1. Introduction

 Welcome to Mental Health Salt Spring (“we,” “us,” or “our”). We value your trust and are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://www.mentalhealthsaltspring.com (the “Site”), contact us, or use our services. By using our Site or services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use immediately.

2. Data We Collect

We collect personal and non-personal information in the following categories: A. Personal Information You Provide Voluntarily Contact Information: name, email address, phone number, mailing address. Appointment Information: booking details, service preferences, communication history. Health Information: if you voluntarily share mental health or related information when requesting services or communicating with us. Payment Information: billing address and transaction data (processed securely via third-party payment providers; we do not store full credit card numbers). B. Automatically Collected Information Usage Data: IP address, browser type, device type, operating system, referral URLs, access times, and pages viewed. Cookies & Tracking: we use cookies, pixels, and analytics tools to enhance user experience, measure engagement, and improve functionality.

3. Legal Basis for Processing (GDPR) 

 We process your personal data under one or more of the following lawful bases: Consent: when you voluntarily submit personal information. Contractual Necessity: to perform or prepare to perform our services with you. Legal Obligation: to comply with applicable laws and regulations. Legitimate Interests: to improve our services, ensure security, and conduct business operations, provided these interests do not override your rights.

4. Use of Your Information

We may use the data we collect for the following purposes: To provide and manage therapy or counseling services. To communicate with you regarding appointments, inquiries, or updates. To improve our Site, services, and user experience. To process payments and send invoices or confirmations. To comply with applicable laws and professional standards. To send you consent-based updates, newsletters, or promotional materials (you may opt out anytime).

5. Cookies and Tracking Technologies

We use cookies and similar technologies to: Maintain essential website functionality. Analyze traffic and user behavior via tools like Google Analytics. Enhance performance and user experience. You can control or delete cookies through your browser settings. Disabling cookies may affect certain features of the Site.

6. Sharing and Disclosure of Information

We do not sell or rent personal information. We may share data only under the following circumstances: Service Providers: with trusted third-party vendors (e.g., website hosting, email delivery, analytics, payment processing) under confidentiality agreements. Legal Requirements: if required by law, court order, or to protect our rights or clients’ safety. Professional Referrals: only with your explicit consent and consistent with applicable health privacy laws.

7. International Data Transfers

 If you are located outside Canada, your data may be transferred to and processed in Canada or other jurisdictions where data protection laws may differ. We ensure adequate safeguards (such as Standard Contractual Clauses under GDPR) for all cross-border transfers. 

8. Data Retention 

 We retain personal data only as long as necessary for the purposes described herein or as required by law, typically: Client and communication records: up to 7 years after last interaction (to comply with professional and legal requirements). Website analytics data: up to 24 months, anonymized thereafter. Marketing communications: until you withdraw consent or unsubscribe. 

 9. Data Security

We implement technical and organizational measures to protect your data, including: SSL/TLS encryption for website traffic. Secure servers and encrypted backups. Limited access to personal data on a need-to-know basis. Staff confidentiality and privacy training. Despite these efforts, no system is completely secure. You use our Site and services at your own risk.

10. Data Breach Notification 

 In the event of a data breach, we will notify affected individuals and relevant authorities as required by law (e.g., GDPR Articles 33–34, PIPEDA, or CCPA). Notifications will include the nature of the breach, affected data, and steps taken to mitigate harm. 

11. Your Rights 

Depending on your jurisdiction (including under GDPR, PIPEDA, and CCPA), you may have the following rights: Access: request a copy of your personal data. Correction: update or rectify inaccurate or incomplete information. Deletion: request erasure (“right to be forgotten”), subject to legal retention limits. Restriction or Objection: limit or object to data processing. Portability: request transfer of your data to another controller. Withdraw Consent: withdraw consent at any time where processing is based on consent. Do Not Sell or Share (CCPA): opt out of sale or sharing of personal information. To exercise these rights, contact us at: 📧 toddmithc24@gmail.com 📫 12983 Shore Rd East, Salt Spring Island, BC, Canada We may verify your identity before fulfilling requests. 

12. Children’s Privacy 

Our Site is not directed toward children under 16. We do not knowingly collect data from minors without parental consent. If you believe a child has provided personal information, please contact us to delete it. 

13. Third-Party Links 

Our Site may contain links to external websites. We are not responsible for the privacy practices or content of such third-party sites. We encourage you to review their privacy policies before engaging with them. 

14. Changes to This Policy 

We may update this Privacy Policy periodically to reflect legal, technical, or business developments. Updates will be posted on this page with a revised “Last Updated” date. Continued use of our Site after updates constitutes acceptance of the revised policy. 

15. Severability 

If any provision of this Privacy Policy is found invalid or unenforceable, that portion shall be interpreted consistent with applicable law, and the remaining provisions will remain in full force and effect. 

16. Governing Law and Jurisdiction 

This Privacy Policy shall be governed by and construed in accordance with the laws of British Columbia, Canada, without regard to its conflict-of-law principles. Any disputes shall be subject to the exclusive jurisdiction of the courts located in British Columbia. 

17. Contact Us 

For questions, concerns, or data access requests, please contact: Mental Health Salt Spring 

📧 Email: toddmithc24@gmail.com 📫 

Address: 12983 Shore Rd East, Port George, NS, Canada 

18. Revision History 

Version Date Description 1.0 Nov 8, 2025 Initial Privacy Policy established