Privacy Policy

1. Introduction

BridgeMed Health Inc. (“BridgeMed Health,” “we,” “us,” or “our”) is a Canadian, psychiatrist-led mental health provider headquartered at 1410-181 University Avenue, Toronto, Ontario M5H 3M7. We deliver Functional Psychiatric Assessments (FPAs) and Return-to-Work (RTW) Function-Focused Psychotherapy to plan members of insurer, group benefit provider, and employer partners across Canada.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information and personal health information when you visit our website, interact with our team, or receive clinical services from us. It is written to align with the Personal Health Information Protection Act, 2004 (Ontario) (“PHIPA”) and the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”).

2. Who We Are

BridgeMed Health Inc. is an Ontario corporation operating a psychiatrist-led virtual mental health practice. Our clinicians are licensed in the Canadian jurisdictions in which they deliver care. Under PHIPA, our psychiatrists are “health information custodians” with respect to personal health information they collect, use, and disclose in the course of providing clinical services to plan members.

Our Privacy Officer is responsible for compliance with this Policy and applicable privacy legislation. Contact details for the Privacy Officer are provided in Section 14 of this Policy.

3. Information We Collect

The information we collect depends on how you interact with BridgeMed Health. We endeavour to collect only the information reasonably necessary to provide our services and operate our website.

We use website inquiries and the information submitted on the referral form to respond and coordinate intake. Send clinical records through the secure intake process.

4. Lawful Basis For Collection And Use

We collect, use, and disclose personal information and personal health information on the following lawful bases:

• Express consent under PHIPA. Plan members provide express consent for the collection, use, and disclosure of personal health information for the purposes of clinical assessment and treatment, including coordination with their case manager and family physician.
• Implied consent within the circle of care. Where permitted under PHIPA, we may rely on implied consent for the disclosure of personal health information to other health information custodians for the purpose of providing health care to the plan member.
• Consent under PIPEDA. For personal information that is not personal health information, we rely on the consent of the individual, obtained at the time of collection or use, in accordance with PIPEDA.
• Statutory authority or court order. We may collect, use, or disclose personal information where required or permitted by law, including by order of a court or tribunal of competent jurisdiction.

5. How We Use Your Information

BridgeMed Health uses the information we collect strictly for the purposes for which it was collected and for related, compatible purposes. Specifically:

• Clinical care. To conduct Functional Psychiatric Assessments, deliver RTW Function-Focused Psychotherapy, and provide related clinical services to plan members.
• Return-to-work reporting. To prepare written reports, functional capacity summaries, and accommodation recommendations for the plan member's case manager and family physician.
• Case manager coordination. To communicate with the plan member's assigned disability case manager regarding clinical status, recommended treatment, and return-to-work readiness, in accordance with consent.
• Family physician (GP) coordination. To share clinical findings, recommendations, and follow-up communications with the plan member's primary care physician, in accordance with consent.
• Service administration. To schedule appointments, deliver virtual care via our telemedicine platform, issue invoices, and maintain clinical records as required by applicable professional and legal standards.
• website operation and improvement. To operate, maintain, and improve the website and to understand how visitors interact with our content.
• Legal and regulatory compliance. To meet our obligations under applicable law, professional regulation, and contractual commitments with partners.

We do not use personal information or personal health information for third-party marketing, advertising profiling, or sale to data brokers. We do not sell, rent, or trade plan member information under any circumstances.

6. Disclosure Of Information

BridgeMed Health discloses personal information and personal health information only as required to deliver clinical services or as permitted or required by law. Disclosures are limited to the minimum information reasonably necessary for the disclosed purpose.

Recipients of disclosed information may include:

• The plan member's case manager, as authorized by the plan member's signed consent and reasonably required for case management and return-to-work planning.
• The plan member's family physician (GP) or other treating health information custodians within the circle of care.
• Authorized service providers retained by BridgeMed Health to support our operations, for example, our telemedicine platform vendor, hosting providers, and professional advisors, each of whom is bound by written confidentiality obligations consistent with this Policy.
• Regulatory and professional bodies, where required by law, professional college obligations, or in response to a lawful order.
• Successor entities, in the event of a corporate reorganization, merger, or sale of assets, subject to confidentiality and notice obligations.

We do not disclose plan member personal health information to employers, insurers, or third parties for purposes of adjudication, underwriting, or marketing, except where the plan member has provided express written consent or such disclosure is required by law.

7. Storage, Retention, And Security

We use administrative, physical, and technical safeguards appropriate to the sensitivity of the information. Contact our Privacy Officer for information about how we store and protect your records.

We retain personal health information for the period required by applicable professional regulation and clinical record-keeping standards, and personal information for the period reasonably required to fulfil the purposes set out in this Policy. When information is no longer required, it is securely destroyed or de-identified in accordance with applicable requirements.

No method of electronic transmission or storage is completely secure. While we apply commercially reasonable safeguards to protect information in our custody, we cannot guarantee absolute security.

8. Your Rights Under PHIPA And PIPEDA

Plan members and other individuals whose information is held by BridgeMed Health have the following rights, subject to limitations set out in applicable law:

• Right of access. You may request access to your personal health information held by BridgeMed Health. We will respond to access requests within the timelines required under PHIPA, normally within thirty (30) days.
• Right of correction. You may request that we correct personal information or personal health information you believe to be inaccurate or incomplete. Where a correction is not made, you may require us to attach a statement of disagreement to the record.
• Right to withdraw consent. You may withdraw or vary your consent to the collection, use, or disclosure of your personal information or personal health information at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to continue providing clinical services to you.
• Right to file a complaint. You may submit a complaint regarding our handling of your information to our Privacy Officer using the contact details in Section 14. You may also submit a complaint directly to the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada.

BridgeMed Health does not charge a fee for routine access or correction requests. Where a request is voluminous or extraordinary, we may charge a reasonable cost-recovery fee in accordance with applicable law and will notify you of the fee in advance.

9. Cookies And website Tracking

The website and its hosting service may process technical information, such as IP addresses and request timestamps, to operate and protect the site. The website also loads resources such as fonts from third-party providers.

Most browsers permit you to manage or disable cookies through browser settings. Disabling essential cookies may affect the proper functioning of the website.

10. Children's Privacy

BridgeMed Health's services are intended for adult plan members. Our website and services are not directed at children under the age of sixteen (16), and we do not knowingly collect personal information from minors under that age.

If you believe that we have inadvertently collected personal information from a minor under sixteen (16), please contact our Privacy Officer using the details in Section 14 and we will take reasonable steps to delete the information.

11. International Transfers Of Information

Service providers may process information outside Canada. We use contractual safeguards as required by applicable privacy law.

You acknowledge that information held outside of Canada may be subject to the laws of the jurisdiction in which it is held, including lawful access by foreign authorities. We will notify plan members and partners where any cross-border transfer of personal health information is reasonably anticipated to involve material additional risk.

12. Privacy Breach Notification

BridgeMed Health maintains a documented privacy breach response procedure. In the event of theft, loss, or unauthorized use or disclosure of personal health information, we will:

• Take immediate steps to contain the breach and mitigate further risk of harm.
• Notify affected individuals at the first reasonable opportunity, as required under PHIPA, with information regarding the nature of the breach, the information involved, and the steps individuals may take to protect themselves.
• Notify the Information and Privacy Commissioner of Ontario where the breach meets the prescribed thresholds for mandatory notification under PHIPA and its regulations.
• Report to the Office of the Privacy Commissioner of Canada where there is a real risk of significant harm to an individual under PIPEDA.
• Conduct a post-incident review and update our safeguards and training where appropriate.

13. Updates To This Policy

BridgeMed Health may revise this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we provide. The current version of this Policy is always available on this page and is identified by the “Last updated” date above.

Where a revision materially affects how we collect, use, or disclose personal health information, we will provide reasonable notice to affected plan members and partners, including by posting an update notice on the website or contacting them directly. Continued use of the website or our services after an update constitutes acknowledgement of the revised Policy.

14. Contact Our Privacy Officer

Questions, access requests, correction requests, withdrawal of consent, or privacy complaints may be directed to our Privacy Officer:

You may also contact the Information and Privacy Commissioner of Ontario at www.ipc.on.ca or the Office of the Privacy Commissioner of Canada at www.priv.gc.ca regarding our handling of your information.