Symphony Physiotherapy Privacy Policy
Last updated: April 13, 2026
This Privacy Policy explains how Symphony Physiotherapy (“Symphony”, “we”, “us”, “our”) collects, uses, discloses, retains and protects personal and personal health information when you interact with our clinic, website, services, or staff. By receiving our services or providing us with personal information you consent to the collection, use, and disclosure described below.
Additional Notices
Where applicable, supplemental notices or acknowledgements (for example, consent forms, booking platform privacy notices or jurisdictional legal disclosures) will be provided to meet local legal requirements.
End of Policy.
Scope and Commitment
This Policy applies to personal information and personal health information collected in-clinic (paper or electronic), by phone, email, our website, third-party booking platforms, referral exchanges, and other interactions.
We are committed to collecting, using, and disclosing only the information reasonably necessary to provide care and to meet administrative, legal and regulatory requirements. This Policy is intended to be open and transparent about our practices.
Definitions
“Personal information” means information that identifies or can be associated with an identifiable individual.
“Personal health information” (PHI) includes information about an individual’s physical or mental health, provision of healthcare, payment or eligibility for healthcare, health numbers, insurance details, clinical records, treatment notes, and substitute decision-maker information.
Information We Collect We collect information appropriate to the services we provide, including but not limited to:
Identifiers and contact details: name, address, phone, email, date of birth.
Health and clinical information: medical history, presenting condition, assessment notes, diagnoses, treatment plans, progress notes, medications, referral information, consent forms, and related clinical documents.
Appointment and billing data: appointment dates/times, invoices, payment and insurance information, claims, and receipts.
Communications and support records: messages, emails, intake forms, feedback, and consent records.
Usage and technical data: IP address, device/browser details, cookies and analytics data from our website.
Third-party information: information provided by other healthcare providers, insurers, referral sources, or authorized family members/substitute decision-makers.
We do not knowingly collect PHI from children. If you believe we have collected information about a child, contact us to request deletion.
Why We Collect and How We Use Information Primary purposes:
To assess, provide, manage and document physiotherapy and rehabilitative care.
To schedule, confirm and manage appointments and send reminders.
To bill and process payments and insurance claims.
Related/secondary purposes:
Quality assurance, training and peer review, including audits by external consultants or regulatory bodies.
Compliance with legal, regulatory and professional obligations (e.g., College inspections, mandatory reporting).
Communicating clinic updates, events or promotions where you have provided consent.
Fraud prevention, security, and investigation of incidents.
Fundraising or clinic development communications where expressly permitted; patients will be offered an easy opt-out.
Facilitating business transactions (e.g., sale or transfer of clinic assets) subject to confidentiality safeguards and notice.
Legal Basis and Consent
Where required by law or regulation, we rely on consent, the provision and performance of services, legal obligations, and legitimate interests (balanced against your privacy rights) to collect and process information.
We will obtain express consent for sensitive uses (e.g., marketing or release of PHI beyond care team) unless otherwise permitted by applicable law.
Disclosure and Third Parties We may disclose personal information to:
Health care providers and allied professionals to coordinate care.
Insurers, government agencies, or third-party payers for claims and payment.
Service providers who perform functions on our behalf (IT/hosting, billing processors, analytics, document shredding, legal and accounting services). These vendors are required to protect PHI and enter confidentiality agreements.
Regulatory bodies, law enforcement or courts when required by law.
Potential purchasers or their advisors during due diligence if the clinic is sold — under confidentiality obligations and limited use.
Any third party you authorize.
We do not sell personal health information or use it to infer sensitive characteristics about you.
Security Safeguards
We protect PHI using administrative, physical and technical safeguards appropriate to the sensitivity of the information, including locked storage for paper records, restricted access, encryption for electronic records and mobile devices, strong passwords, and two-factor authentication where possible.
Staff, contractors and external consultants with access to PHI are bound by confidentiality agreements and receive privacy training.
Paper files are transported securely; electronic transfers use encryption or anonymization as appropriate.
Retention and Destruction
Patient files are retained in accordance with legal and professional requirements. As a general practice we retain records for a minimum of ten (10) years from the date of last patient interaction, or ten years after the patient turns 18, whichever is longer, unless a different retention period is required by law.
When records are no longer required, paper records are destroyed by secure cross-cut shredding; electronic records and devices are securely deleted/overwritten or hardware physically destroyed.
Access, Correction and Control of Your Information
Subject to legal exceptions, you have the right to request access to the personal information and PHI we hold about you, request corrections to factual inaccuracies, and request a copy or portability of your information where applicable.
To request access or correction, contact our Privacy Officer (details below). We may require proof of identity and may charge a reasonable fee for copying or locating records where permitted by law. We will respond within applicable statutory timelines (typically within 30 days where required).
If we refuse access or correction, we will explain the reason and provide information about any available complaint rights.
Privacy Breaches and Notification
If we become aware of an unauthorized access, loss or disclosure of PHI, we will take steps to contain and remediate the breach (e.g., retrieve records, change access credentials, limit system access), investigate the incident, notify affected individuals where required, and notify any applicable regulatory authorities.
We will provide affected individuals with contact information, steps to protect themselves and the regulator’s contact details where required.
Children
Our services are not intended for children. We do not knowingly collect PHI from individuals under the age of majority. If we learn that a child’s PHI has been provided to us without appropriate consent, we will take reasonable steps to delete it.
International Transfers
Personal information may be stored or processed outside your country of residence (for example, by third-party service providers). When transfers occur, we use contractual safeguards and other appropriate measures to protect PHI in accordance with applicable law.
Complaints and Enforcement
For questions, concerns, or to make a complaint, contact our Privacy Officer (below). We will acknowledge and investigate complaints promptly and provide a written response.
You may have the right to complain to the applicable data protection or privacy regulator in your jurisdiction if you are not satisfied with our response.
Contact — Privacy Officer Symphony Physiotherapy Privacy Officer: [Name — e.g., Clinic Owner or Practice Manager] Address: [clinic mailing address] Phone: 705-326-9977 Email: [clinic email address]
Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised Policy with an updated “Last updated” date.