Effective Date: April 19, 2026  |  Last Updated: April 19, 2026  |  Governing Legislation: PHIPA, S.O. 2004, c. 3, Sched. A (Ontario)

1. About This Notice

Heartful ABA is a home-based therapy service provider operating in the Greater Toronto Area, Ontario. As a provider of ABA therapy and related health support services, we collect and handle personal health information (PHI) as defined under PHIPA. This notice describes our practices in accordance with that legislation.

The Health Information Custodian responsible for your personal health information is:

• Fathima Rizna Mohamed Roomy, Founder & Head Therapist, Heartful ABA
• Email: heartfulabaservices@gmail.com
• Phone: +1 (647) 740-0214

2. What Is Personal Health Information?

Under PHIPA, personal health information (PHI) means identifying information about an individual that relates to:

• The individual's physical or mental health, including family health history
• The provision of health care, including the identification of a health care provider
• Payments or eligibility for health care
• A plan of service for the individual
• Donation of any body part or substance
• The individual's health number

In the context of Heartful ABA, PHI includes (but is not limited to): autism spectrum disorder (ASD) diagnosis, developmental assessments, therapy goals, progress notes, behaviour data, and any health-related information shared by you during intake, sessions, or communications.

3. Collection of Personal Health Information

We collect PHI directly from you (the parent, guardian, or individual), or from authorized sources including:

• Completed intake forms submitted through our website or in person
• Verbal or written communications during consultations and therapy sessions
• Diagnostic reports, school reports, or assessments shared by you or your child's health care team
• The Ontario Autism Program (OAP) or other funding bodies, where applicable and consented

We collect only the minimum PHI necessary to provide safe, effective, and individualized therapy services.

4. Purposes for Collection, Use, and Disclosure

We collect, use, and disclose PHI for the following purposes:

• Clinical Care: To assess, develop, deliver, and monitor individualized ABA therapy programs and speech therapy services
• Communication: To communicate with you regarding your child's program, scheduling, and progress
• Supervision: To facilitate BCBA clinical supervision of therapy programs (information is shared within our clinical team only)
• Funding & Billing: To process OAP funding applications, insurance claims, or private payment arrangements, with your consent
• Legal Compliance: To comply with applicable laws, regulations, or court orders
• Safety: To contact emergency services or a substitute decision-maker if there is a risk to the health or safety of the individual

5. Consent

We obtain your express or implied consent before collecting, using, or disclosing your PHI, except where the law permits otherwise. Consent may be provided in writing (e.g. through your intake form), verbally, or through your conduct (e.g. seeking services from us).

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect our ability to provide services. To withdraw consent, contact us at heartfulabaservices@gmail.com.

For clients under 16 years of age, consent is obtained from a parent or legal guardian (substitute decision-maker) unless the individual has the capacity to consent on their own behalf.

6. Disclosure of Personal Health Information

We do not sell or trade PHI. We disclose PHI only:

• With your consent, to other health care providers or specialists involved in your child's care
• To the OAP or your insurance provider, with your consent, for funding purposes
• As required by law (e.g. mandatory reporting obligations, court order)
• In emergency situations where disclosure is necessary to prevent serious harm

7. Retention and Destruction of Records

We retain PHI for a minimum of ten (10) years from the date of the last recorded entry, or for ten (10) years after a child turns 18, whichever is longer, in accordance with Ontario health record-keeping standards. After the retention period, records are securely destroyed.

8. Security Safeguards

We implement appropriate administrative, technical, and physical safeguards to protect PHI against theft, loss, unauthorized access, use, modification, or disclosure. Access to PHI is restricted to authorized personnel on a need-to-know basis.

9. Your Rights Under PHIPA

As an individual (or substitute decision-maker for a child), you have the right to:

• Access your PHI: Request a copy of the personal health information we hold, subject to limited exceptions under PHIPA (s. 52)
• Correct your PHI: Request a correction or amendment to inaccurate or incomplete records (s. 55)
• Withdraw consent: Withdraw consent for the collection, use, or disclosure of PHI, subject to legal obligations
• Request a record of disclosures: Request a record of who we have disclosed your PHI to and for what purpose (s. 54)
• File a complaint: If you believe we have violated your rights under PHIPA, you may file a complaint with the Information and Privacy Commissioner of Ontario (IPC)

To exercise any of these rights, submit a written request to: heartfulabaservices@gmail.com. We will respond within 30 days of receiving your request.

10. Complaints

If you have a concern about how we handle your PHI, please contact us first at heartfulabaservices@gmail.com. If your concern is not resolved to your satisfaction, you may contact:

• Information and Privacy Commissioner of Ontario
  2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8
  Phone: 1-800-387-0073  |  Website: www.ipc.on.ca

11. Changes to This Notice

We may update this PHIPA Notice from time to time to reflect changes in our practices or applicable law. The most current version will always be posted on our website. We will notify active clients of material changes.