Effective Date: April 19, 2026  |  Last Updated: October 30, 2026  |  Version: 2026-10-30  |  Governing Legislation: PHIPA, S.O. 2004, c. 3, Sched. A (Ontario)

1. About This Notice

Heartful ABA is a home-based therapy service provider operating in the Greater Toronto Area, Ontario. As a provider of ABA therapy (under the clinical supervision of a Registered Behaviour Analyst), speech-language therapy, occupational therapy and related support services, we collect and handle personal health information (PHI) as defined under PHIPA. This notice describes our practices in accordance with that legislation.

The Health Information Custodian responsible for your personal health information is:

• Fathima Rizna Mohamed Roomy, Founder & Head Therapist, Heartful ABA
• Email: info@heartfulaba.com
• Phone: +1 (647) 740-0214

2. What Is Personal Health Information?

Under PHIPA, personal health information (PHI) means identifying information about an individual that relates to:

• The individual's physical or mental health, including family health history
• The provision of health care, including the identification of a health care provider
• Payments or eligibility for health care
• A plan of service for the individual
• Donation of any body part or substance
• The individual's health number

In the context of Heartful ABA, PHI includes (but is not limited to): autism spectrum disorder (ASD) diagnosis, developmental assessments, therapy goals, progress notes, behaviour data, and any health-related information shared by you during intake, sessions, or communications.

3. Collection of Personal Health Information

We collect PHI directly from you (the parent, guardian, or individual), or from authorized sources including:

• Completed intake forms submitted through our website (with your consent, given by ticking the consent box) or in person
• Verbal or written communications during consultations and therapy sessions
• Diagnostic reports, school reports, or assessments shared by you or your child's health care team
• The Ontario Autism Program (OAP) or other funding bodies, where applicable and consented

We collect only the minimum PHI necessary to provide safe, effective, and individualized therapy services.

4. Purposes for Collection, Use, and Disclosure

We collect, use, and disclose PHI for the following purposes:

• Clinical Care: To assess, develop, deliver, and monitor individualized ABA therapy programs, speech-language therapy, occupational therapy, and tutoring and academic support
• Communication: To communicate with you regarding your child's program, scheduling, and progress
• Supervision: To facilitate clinical supervision of ABA programs by the supervising Registered Behaviour Analyst (RBA), and coordination with the Speech-Language Pathologist (SLP) or Occupational Therapist (OT) involved in your child's care (information is shared within the clinical team only)
• Funding & Billing: To process OAP funding applications, insurance claims, or private payment arrangements, with your consent
• Legal Compliance: To comply with applicable laws, regulations, or court orders
• Safety: To contact emergency services or a substitute decision-maker if there is a risk to the health or safety of the individual

5. Consent

We obtain your knowledgeable consent before collecting, using, or disclosing your PHI, except where the law permits otherwise. For information submitted through our website, we ask for your express consent by asking you to tick a consent box, and we record the date, time and policy version of that consent. Consent may otherwise be provided in writing (e.g. through your intake form), verbally, or through your conduct (e.g. seeking services from us).

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide services. To withdraw consent, contact us at info@heartfulaba.com.

For clients under 16 years of age, consent is obtained from a parent or legal guardian (substitute decision-maker) unless the individual has the capacity to consent on their own behalf.

6. Disclosure of Personal Health Information

We do not sell or trade PHI. We disclose PHI only:

• With your consent, to other health care providers or specialists involved in your child's care
• To the OAP or your insurance provider, with your consent, for funding purposes
• As required by law (e.g. mandatory reporting obligations, court order)
• In emergency situations where disclosure is necessary to prevent serious harm

7. Retention and Destruction of Records

We retain PHI for a minimum of ten (10) years from the date of the last recorded entry, or for ten (10) years after a child turns 18, whichever is longer, in accordance with Ontario health record-keeping standards. After the retention period, records are securely destroyed.

7A. Website Forms and Electronic Service Providers

When you submit our online intake or contact form, your information is transmitted securely (HTTPS/TLS) through the following electronic service providers acting on our behalf: our website hosting provider (website hosting and secure form processing; provider and processing location listed in Section 5 of our Privacy Policy), Resend (email delivery, United States), and Google (Gmail inbox). These providers may only use the information to provide their service to us and may process it outside Ontario, including in the United States, where it may be subject to the laws of that country. Full details — including what each provider receives, where it is processed and how long it is kept — are in Section 5 of our Privacy Policy.

Online form submissions are used only to respond to your request. If you become a client, the relevant information is transferred into your child's client record and the original email is deleted within 30 days; requests that do not proceed are deleted within 12 months.

8. Security Safeguards

We implement appropriate administrative, technical, and physical safeguards to protect PHI against theft, loss, unauthorized access, use, modification, or disclosure. Access to PHI is restricted to authorized personnel on a need-to-know basis.

Privacy breaches

If your PHI is stolen, lost, or used or disclosed without authority, we will notify you at the first reasonable opportunity, as required by PHIPA (s. 12), and will report the breach to the Information and Privacy Commissioner of Ontario where required by regulation.

9. Your Rights Under PHIPA

As an individual (or substitute decision-maker for a child), you have the right to:

• Access your PHI: Request a copy of the personal health information we hold, subject to limited exceptions under PHIPA (s. 52)
• Correct your PHI: Request a correction or amendment to inaccurate or incomplete records (s. 55)
• Withdraw consent: Withdraw consent for the collection, use, or disclosure of PHI, subject to legal obligations
• Request a record of disclosures: Request a record of who we have disclosed your PHI to and for what purpose (s. 54)
• File a complaint: If you believe we have violated your rights under PHIPA, you may file a complaint with the Information and Privacy Commissioner of Ontario (IPC)

To exercise any of these rights, submit a written request to: info@heartfulaba.com. We will respond within 30 days of receiving your request.

10. Complaints

If you have a concern about how we handle your PHI, please contact us first at info@heartfulaba.com. If your concern is not resolved to your satisfaction, you may contact:

• Information and Privacy Commissioner of Ontario
  2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8
  Phone: 1-800-387-0073  |  Website: www.ipc.on.ca

11. Changes to This Notice

We may update this PHIPA Notice from time to time to reflect changes in our practices or applicable law. The most current version will always be posted on our website. We will notify active clients of material changes.