridgeMed Health have the following rights, subject to limitations set out in applicable law: [VERIFY WITH NIRAL'S COUNSEL]

• Right of access. You may request access to your personal health information held by BridgeMed Health. We will respond to access requests within the timelines required under PHIPA, normally within thirty (30) days. [VERIFY WITH NIRAL'S COUNSEL]
• Right of correction. You may request that we correct personal information or personal health information you believe to be inaccurate or incomplete. Where a correction is not made, you may require us to attach a statement of disagreement to the record. [VERIFY WITH NIRAL'S COUNSEL]
• Right to withdraw consent. You may withdraw or vary your consent to the collection, use, or disclosure of your personal information or personal health information at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to continue providing clinical services to you. [VERIFY WITH NIRAL'S COUNSEL]
• Right to file a complaint. You may submit a complaint regarding our handling of your information to our Privacy Officer using the contact details in Section 14. You may also submit a complaint directly to the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada. [VERIFY WITH NIRAL'S COUNSEL]

BridgeMed Health does not charge a fee for routine access or correction requests. Where a request is voluminous or extraordinary, we may charge a reasonable cost-recovery fee in accordance with applicable law and will notify you of the fee in advance. [VERIFY WITH NIRAL'S COUNSEL]

9. Cookies And Website Tracking

The Website uses only essential cookies required for site operation and security — for example, to maintain session state and protect against cross-site request forgery. We do not deploy advertising cookies, third-party marketing trackers, or behavioural retargeting pixels. [VERIFY WITH NIRAL'S COUNSEL]

We collect limited, aggregated Website analytics for the purpose of understanding how visitors engage with our content and improving the user experience. Analytics data is collected in a manner intended to limit identifiability of individual visitors. [VERIFY WITH NIRAL'S COUNSEL]

Most browsers permit you to manage or disable cookies through browser settings. Disabling essential cookies may affect the proper functioning of the Website. [VERIFY WITH NIRAL'S COUNSEL]

10. Children's Privacy

BridgeMed Health's services are intended for adult plan members. Our Website and services are not directed at children under the age of sixteen (16), and we do not knowingly collect personal information from minors under that age. [VERIFY WITH NIRAL'S COUNSEL]

If you believe that we have inadvertently collected personal information from a minor under sixteen (16), please contact our Privacy Officer using the details in Section 14 and we will take reasonable steps to delete the information. [VERIFY WITH NIRAL'S COUNSEL]

11. International Transfers Of Information

BridgeMed Health primarily stores and processes personal information and personal health information in Canada. Where service providers operate or store information outside of Canada, we require those providers to be bound by contractual obligations providing a comparable level of protection to that required under PHIPA and PIPEDA. [VERIFY WITH NIRAL'S COUNSEL]

You acknowledge that information held outside of Canada may be subject to the laws of the jurisdiction in which it is held, including lawful access by foreign authorities. We will notify plan members and partners where any cross-border transfer of personal health information is reasonably anticipated to involve material additional risk. [VERIFY WITH NIRAL'S COUNSEL]

12. Privacy Breach Notification

BridgeMed Health maintains a documented privacy breach response procedure. In the event of theft, loss, or unauthorized use or disclosure of personal health information, we will: [VERIFY WITH NIRAL'S COUNSEL]

• Take immediate steps to contain the breach and mitigate further risk of harm. [VERIFY WITH NIRAL'S COUNSEL]
• Notify affected individuals at the first reasonable opportunity, as required under PHIPA, with information regarding the nature of the breach, the information involved, and the steps individuals may take to protect themselves. [VERIFY WITH NIRAL'S COUNSEL]
• Notify the Information and Privacy Commissioner of Ontario where the breach meets the prescribed thresholds for mandatory notification under PHIPA and its regulations. [VERIFY WITH NIRAL'S COUNSEL]
• Report to the Office of the Privacy Commissioner of Canada where there is a real risk of significant harm to an individual under PIPEDA. [VERIFY WITH NIRAL'S COUNSEL]
• Conduct a post-incident review and update our safeguards and training where appropriate. [VERIFY WITH NIRAL'S COUNSEL]

13. Updates To This Policy

BridgeMed Health may revise this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we provide. The current version of this Policy is always available on this page and is identified by the “Last updated” date above. [VERIFY WITH NIRAL'S COUNSEL]

Where a revision materially affects how we collect, use, or disclose personal health information, we will provide reasonable notice to affected plan members and partners, including by posting an update notice on the Website or contacting them directly. Continued use of the Website or our services after an update constitutes acknowledgement of the revised Policy. [VERIFY WITH NIRAL'S COUNSEL]

14. Contact Our Privacy Officer

Questions, access requests, correction requests, withdrawal of consent, or privacy complaints may be directed to our Privacy Officer: [VERIFY WITH NIRAL'S COUNSEL]

You may also contact the Information and Privacy Commissioner of Ontario at www.ipc.on.ca or the Office of the Privacy Commissioner of Canada at www.priv.gc.ca regarding our handling of your information. [VERIFY WITH NIRAL'S COUNSEL]