Home About Us Our Team Services Funding & Coverage FAQ & Resources Contact Get Started
Legal

Privacy Policy

How Heartful ABA collects, uses, and protects your personal information.

Effective Date: October 30, 2026  |  Last Updated: October 30, 2026  |  Version: 2026-10-30  |  Governing Law: Ontario, Canada

Heartful ABA ("we", "us", or "our") is committed to protecting the privacy of families, children, and individuals who interact with our services. This Privacy Policy explains what personal information we collect, why we collect it, which service providers receive it, where it is processed, how long we keep it, and how you can exercise your rights.

It is written to meet the requirements of Ontario's Personal Health Information Protection Act, 2004 (PHIPA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and — for anyone whose information is protected by it — the European Union and United Kingdom General Data Protection Regulation (GDPR / UK GDPR). Where these laws differ, we apply the protection that is most favourable to you.

1. Who We Are

Heartful ABA is a home-based provider of Applied Behaviour Analysis (ABA), speech-language therapy, occupational therapy, and tutoring and academic support in the Greater Toronto Area, Ontario, Canada. ABA services are provided under the clinical supervision of a Registered Behaviour Analyst (RBA).

For PHIPA purposes, Heartful ABA is the health information custodian of personal health information about our clients. For GDPR purposes, Heartful ABA is the controller of the personal data described in this policy.

  • Business Name: Heartful ABA
  • Privacy Contact (Privacy Officer): Fathima Rizna Mohamed Roomy, Founder
  • Email: info@heartfulaba.com (please use the subject line "Privacy Request")
  • Phone: +1 (647) 740-0214
  • Service Area: Greater Toronto Area, Ontario, Canada

2. What Personal Information We Collect and Why

2.1 Intake request form

We collect: parent/guardian first and last name, phone number, email address, street address, city and province; your child's age; the services you are interested in; whether your child receives Ontario Autism Program (OAP) funding; and any comments you choose to provide. Comments may include personal health information, such as a diagnosis or developmental needs.

Why: to contact you, understand your child's needs, confirm that we serve your area, recommend suitable services and funding options, and schedule a consultation. We only ask for your child's age in the online form — we do not need your child's name or detailed records until you decide to proceed.

2.2 Contact form

We collect: first and last name, email address, optional phone number, your enquiry topic and your message.

Why: to reply to your enquiry. Please do not include health information in a general message; use the intake form instead.

2.3 Consent record

When you tick the consent box on a form, we record the date and time of your consent and the version of this policy you agreed to, so that we can demonstrate your consent if asked.

2.4 Information collected automatically

When you visit our website or submit a form, our hosting provider automatically processes technical information such as your IP address, browser type, and the pages requested. We use it only to deliver the website, protect it against abuse (for example, limiting repeated form submissions), and diagnose errors. We do not use analytics, advertising, or tracking cookies (see our Cookie Policy).

2.5 Website chat assistant

The chat assistant on our website runs entirely in your browser using pre-written answers. Messages you type into it are not sent to us or to any third party and are not stored.

2.6 Clients receiving services

If you become a client, we collect further information needed to provide care (for example, assessments, treatment plans, session notes, and funding details). This is handled as described in our PHIPA Notice.

3. Legal Basis and Consent

Under PHIPA and PIPEDA, we rely on your knowledgeable, express consent, which you give by ticking the consent box before submitting a form. For clients, we also rely on consent obtained during intake and as otherwise permitted or required by law.

Where the GDPR applies, our legal bases are: your consent (Art. 6(1)(a)), and your explicit consent for any health information you share (Art. 9(2)(a)); taking steps at your request before entering into a service agreement (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); and our legitimate interest in keeping our website secure (Art. 6(1)(f)).

You may withdraw your consent at any time by contacting us (see Section 11). Withdrawal does not affect processing that happened before you withdrew, and may limit our ability to respond to your request or provide services.

We do not sell personal information, use it for advertising, or send marketing messages without your separate consent. We do not use automated decision-making or profiling.

4. How a Website Form Submission Is Processed

Online forms do not go directly into a clinical records system. Sending a submission to our email inbox involves our hosting provider, our form-delivery provider, and our email provider. The complete process is:

  1. Your browser → our website. Your submission is encrypted in transit (HTTPS/TLS) and received by a secure server-side function on our website, operated by our hosting provider listed in Section 5. The function checks the data, rejects incomplete or suspicious submissions, and does not save the contents of your submission.
  2. Our website → email-delivery provider. The function formats the submission as an email and sends it over an encrypted connection to Resend, our email-delivery provider, using a private API key that is never visible in the website code.
  3. Email-delivery provider → our inbox. Resend delivers the email to our Heartful ABA inbox, which is hosted by Google (Gmail). Only authorized Heartful ABA staff can access it.
  4. Our follow-up. We reply to you by email or phone. If you become a client, the relevant information is moved into your child's client record and the original email is deleted (see Section 6).

5. Service Providers That Receive or Store Your Information

We use the service providers ("agents" or "electronic service providers" under PHIPA, and "processors" under the GDPR). Each receives only the information needed for its role and may use it only to provide its service to us.

We may also share information, with your consent, with the Ontario Autism Program (OAP) or your extended health insurer for funding; within our clinical team (including the supervising Registered Behaviour Analyst and the Speech-Language Pathologist or Occupational Therapist involved in your child's care) for treatment; and where required by law.

If we change any of the providers above, we will update this policy before the change takes effect.

6. How Long We Keep Information and How Deletion Works

  • Contact form enquiries: kept for up to 12 months after our last communication with you, then deleted.
  • Intake requests that do not proceed to services: deleted within 12 months of the request, or sooner if you ask.
  • Intake requests that become clients: the relevant information is transferred into the client record within 30 days, and the original email is then deleted. Client records are retained as described in our PHIPA Notice (generally at least 10 years after the last entry, or 10 years after the child turns 18, whichever is later).
  • Consent records: kept for as long as the related information is kept, so we can show that consent was given.
  • Technical logs: kept by our hosting provider for a short period for security purposes.

How deletion is handled: we delete emails from our inbox and empty the trash; Gmail permanently removes deleted messages after 30 days. Paper copies are cross-cut shredded. Copies held by Resend are deleted automatically at the end of its retention period (Section 5). You can ask us to delete your information at any time (see Section 9); we will confirm once it is done, unless we are legally required to keep it — in which case we will explain why.

7. Where Your Information Is Processed (Transfers Outside Canada)

Heartful ABA is based in Ontario, Canada. Some of our service providers process information in the United States and possibly other countries. Information processed outside Canada is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. We remain accountable for your information and require our providers to protect it.

Where the GDPR applies, transfers outside the EU/UK rely on an adequacy decision (Canada benefits from an EU adequacy decision for commercial organizations) or on safeguards offered by the provider, such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

By ticking the consent box on our forms, you acknowledge that your submission will be processed by the providers listed in Section 5, including outside Canada.

8. How We Protect Your Information

  • All website traffic and form submissions are encrypted in transit (HTTPS/TLS).
  • Form-delivery credentials are kept on our server and never exposed in the website code.
  • Submissions are validated on the server, limited in size, and rate-limited to block automated abuse.
  • The website uses a strict security policy that prevents third-party scripts from running on our pages.
  • Access to our inbox and client records is limited to authorized staff on a need-to-know basis and protected by strong passwords and multi-factor authentication.
  • Staff are trained on their privacy obligations and confidentiality.

No method of electronic transmission or storage is completely secure. If a privacy breach occurs that affects you, we will notify you at the first reasonable opportunity and, where required, report it to the Information and Privacy Commissioner of Ontario, the Office of the Privacy Commissioner of Canada, or (under the GDPR) the relevant supervisory authority within 72 hours.

9. Your Rights

Depending on the law that applies, you have the right to:

  • Access the personal information we hold about you or your child, and receive a copy
  • Correct information that is inaccurate or incomplete
  • Withdraw consent to the collection, use or disclosure of your information
  • Request deletion of your information (subject to legal record-keeping requirements)
  • Know who we have shared it with, including a record of disclosures
  • Under the GDPR, also to restrict or object to processing, and to data portability (receive your data in a commonly used electronic format)
  • Complain to a privacy regulator (see Section 12)

To exercise any of these rights, email info@heartfulaba.com with the subject line "Privacy Request". We may need to verify your identity before acting. We will respond within 30 days; if we need more time, we will tell you why, as permitted by law. There is no charge for most requests.

10. Children's Privacy

Our services are intended for families with children. Personal information about a child is collected from, and with the consent of, a parent or legal guardian (the substitute decision-maker), unless the child is capable of consenting on their own behalf under PHIPA. We do not knowingly collect information directly from children through our website.

11. Contact Us About Privacy

For privacy questions, to withdraw consent, or to exercise your rights, please contact our Privacy Officer:

12. Complaints

Please contact us through following email address for complaints/issues so we can try to resolve your concern.

13. Third-Party Links

Our website links to external sites such as Instagram and WhatsApp, and displays an embedded Google Map. Those services have their own privacy policies, and we encourage you to review them. If you contact us through WhatsApp or Instagram, your message is handled by that platform (Meta) under its terms.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, service providers, or the law. The current version and its date are always shown at the top of this page. If we make a material change that affects how we use information you have already given us, we will ask for your consent again where required.