Your privacy at Avora

1. Who we are and what this policy covers

Avora provides virtual mental-health assessment and treatment to adults in Ontario. As part of that care, and only where it is clinically appropriate and lawful, our clinicians may prescribe medications that are controlled substances under Canada's Controlled Drugs and Substances Act (the “CDSA”) — for example, stimulant medications used to treat ADHD.

When we deliver this care we act as a health information custodian under Ontario's Personal Health Information Protection Act, 2004 (“PHIPA”). Information that is not personal health information — for example, some account and billing data — is handled in accordance with the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”). This policy explains how we handle your information under both.

This version applies to individuals receiving care in Ontario, Canada. Patients in other regions are governed by the privacy policy published for their own jurisdiction.

2. The information we collect

We collect only what we need to provide safe care, meet our legal and regulatory obligations, and operate the service:

• Identity and account information — your legal name, preferred name, date of birth, contact details, province of residence, and time zone.
• Personal health information — your assessment responses, symptoms, clinical and medication history, diagnoses, care plans, clinician notes, and communications with your care team.
• Controlled-substance and prescription information — prescriptions we issue, dispensing records, and information exchanged with your pharmacy and, where required by law, provincial monitoring programs.
• Technical and usage information — device and log data, and information needed to secure your account and prevent misuse.

3. Mental-health information and controlled substances

Mental-health records and records relating to controlled substances are among the most sensitive information we hold, and we apply heightened protection to them. Access is limited to the members of your care team who need it to treat you, and every access is logged.

Because stimulants and certain other medications we may prescribe are controlled substances, both we and the pharmacies that dispense them are subject to legal oversight designed to prevent misuse and diversion. In Ontario, dispensing of monitored drugs is reported to the province's Narcotics Monitoring System under the Narcotics Safety and Awareness Act, 2010. This means information about prescriptions you fill may be reported to, and held by, provincial and federal authorities as the law requires — independently of Avora.

4. How we use your information

• To assess your needs, provide and coordinate your care, and prescribe and manage medication where appropriate.
• To schedule appointments and communicate with you and your care team.
• To keep you and others safe, including responding to indications of risk.
• To meet our legal, regulatory, and professional obligations, including controlled-substance record-keeping and reporting.
• To operate, secure, and improve the service.

We do not sell your information, and we do not use your health information for advertising.

5. Your consent, and your right to say no

Under PHIPA, your clinicians may rely on your implied consent to collect, use, and share your personal health information among your “circle of care” — the health-care providers who are treating you — unless you tell us otherwise. For uses outside of your direct care, we rely on your express consent.

You may withhold or withdraw your consent to the sharing of all or part of your record (sometimes called a “lockbox”). We will honour your instructions to the extent the law allows. Some restrictions may limit the care we can safely provide — particularly where a controlled substance is involved — and we will explain any such consequences to you. Withdrawing consent does not apply where a use or disclosure is required or permitted by law.

6. When and with whom we share

We share your information only as needed to provide care or as required or permitted by law, including with:

• Your circle of care — the clinicians and, where relevant, pharmacists involved in your treatment.
• The pharmacy that dispenses a prescription we issue for you.
• Provincial and federal authorities where the law requires it — including Ontario's Narcotics Monitoring System and Health Canada in connection with controlled substances.
• Health regulators (such as the College of Physicians and Surgeons of Ontario or the Ontario College of Pharmacists) where required for their oversight functions.
• Others where PHIPA or another law requires or permits disclosure — for example, to reduce a significant risk of serious bodily harm, or in response to a lawful order.

We limit each disclosure to the minimum information reasonably necessary.

7. Where your information is stored and how we protect it

Your personal health information is stored on servers located in Canada. We protect it with encryption in transit and at rest, role-based access controls, and audit logging, and we require our service providers to meet comparable standards under written agreement.

If we ever need to store or process information outside Canada, we will do so only with appropriate safeguards and where permitted by law, and we will describe that handling here.

8. How long we keep it

We keep your records for as long as required to provide your care and to meet the record-retention requirements that apply to health records and to controlled-substance prescriptions under Ontario and federal law and professional regulations. When information is no longer required, we securely destroy it or de-identify it.

9. Your rights

• Access — you may request a copy of the personal health information we hold about you.
• Correction — you may ask us to correct information you believe is inaccurate or incomplete.
• Withdraw consent — you may withhold or withdraw consent to sharing, subject to legal limits and to any care consequences we explain to you.
• Complain — you may raise a concern with our Privacy Officer, and you have the right to complain to the Information and Privacy Commissioner of Ontario.

10. Privacy breaches

If your personal health information is lost, stolen, or accessed or disclosed without authority, we will contain and investigate the incident. Where PHIPA requires it, we will notify you at the first reasonable opportunity and report to the Information and Privacy Commissioner of Ontario.

11. Changes to this policy

We may update this policy as our service, or the law, changes. Each version is dated and numbered, and material changes to how we handle your information will be brought to your attention. The version you agreed to during onboarding is recorded with your consent.

12. How to contact us

To ask a question, exercise a right, or make a complaint, contact our Privacy Officer at [privacy@avora.example — placeholder pending the operating entity's details].

You may also contact the Information and Privacy Commissioner of Ontario: 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8 · 1-800-387-0073 · info@ipc.on.ca · ipc.on.ca.