Our Role Under PHIPA
Fitra Health is the Health Information Custodian under Ontario's Personal Health Information Protection Act.
Fitra Health Inc. is the Health Information Custodian (HIC) under PHIPA with custody and control of personal health information (PHI) collected through the Platform, including the Jane App electronic medical record system.
The independently licensed Naturopathic Doctors who provide clinical services through the Platform act as Agents of Fitra Health (the HIC) under PHIPA. Each Naturopathic Doctor is authorized to collect, use, and disclose PHI only as necessary to provide clinical care and as authorized by Fitra Health's information practices.
While Fitra Health is the HIC, each Naturopathic Doctor retains independent professional obligations to maintain clinical records in accordance with CONO Standards.
Legal Framework
Our privacy practices are governed by the Canadian and Ontario laws that protect personal and health information.
Fitra Health operates in accordance with the Personal Health Information Protection Act, 2004 (PHIPA) for personal health information and the Personal Information Protection and Electronic Documents Act (PIPEDA) for other personal information. This policy applies to all services provided through the fitrahealth.ca Platform.
Information We Collect
We collect only what is necessary to operate the platform and support care-related workflows.
- Personal Information (PI): Name, email address, phone number, city, and postal code when you register, subscribe, or submit inquiries.
- Booking and billing details: Payment information is collected and processed through Jane App's secure payment system. Fitra Health does not store your full credit card number.
- Quiz and form responses: Answers you provide to our symptom-check quizzes, questions you submit through our Ask a Naturopath forms, and call-request details such as availability, topic of interest, and any optional notes. Where you choose to request a call after completing a quiz, a summary of your quiz responses is included with your request so the team can prepare for your call.
- Personal Health Information (PHI): Health information you provide when booking, including the reason for your visit. Detailed clinical records, intake forms, consultation notes, and treatment plans, are collected and managed through Jane App, under PHIPA.
- Technical data: IP address, browser type, pages visited, device identifiers, and usage statistics used to maintain platform security and performance.
- Communications: Records of your correspondence with us, including emails and contact form submissions.
How We Use Information
Information is used to deliver services, support operations, and meet regulatory obligations.
- Service delivery: Operate, maintain, and improve the Platform, including appointment bookings, virtual consultations, and payment processing.
- Booking and communication: Process appointment requests, send reminders, and provide customer support.
- Billing and insurance: Support payment collection and provide detailed receipts for insurance reimbursement.
- Legal and regulatory compliance: Comply with PHIPA, PIPEDA, tax laws, and CONO professional requirements; enforce our Terms of Service; protect the rights, property, or safety of Fitra Health, our users, or others.
- Platform operations: Maintain website security and service quality. We primarily use anonymized or aggregated data for analytics.
- Advertising measurement: Measure the performance of our advertising campaigns and improve how we reach people who may benefit from our services, using the tools described in the Advertising and Tracking section below.
- Marketing (with express consent only): Send newsletters, health content, and service updates in compliance with CASL.
How We Contact You
When you request a consultation — including through an advertisement form on platforms such as Facebook or Instagram — you consent to being contacted about that request as described here.
- Channels: We may contact you by text message (SMS), email, direct message on the platform where you reached us, and telephone regarding your booking request, appointments, intake forms, and related administrative matters.
- Automated and AI-assisted calls: Some calls and messages are placed or answered by an automated virtual assistant acting for our front desk — for example appointment scheduling, appointment confirmations, and intake form reminders. The assistant identifies itself as an automated assistant, does not provide medical advice, and can pass any request to our human front desk.
- Call handling: Calls with our virtual assistant may be transcribed in order to fulfil your request (for example, to record a booking or a callback). Transcripts are protected under the safeguards described in this policy and are not used for advertising.
- Frequency and limits: Contact is limited to your request and your appointments. Automated reminder calls are limited in number and placed only during daytime hours (Eastern Time).
- Opting out: You may withdraw consent to any contact channel at any time — reply STOP to any text, say so on any call, or email info@fitrahealth.ca. Withdrawing consent does not affect care you have already booked; we will use an alternative channel to deliver essential appointment information.
Third-Party Processors
Certain trusted providers process information on our behalf as part of the platform experience.
Jane App: scheduling, virtual video conferencing, electronic health records, payment processing, and billing integration. Vercel: website hosting, infrastructure, and basic site performance analytics. Google: our team email runs on Google Workspace, so form submissions, quiz call requests, and Ask a Naturopath questions you send through the website are delivered to and stored in our Google Workspace email accounts. PostHog Inc.: product analytics, described in the Session Analytics section below. Meta Platforms Inc.: advertising measurement, described in the Advertising and Tracking section below. Twilio Inc.: telephone and text message delivery for our front desk. ElevenLabs Inc.: speech processing for our automated front-desk virtual assistant, used to conduct scheduling and reminder calls as described in the How We Contact You section.
Some of these providers, including PostHog, Meta, Google, and Vercel, process data on servers located in the United States. Information processed outside Canada may be subject to the laws of those jurisdictions, including lawful access by courts and authorities there.
These providers are bound to protect your personal information and use it only for the purposes for which it was disclosed, in compliance with applicable privacy laws. Fitra Health does not sell your personal information.
Information may also be disclosed where required by law, regulation, or court order, or to protect the rights, safety, and security of patients, practitioners, or the platform.
Data Retention
Information is retained only as long as required by law, professional standards, or legitimate platform needs.
- Clinical records (PHI): Retained for a minimum of ten (10) years from the date of the last entry, in accordance with CONO guidelines.
- Administrative records: Retained for a minimum of six (6) years to meet legal, tax, and audit obligations.
- Booking data: Retained for up to twenty-four (24) months unless you request earlier deletion.
- Active account data: Retained while your account is active and as needed to provide services.
Data Security
We implement administrative, technical, and physical safeguards to protect your information.
Technical safeguards include SSL/TLS encryption for data in transit, secure hosting environments with firewall protection, encrypted data storage, and multi-factor authentication for administrative access.
As the Health Information Custodian, Fitra Health maintains written information practices and privacy breach notification protocols in compliance with PHIPA. Access to personal information is restricted to authorized personnel bound by confidentiality obligations.
While we implement commercially reasonable security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
Privacy Breach Notification
In the event of a privacy breach, Fitra Health will act promptly in accordance with PHIPA requirements.
If Fitra Health becomes aware of a privacy breach that creates a real risk of significant harm to a patient or individual, we will notify the affected individual and the Information and Privacy Commissioner of Ontario (IPC) as required under PHIPA.
Notification will include a description of the breach, the type of information involved, the steps taken to contain the breach, and steps you can take to protect yourself. We will document all breaches regardless of whether notification is required.
Your Rights
You have rights regarding your personal and health information under PHIPA and PIPEDA.
- Right to Access: Request a copy of the personal information we hold about you, subject to legal exceptions.
- Right to Correct: Request correction of inaccurate or incomplete personal information.
- Right to Withdraw Consent: Withdraw consent to collection, use, or disclosure at any time, subject to legal or contractual restrictions. Withdrawal may affect platform functionality.
- Right to Request Deletion: Request deletion of personal information where retention is no longer legally required.
- Right to Complain: File a complaint with the Information and Privacy Commissioner of Ontario (IPC) for PHIPA matters, or the Office of the Privacy Commissioner of Canada (OPC) for PIPEDA matters.
CASL Compliance
Marketing communications are sent only with your express consent, as required by Canadian law.
Fitra Health complies with Canada's Anti-Spam Legislation (CASL). We will only send commercial electronic messages (CEMs), including emails and text messages, if we have express or implied consent as permitted under CASL. Every CEM clearly identifies Fitra Health Inc. as the sender, includes our mailing address and contact information, and provides a clear opt-out (an unsubscribe link in emails, or reply STOP to any text message).
You may unsubscribe at any time by clicking the unsubscribe link in any marketing email, replying STOP to any text message, or by contacting us at privacy@fitrahealth.ca. Unsubscribe requests are processed within ten (10) business days.
Service-related communications (appointment confirmations, billing, account activity) are transactional messages exempt from CASL consent requirements.
Text Messaging (SMS) and Phone Communications
How we use text messages and phone calls to help you book and attend appointments, and how to opt out.
- Consent at sign-up: When you submit a form on our website or through our social media advertising (including our free discovery-call request forms), you provide your phone number and agree that Fitra Health Inc. may contact you by text message (SMS) and telephone to help you book, confirm, reschedule, and attend your appointment, and to send related reminders and follow-ups.
- Message frequency and rates: Message frequency varies based on your interactions with us. Message and data rates may apply. Consent to receive text messages is not a condition of receiving naturopathic services.
- Opting out: You can stop text messages at any time by replying STOP to any message from us. You can opt out of phone calls by telling us during any call or by emailing privacy@fitrahealth.ca. For marketing emails, use the unsubscribe link or contact privacy@fitrahealth.ca.
- No sharing of mobile data: Mobile opt-in and consent information, including your phone number, is never shared with third parties or affiliates for their own marketing purposes. Fitra Health does not sell your personal information.
Session Analytics
We use an analytics platform to understand how visitors interact with our website, with safeguards that keep health information out of analytics data.
We use PostHog, an analytics service operated by PostHog Inc. and hosted in the United States, to understand how visitors interact with our website. It collects page views, clicks, scroll behavior, and similar usage events to help us improve the user experience.
Important safeguards: What you type into forms is masked and is not recorded as analytics content. Interaction events, such as which pages you visit and which buttons or quiz options you click, may be recorded to help us understand how our tools are used. The contents of your call requests and the questions you write to us are delivered to our team through the form submission described above, not through the analytics platform. Analytics events do not include passwords or payment details.
Until you make a choice on our cookie banner, analytics run in a cookieless mode that does not set cookies and does not use persistent identifiers, so your visit is not tracked across sessions or other websites. If you accept, analytics use cookies and local storage so we can understand repeat visits. If you decline, analytics are turned off. You can also clear your browser's local storage at any time to reset your choice.
This data processing is conducted under our legitimate interest in improving our platform, in compliance with PIPEDA and PHIPA.
Advertising and Tracking
We advertise on platforms like Meta and Google, and use their measurement tools on our website.
Meta Pixel: Our website uses the Meta Pixel, a measurement tool from Meta Platforms Inc. (Facebook and Instagram). It sends Meta events about how our site is used, including page views, opening our booking form, and submitting a call request, along with the address of the page where the event happened and standard browser information. We do not send Meta your name, email address, phone number, quiz answers, or any health information you type into our forms. Meta may associate these events with your Facebook or Instagram account under its own data policy, and processes this data in the United States. We use this to measure whether our advertising works and to reach people who may benefit from our services.
Google: Where Google measurement tools are active, similar usage events may be sent to Google. If you arrive from a Google ad, an ad click identifier may be stored in your browser's local storage and attached to booking links so we can measure which ads lead to appointments.
Your choices: You can limit this tracking by using a browser with tracking protection or an ad blocker, by adjusting your ad preferences in your Facebook, Instagram, or Google account settings, and by declining cookies where the banner is shown. Visiting a page about a health topic does not tell us, Meta, or Google anything about your diagnosis, and no clinical information from your care ever flows to advertising platforms.
Contact
Privacy questions, access requests, correction requests, and breach concerns can be directed to our team.
Privacy Office
We respond to privacy requests promptly and document every inquiry.