How we handle your information
Contents
1. Who we are
Care In House provides physician-directed mobile nursing and clinical home-visit services in the Halton region. For the purposes of PHIPA, our authorizing physician is the health information custodian; our nurses, administrative staff, and contractors are agents of that custodian and handle personal health information only as directed.
Our Privacy Officer is responsible for compliance with this policy:
Care In House — Privacy Officer
[Mailing address, Ontario]
Email: info@carenhouse.ca
Phone: [phone — active at launch]
2. What we collect
2.1 Personal information (non-clinical)
- Name, email address, phone number, mailing address, city, province, and country
- Information provided when registering your interest (referral source, intended use)
- Payment details — processed by our PCI-DSS-compliant payment processor; Care In House does not store full card numbers
- Communications you send us and our responses
- Technical website data (see section 9)
2.2 Personal health information (when you become a patient)
- OHIP number, date of birth, and other identifiers required to deliver and bill care
- Health history, current medications, allergies, and clinical findings from a visit
- Point-of-care test results (urinalysis, glucose, rapid swabs) generated during a visit
- Dermoscopy and other clinical images captured during a visit
- Records of physician video consultations conducted as part of a visit
- Correspondence with your other health providers, where you have consented
3. Why we collect it
We collect information only for purposes a reasonable person would consider appropriate:
- To communicate with you about the service, your appointment, and your care
- To assess, plan, deliver, and document the clinical services you request
- To process payment for our private-pay nursing services
- To submit OHIP claims for medically necessary insured physician services where applicable
- To coordinate your care with your family doctor or other providers (with your express consent)
- To comply with CPSO, CNO, PHIPA, and other applicable regulatory obligations
- To respond to a privacy breach or legal process
- To notify waitlist registrants about the launch of our service (with CASL-compliant consent)
We do not sell, rent, or trade your information to any third party, ever. We do not use it for targeted advertising.
4. Who we share it with
- Within our care team — the physician medical director and Registered Nurses providing your care
- Your other health providers — only with your prior express consent
- Ontario Health / Ministry of Health — for OHIP physician billing where applicable
- Our regulators — CPSO and CNO, where required or authorised by law
- Public health authorities — where mandatory reporting is required by law
- Our service providers — including our EMR platform, payment processor, secure video platform, and website-form processor (Formspree Inc.), each bound by written agreements to safeguard your information
- Legal process — where required by court order or other binding obligation
Some service providers may process data outside Canada. Where this occurs, we require contractual safeguards consistent with Ontario and Canadian privacy standards.
5. How long we keep it
- Medical records — minimum 10 years after last patient contact (or until 10 years after the 18th birthday of a patient who was a minor, whichever is longer), per CPSO requirements
- Billing records — minimum 7 years per Canada Revenue Agency requirements
- Waitlist registrations — deleted within 12 months of public launch if the registrant has not become a patient, unless they have opted into ongoing communications
- Website logs — no more than 90 days
- All other personal information — only as long as necessary for the purpose collected
When information is no longer required, we destroy or de-identify it securely.
6. How we protect it
- Access limited to agents with a need to know
- All agents sign confidentiality undertakings and complete annual privacy training
- Records stored in encrypted, access-controlled systems with audit logs
- All portable devices used for clinical work are encrypted and require multi-factor authentication
- Video consultations use a PHIPA-standard secure platform
- A written Privacy Breach Response Protocol is in place; material breaches are reported to affected individuals as required by PHIPA
No system is perfectly secure. If we discover a breach involving your personal health information that poses a real risk of significant harm, we will notify you without unreasonable delay.
7. Your rights
- Access — request a copy of information we hold about you
- Correction — request correction of inaccurate or incomplete information
- Withdraw consent — withdraw consent to certain uses or disclosures, subject to legal obligations
Contact our Privacy Officer (section 1) to exercise any right. We respond within 30 days as standard, always within the statutory maximum.
8. Waitlist and marketing communications (CASL)
By ticking the consent checkbox on our waitlist form, you provide express consent under CASL to receive a launch announcement and a small number of related service updates. Every commercial electronic message we send includes our business name, mailing address, and a working one-click unsubscribe mechanism honoured within 10 business days. Unsubscribing removes you from marketing communications only — clinical communications for existing patients are governed separately by PHIPA.
9. Cookies and analytics
Our website uses only cookies strictly necessary to operate the site. We do not currently use cookies for advertising or third-party profiling. If we add analytics tools in future, we will update this section and obtain consent where required.
10. Minors
Care In House is a service for adults (18+). We do not knowingly collect personal information from persons under 18 through our website. If you believe a minor's information has been submitted, contact our Privacy Officer and we will delete it promptly.
11. Changes to this policy
We may update this policy to reflect changes in our practices or legal requirements. The "last reviewed" date at the top reflects the current version. Material changes affecting personal health information will be announced on our website and, where reasonable, communicated to you directly.