Privacy Policy
Joshua Erlick Therapy
Last updated: October 2026
Your privacy matters
Therapy involves sharing parts of your life that deserve care. That care begins with how your information is handled, whether you are browsing this website, booking a consultation or attending sessions.
Your privacy is an essential part of the therapeutic relationship. You have the right to understand what information is collected, why it is needed, how it is protected and the choices available to you.
This policy explains how Joshua Erlick Therapy collects, uses, stores and protects personal information in accordance with applicable privacy legislation and professional responsibilities.
Joshua Erlick Therapy is operated by Joshua Erlick, Registered Psychotherapist (Qualifying), registered with the College of Registered Psychotherapists of Ontario (CRPO).
As an independent practitioner, I am responsible for the personal health information in my custody or control. This includes maintaining appropriate privacy practices under Ontario's Personal Health Information Protection Act (PHIPA).
I am also the person responsible for responding to privacy questions, access requests and complaints.
Privacy Contact: hello@joshuaerlicktherapy.com
Information I collect
The information collected depends on how you interact with the practice.
This may include:
Personal information: Your name, contact details, address and communication preferences.
Appointment information: Consultation requests, appointment dates, booking information and relevant correspondence.
Clinical information: Information relevant to psychotherapy, including presenting concerns, personal history, consent forms, assessments, treatment plans and clinical notes.
Financial information: Billing details, payment records and receipts.
Emergency contact information: Details provided where appropriate for your care.
Website information: Technical information such as IP addresses, browser type, pages viewed and cookie preferences.
I aim to collect only information reasonably necessary to provide psychotherapy, administer the practice and meet my legal or professional responsibilities.
Information is generally collected directly from you. Information from another professional or individual is obtained with appropriate consent or another lawful authorization.
A note about initial enquiries
You do not need to disclose your full personal or clinical history when making an initial enquiry.
Website contact forms are intended for general enquiries and appointment-related communication. Please avoid including detailed medical information or sensitive personal experiences in these forms.
If further information is required, we can discuss an appropriate way to share it.
How your information is used
Personal information is used for purposes directly related to providing psychotherapy and managing Joshua Erlick Therapy.
These purposes may include:
Responding to enquiries and arranging consultations.
Scheduling and managing appointments.
Providing psychotherapy and maintaining continuity of care.
Creating and maintaining clinical records.
Communicating about appointments, treatment and administrative matters.
Processing payments and issuing receipts.
Supporting professional clinical supervision and consultation.
Meeting legal, regulatory and professional obligations.
Responding to privacy requests or concerns.
Maintaining website functionality and security.
Website information may also be used to understand how visitors interact with the website and identify opportunities for technical improvements.
I do not sell personal health information or use information disclosed in psychotherapy to create targeted advertising.
Personal health information is collected, used and disclosed only with appropriate consent or where permitted or required by law.
Consent and your choices
Your participation in psychotherapy is based on informed consent.
Before therapy begins, I explain how information relevant to your care is collected, used and shared. This includes discussing confidentiality, recordkeeping and the privacy considerations associated with electronic communication or virtual therapy.
Consent is an ongoing process. You are welcome to ask questions about how your information is handled throughout our work together.
You may:
Ask questions about the collection or use of your information.
Discuss limitations on how your information is shared.
Decline optional communications.
Withdraw consent where consent is the basis for collecting, using or disclosing information.
Request access to your records or ask for corrections where permitted by law.
Some information is necessary to provide psychotherapy safely and maintain appropriate professional records.
If withholding or withdrawing consent affects my ability to provide a service, I will explain the implications and discuss the available options.
Withdrawing consent does not reverse information use that has already lawfully occurred. It also does not automatically require the deletion of records that must be retained under applicable legislation or professional standards.
Confidentiality and its limits
What you share during psychotherapy is treated as confidential.
Confidentiality is fundamental to the therapeutic relationship. Personal health information is not disclosed without appropriate consent unless disclosure is permitted or required by applicable law.
There are circumstances in which confidentiality may be limited.
These may include:
Reporting obligations under applicable child protection legislation.
Compliance with a valid court order or another legally enforceable requirement.
Circumstances involving a significant risk of serious harm where disclosure is legally authorized or required.
Disclosures required for certain professional or regulatory proceedings.
Other circumstances where disclosure is permitted or required by law.
Where disclosure is necessary, I aim to share only the information reasonably required for the authorized purpose.
The limits of confidentiality are discussed more fully during the informed consent process before psychotherapy begins.
Clinical supervision and professional consultation
Clinical supervision and professional consultation are important components of responsible psychotherapy practice.
As a Registered Psychotherapist (Qualifying), I practise within the clinical supervision requirements established by CRPO.
Relevant aspects of clinical work may be discussed with an appropriately qualified supervisor to support clinical judgment, professional development and the quality of care provided.
Identifying information is limited wherever reasonably possible. Information is shared in accordance with applicable privacy legislation and the informed consent arrangements discussed with clients.
Professional supervisors are also subject to responsibilities concerning confidentiality.
Website, booking and technology providers
Joshua Erlick Therapy uses external technology services to support website operations, appointment scheduling, communication and payment processing.
These services include:
Squarespace
Squarespace provides website hosting and related website functions.
When you visit this website or submit information through a website form, Squarespace may process technical information and the information you choose to provide.
Website form submissions may also be delivered to a connected email account or another designated service.
General website forms are not intended for collecting detailed confidential clinical information.
Acuity Scheduling
Acuity Scheduling is used to manage appointments and related communications.
When you book a consultation or therapy session, Acuity may process your name, contact details, appointment information and any information entered into the booking form.
Booking information may also appear in appointment confirmations, reminders or connected calendar services.
Google Workspace
Google services support aspects of practice administration and communication.
These include:
Google Calendar: Appointment scheduling and calendar synchronization.
Google Meet: Virtual psychotherapy appointments.
Gmail: Practice-related correspondence.
Google Drive: Storage of encrypted backup files where cloud backups are used.
Depending on the service and its configuration, Google may process contact details, appointment information, communications or technical information necessary to provide the service.
Appointment details synchronized with a calendar may constitute personal health information when they identify someone as receiving psychotherapy services.
PayPal and Stripe
PayPal and Stripe support payment processing.
Depending on the payment method, these providers may process identifying information, billing details, transaction amounts and payment information.
Payment providers maintain their own privacy and security practices. Their independent handling of transaction information is explained in their respective privacy policies.
Responsibility for external providers
External service providers have their own information-handling arrangements, security measures and privacy policies.
The use of these services does not remove my responsibility to take reasonable steps to protect personal health information under applicable legislation.
I remain responsible for considering the suitability of services used by the practice and taking reasonable steps to manage associated privacy risks.
Information shared through these services should be limited to what is reasonably necessary for their intended purposes.
Email, forms and virtual appointments
Electronic communication offers convenience and flexibility. It also introduces privacy considerations that differ from face-to-face communication.
Email and online services may involve information passing through external networks or service providers. Although security measures may be used, no electronic communication system can be guaranteed to be entirely free from risk.
For initial enquiries and routine correspondence, please use email primarily for scheduling or general questions.
If sensitive information needs to be shared electronically, we can discuss an appropriate method and any associated risks.
Virtual psychotherapy
Google Meet is used to facilitate virtual appointments.
For online sessions, clients are encouraged to:
Attend from a private environment wherever possible.
Use a secure internet connection.
Protect access to their devices and accounts.
Consider headphones to reduce the possibility of conversations being overheard.
Avoid sharing confidential meeting links.
Raise any privacy or technical concerns during the session.
The privacy considerations associated with virtual psychotherapy are discussed during informed consent.
Any proposed recording or automated transcription of a session would be discussed in advance and would require appropriate informed consent.
Urgent communication
Website forms and email are not monitored continuously.
They should not be used for emergencies or requests for immediate crisis support.
If you are experiencing an immediate emergency, please contact local emergency services or attend your nearest emergency department.
Payments and receipts
Information required to arrange payment and issue receipts is collected as part of providing psychotherapy services.
This may include your name, contact details, payment amount, transaction date and relevant billing information.
Online payments are processed through the applicable payment provider.
These providers may retain transaction records in accordance with their own privacy policies and legal obligations.
I aim to avoid including unnecessary sensitive clinical information in payment descriptions or transaction references.
Receipts may contain information identifying the practitioner, the service provided and the amount paid.
If you choose to submit a receipt to an insurance provider or another organization, that organization will process the information according to its own privacy practices.
Cookies and website analytics
Cookies are small files stored on your device when you visit a website.
This website may use cookies or similar technologies to support essential functions, remember preferences and understand website activity.
Depending on the website configuration, information collected may include:
IP addresses and general device information.
Browser type and operating system.
Pages visited and website navigation activity.
Cookie preferences and session information.
Technical information associated with integrated website services.
Some cookies support essential website functions. Others may be used for analytics or optional features.
Where applicable law requires consent for nonessential tracking technologies, that consent will be sought before they are used.
You can also manage or restrict cookies through your browser settings. Disabling certain cookies may affect website functionality.
Technical information and online identifiers may constitute personal information when they identify or can reasonably be linked to an individual.
Such information is handled in accordance with applicable privacy requirements.
Optional communications
Making an enquiry or booking psychotherapy does not automatically subscribe you to marketing communications.
If optional updates or newsletters are offered, participation is voluntary.
You may withdraw your consent or unsubscribe from optional communications at any time.
This does not prevent necessary messages concerning appointments, payments or ongoing care.
Information disclosed during psychotherapy is not used to create marketing profiles or targeted advertising.
Storage and protection of personal information
Joshua Erlick Therapy takes reasonable steps to protect personal health information against theft, loss and unauthorized access, use, disclosure, modification or disposal.
These responsibilities arise under Ontario's Personal Health Information Protection Act (PHIPA) and the Professional Practice Standards established by CRPO.
Clinical record storage
Clinical records are maintained electronically using Microsoft Word documents.
These records are stored locally on a password-protected Apple Mac computer with FileVault encryption enabled.
FileVault provides encryption of the computer's internal storage and helps protect information if the device is lost or stolen.
Access to clinical records is restricted to authorized purposes.
Appropriate recordkeeping also requires records to remain accurate, retrievable and protected against unauthorized alteration or disclosure.
Encrypted backups
Where cloud backups are used, clinical records are encrypted before being uploaded to the practice's Google Workspace Drive account.
This provides an additional layer of protection beyond the security measures offered by the cloud storage provider.
Backup information may be processed or stored by Google and its authorized service providers in accordance with the relevant service arrangements.
General security responsibilities
The safeguards appropriate to personal information depend on its sensitivity, the method of storage and the systems used to process it.
Relevant security considerations include:
Password protection and encryption.
Appropriate restrictions on access to clinical records.
Protection of devices and accounts.
Secure transmission of confidential information.
Protection against accidental loss or unauthorized alteration.
Appropriate backup and recovery arrangements.
Secure retention and disposal of records.
Assessment of the privacy practices of external service providers.
I remain responsible for taking reasonable measures appropriate to the information held by the practice.
No electronic system can guarantee absolute protection against every possible security incident.
International storage and processing
Some technology providers supporting Joshua Erlick Therapy may store or process personal information outside Ontario or Canada.
This may include processing in the United States or other jurisdictions where a provider or its authorized service providers operate.
Information processed in another jurisdiction may be subject to its local laws, including lawful access by courts, regulators or public authorities.
Storage locations and privacy safeguards vary according to the provider and the services used.
International processing does not remove my responsibility to protect personal health information in accordance with applicable Canadian privacy legislation.
Where external services handle personal health information, I remain responsible for assessing their suitability and taking reasonable steps to manage associated privacy risks.
You are welcome to contact me if you have questions about how your information is stored or protected.
Privacy breaches
A privacy breach may occur when personal health information is lost, stolen or accessed, used or disclosed without proper authorization.
If a suspected privacy breach occurs, I am responsible for taking appropriate steps to assess the circumstances, contain the incident and address any resulting privacy risks.
Where personal health information has been stolen, lost or used or disclosed without authority, affected individuals will be notified at the first reasonable opportunity as required under PHIPA.
Certain incidents must also be reported to the Information and Privacy Commissioner of Ontario.
The circumstances of a breach determine the applicable notification and reporting requirements.
If you believe your personal information has been compromised in connection with Joshua Erlick Therapy, please contact me directly.
How long information is kept
Clinical records are retained in accordance with CRPO's Professional Practice Standards and applicable legislation.
Where I am the custodian of the clinical record, records are retained for at least 10 years after the last interaction with the client or 10 years after the client's 18th birthday, whichever is later.
Records may need to be retained longer where another legal or professional obligation applies.
Clinical records may include consent documentation, assessments, treatment notes and relevant correspondence forming part of the therapeutic record.
Financial and administrative records are retained in accordance with applicable professional and legal requirements.
Other information
Information collected through enquiries that do not proceed to therapy is retained only for as long as reasonably necessary for its purpose and applicable obligations.
Website information and technical data may be retained according to the relevant website functions and service provider arrangements.
Payment providers may independently retain transaction records to meet their financial or legal obligations.
Secure disposal
When information is no longer required and applicable retention periods have ended, it is securely destroyed or otherwise disposed of using methods appropriate to its storage format.
Ending psychotherapy, withdrawing consent or unsubscribing from optional communications does not automatically require the deletion of clinical records that must legally be retained.
If the practice closes or its arrangements change, clinical records must continue to be managed in accordance with applicable privacy legislation and CRPO standards.
Access to your personal health information
You have the right to request access to personal health information about you that is held by Joshua Erlick Therapy, subject to applicable legal exceptions.
Requests may be made by contacting:
I may ask you to submit a request in writing and provide sufficient information to verify your identity or your authority to make the request.
Under PHIPA, formal access requests are generally answered as soon as reasonably possible and within 30 calendar days.
An extension of up to 30 additional calendar days may be permitted in circumstances established by law. Where an extension applies, the reasons and revised timeline will be communicated.
Access may be provided through an opportunity to examine an eligible record or by supplying a copy.
Reasonable cost-recovery fees may apply where permitted by law. Any applicable fee will be explained in accordance with legal requirements.
Limits on access
The right to access personal health information is subject to certain exceptions.
Access may be restricted where permitted or required by law, including circumstances where disclosure could reasonably be expected to create a risk of serious bodily harm or serious harm to an individual's treatment or recovery.
Other legal restrictions may apply to particular records or information.
Where access is refused in whole or in part, the reasons will be explained along with information about your available rights.
Requests to correct information
You may request a correction to personal health information if you believe a record is inaccurate or incomplete for the purposes for which it is used.
Correction requests are considered in accordance with PHIPA and other applicable requirements.
A correction request may be declined where the law permits, including where:
The information is not inaccurate or incomplete for the purpose for which it is used.
Sufficient information has not been provided to establish that a correction is required.
The information was not originally created by the practice and there is insufficient authority or knowledge to amend it.
The record contains a professional opinion or observation made in good faith.
Where a correction request is refused, the reasons will be explained.
You may also have the right to prepare a statement of disagreement that can be associated with the relevant record in accordance with PHIPA.
Formal correction requests are generally addressed within the applicable statutory timelines.
Questions, concerns and privacy complaints
You are welcome to ask questions about how your personal information is collected, used, stored or disclosed.
If you have a concern or complaint about the handling of your information, you may contact me directly.
Joshua Erlick Therapy
Privacy Contact: Joshua Erlick
Email: hello@joshuaerlicktherapy.com
Privacy concerns will be reviewed and addressed in accordance with applicable legal and professional responsibilities.
You also have the right to make a complaint to the Information and Privacy Commissioner of Ontario (IPC) if you believe your rights under PHIPA have been affected.
The IPC is the independent authority responsible for overseeing compliance with Ontario's health privacy legislation.
Information and Privacy Commissioner of Ontario
Website: https://www.ipc.on.ca
You may contact the IPC directly where you have a right to make a complaint under PHIPA.
Changes to this Privacy Policy
This Privacy Policy may be updated to reflect changes in legislation, professional requirements, technology providers or the operation of Joshua Erlick Therapy.
When changes are made, the date at the top of this page will be updated.
Where an important change requires additional notice or consent under applicable law, the appropriate steps will be taken.
The most current version of this Privacy Policy will be available on this website.
A final word
Privacy is not simply an administrative requirement. It is part of the trust on which meaningful psychotherapy depends.
My responsibility is to approach the information you share with care, professional judgment and respect for your rights.
If you have questions about your privacy or the handling of your information, I welcome you to contact me.
Joshua Erlick
Registered Psychotherapist (Qualifying)
Joshua Erlick Therapy
hello@joshuaerlicktherapy.com