Privacy Policy

Who this covers

Rahao Therapy is the practice of Anhad Kaur, Registered Psychotherapist, registered with the College of Registered Psychotherapists of Ontario (CRPO #17015). Anhad is the health information custodian responsible for the personal health information described here.

This policy covers two separate things: this website, and the therapy practice. They collect different information and are kept deliberately separate.

What the website collects

This site uses Google Analytics, loaded through Google Tag Manager, to understand how people find and move through the site. It records things like which pages are visited, roughly where in the world a visit came from, and whether someone arrived from a search or an advertisement.

This is measurement, not profiling. It tells us that a page was visited. It does not tell us who you are, it is never combined with anything from your therapy file, and no part of it is used to build an audience list or to target you personally.

This site also uses Microsoft Clarity, loaded through Google Tag Manager, to show us where the site is confusing or hard to use. Clarity goes further than Google Analytics. It creates heatmaps and session recordings, which are replays of a visit that show scrolling, clicks and the pages viewed. It also receives the random ID Google Analytics gives your browser, so we can look at the two together.

We do not use Clarity to work out who you are or to advertise to you, and nothing from it is combined with your therapy file. We keep Clarity’s content masking turned on to limit what it can capture. Even so, please keep clinical detail out of the contact form, as explained below.

Microsoft runs Clarity under its own terms and describes itself as a data controller, which means it makes some of its own decisions about this data. Clarity sets cookies in your browser, including _clck and _clsk, and some Microsoft cookies it uses, such as MUID, also support Microsoft’s advertising and other operations. Microsoft says recordings are generally kept for up to 30 days, with some kept for up to 9 months, and that heatmaps are available for up to 9 months.

Analytics cookies are set in your browser for this purpose. If you would rather not be measured at all, most browsers let you block cookies, and you can install Google’s own opt-out add-on. To stop Clarity, turn on Global Privacy Control in your browser or through a browser extension. Clarity does not respond to Do Not Track signals. Microsoft also points people to the Digital Advertising Alliance opt-out. Nothing on the site stops working if you do any of this.

If you arrive by clicking one of our Google ads, Google Ads records whether that click led to an enquiry, so we can tell which ads are useful. Your browser keeps the ad’s reference codes for up to 90 days, and if you send an enquiry those codes go with it, so we know which ad it came from. They identify the ad and the keyword by number, not the words you searched. We do not use this for remarketing, and we do not build audience lists from visits to this site.

Other parties involved in serving the site:

• Vercel hosts the site and keeps standard server logs, including IP address and browser type, for security and reliability.
• Google Fonts serves the typefaces. Your browser requests them from Google, which receives your IP address in the process.
• Wistia hosts the introduction video on the home page and may set a cookie when the player loads, to measure playback. It appears on that one page only.
• Google Tag Manager, Google Analytics and Google Ads, as described above. Google processes this data on our behalf and may store it outside Canada.
• Microsoft Clarity, as described above. Microsoft stores this data in its Azure cloud service, which may be outside Canada.

Booking links take you to Jane, a separate booking and records system. Once you are on Jane, Jane’s own privacy policy applies.

What the contact form collects

The contact form asks for your name, email address and a short note about what you are looking for. It is used only to reply to you and to arrange a consultation.

Email is not a secure channel. Please do not send detailed clinical or health information through the form or by email. A free 20-minute consultation is a safer place for that conversation, and anything clinical belongs in Jane.

What the practice collects

If you become a client, Anhad collects what is needed to provide care and to meet her professional obligations: contact details, date of birth, emergency contact, relevant health and mental health history, what is discussed in session, session notes, and payment records.

How it is used

• Providing and coordinating your care
• Scheduling, reminders and communicating with you
• Processing payment and issuing receipts for your insurer
• Keeping the clinical records that CRPO requires
• Meeting legal and professional obligations

Your information is never sold, rented, or used for marketing.

When information is shared

Clinical information is disclosed only with your written consent, or where the law requires or permits it without consent. The main exceptions are:

• A child under 16 may be in need of protection
• A serious risk of harm to you or to someone else
• A subpoena, warrant or court order
• A mandatory report about a regulated health professional

Where an exception applies, only the information necessary for that purpose is shared.

Where your information is stored

Clinical records are kept in Jane, which stores Canadian health data on Canadian servers. The website and the contact form are served from infrastructure located in the United States, which means information submitted through the form may be processed outside Canada and could be subject to the laws of that country. This is one reason the form should not carry clinical detail.

How long it is kept

CRPO requires clinical records to be retained for at least ten years after your last interaction with the practice. For a client who was under 18, the ten years runs from their eighteenth birthday. Contact form enquiries that do not become client files are kept only as long as needed to respond, and then deleted.

How it is protected

Records are held in a password-protected, encrypted practice management system with access limited to Anhad and, in future, to clinicians working within the practice who need it to provide care. Sessions are delivered over a platform that meets Canadian health privacy standards. No system is completely secure, and information sent over the internet carries some risk that cannot be fully eliminated.

Your rights

Under Ontario’s Personal Health Information Protection Act (PHIPA) you have the right to:

• Ask for access to your record, and receive a copy. A reasonable fee may apply for copying.
• Ask for a correction if something is inaccurate or incomplete.
• Withdraw or limit your consent to a particular use or disclosure, subject to legal limits.
• Ask who your information has been shared with.
• Make a complaint, and be told how it was handled.

To exercise any of these, email admin@rahaotherapy.com. You can expect a response within 30 days.

If you have a concern

Please raise it with Anhad first, at admin@rahaotherapy.com. Most concerns can be resolved directly.

You also have the right to complain to the Information and Privacy Commissioner of Ontario, who oversees PHIPA, at ipc.on.ca or 1 800 387 0073. Concerns about professional conduct can be directed to the College of Registered Psychotherapists of Ontario at crpo.ca.

Who this service is for

Rahao Therapy works with adults. The site is not directed at children, and information is not knowingly collected from them.

Other websites

This site links to other organisations, including Jane and professional directories. Their privacy practices are their own, and we would encourage you to read them.

Changes to this policy

If this policy changes materially, the new version will be posted here with an updated effective date.

Contact

Anhad Kaur, Registered Psychotherapist (CRPO #17015)
Rahao Therapy · Virtual across Ontario
admin@rahaotherapy.com