PRIVACY POLICY

Enlee is a nonprofit mental health organization committed to providing accessible, culturally responsive, and trauma-informed mental health support to marginalized individuals and communities, including newcomers, refugees, and those who face systemic barriers to care. We recognize that the people we serve are among the most vulnerable, and we treat the privacy of every individual who accesses our services as a fundamental right.

This Privacy Policy governs all personal health information and personal information collected, used, or disclosed by Enlee in connection with the delivery of mental health services, volunteer and intern coordination, community programs, and organizational administration. It applies to all staff, clinical supervisors, interns, students, volunteers, and contractors who work with Enlee in any capacity.

Enlee's Privacy Officer is the Executive Director. Privacy-related questions, requests, or concerns should be directed to: Bonny Li, bkli@enlee.com

This Policy is governed by and interpreted consistently with:

• Personal Health Information Protection Act, 2004 (PHIPA, Ontario)
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• Regulated Health Professions Act, 1991 (RHPA, Ontario)
• Child, Youth and Family Services Act, 2017 (CYFSA, Ontario)
• Mental Health Act, R.S.O. 1990
• Not-for-Profit Corporations Act, 2010 (Ontario), where applicable
• Professional standards and codes of ethics of the College of Registered Psychotherapists of Ontario (CRPO), the Canadian Counselling and Psychotherapy Association (CCPA), and any other applicable regulatory bodies governing Enlee's clinical staff and supervisors

This Policy applies to:

• All individuals who seek, receive, or have received services from Enlee
• All clinical supervisors, therapists, interns, and students operating under Enlee's umbrella
• Volunteers, administrative staff, and contractors
• Third parties who provide or receive information in connection with Enlee's service delivery

It governs personal health information collected in person, by telephone, by email, through Enlee's intake processes, and through any other channel used by Enlee in connection with service delivery or organizational operations.

Personal health information (PHI) includes identifying information about an individual related to their physical or mental health, including:

• Name, date of birth, address, and contact information collected in a health care context
• Presenting concerns, symptoms, diagnoses, and treatment history
• Session notes, progress records, and clinical documentation
• Psychometric or screening tool results
• Immigration status, refugee claim history, or legal circumstances disclosed in a clinical context
• Information about trauma history, cultural background, or family circumstances
• Medications, referrals, and correspondence related to an individual's health care
• Financial information collected for sliding scale or fee determination purposes

Enlee acknowledges that many of the individuals we serve belong to communities with heightened vulnerability around privacy — including refugee claimants, undocumented individuals, and survivors of persecution. Information that could identify or expose these individuals is treated with exceptional care and the strictest level of discretion.

5.1 What We Collect

Enlee collects the personal health information necessary to provide mental health services and administer programs, including:

• Identifying and contact information
• Reason for seeking support and presenting concerns
• Relevant personal, family, cultural, and medical history
• Emergency contact information
• Financial or income information for the purposes of sliding scale fee determination
• Immigration or residency status where relevant to service eligibility or clinical care
• Session content documented in clinical notes
• Consent forms and intake documentation

5.2 How We Collect It

Information is collected directly from service recipients through intake forms, verbal intake, and clinical sessions. Where a client is referred by a community organization, legal advocate, or another health provider, information shared in that referral is collected only to the extent necessary for service delivery and with the client's knowledge.

5.3 Consent

Enlee collects personal health information only with the individual's knowledge and consent, except where collection is required or authorized by law. Individuals are informed at intake about what information is collected, why, and how it is used. Consent may be withdrawn at any time, subject to Enlee's legal and ethical obligations. Consent forms are provided in plain language and, where possible, in the individual's preferred language.

Enlee uses personal health information for the following purposes:

• Conducting intake and assessment to understand the individual's needs
• Delivering and documenting mental health services
• Facilitating clinical supervision of interns and students providing services
• Communicating with individuals about appointments and services
• Assessing eligibility for subsidized or free services
• Complying with legal reporting obligations
• Internal quality assurance and program evaluation (in a de-identified format wherever possible)
• Reporting to funders, granting bodies, or regulatory bodies using aggregate, de-identified data only

Enlee does not use personal health information for fundraising, marketing, or any purpose unrelated to the care and support of the individual without their explicit written consent.

7.1 Disclosure With Consent

Enlee may disclose personal health information to other parties with the individual's written consent, including other health care providers, community organizations, legal representatives, or settlement workers involved in the individual's support.

7.2 Mandatory Disclosure Without Consent

There are circumstances in which Enlee is legally and ethically required to disclose information without consent:

• Child protection: Where there are reasonable grounds to suspect a child is or may be at risk of abuse, neglect, or harm, Enlee is required to report to the Children's Aid Society under the Child, Youth and Family Services Act, 2017, regardless of consent.
• Risk of serious harm: Where an individual poses a credible, serious risk of harm to themselves or an identifiable third party, Enlee may breach confidentiality to the extent necessary to prevent that harm.
• Court order or legal process: Where required by a court order, subpoena, or other lawful legal authority.
• Regulatory investigations: Where required by the CRPO or another regulatory body in the context of a complaint or investigation involving Enlee's clinical staff.
• Coroner's inquest: Where required under the Coroners Act.

In all cases, Enlee discloses only the minimum information necessary. Where possible, individuals are informed of mandatory disclosures in advance.

7.3 Disclosure to Interns and Students

Enlee operates as a training organization for student clinicians in practicum and internship placements. Interns and students access personal health information strictly to the extent required to provide services under clinical supervision. All interns and students sign Enlee's confidentiality agreement prior to beginning their placement and are trained on PHIPA obligations before accessing any client information.

7.4 Funder and Grant Reporting

Where Enlee is required to report to funders or granting bodies, all reporting uses aggregate, de-identified data. No personal health information is disclosed to funders without the explicit written consent of the individual.

8.1 Record Storage

Clinical records are stored in secure, password-protected systems accessible only to authorized Enlee personnel. Physical records, where applicable, are stored in locked filing cabinets in Enlee's premises.

8.2 Retention Period

Clinical records are retained for a minimum of ten (10) years from the date of the last entry, or, in the case of a minor, until ten (10) years after the individual reaches the age of majority, in accordance with CRPO Standards of Practice and applicable professional obligations.

8.3 Security Measures

Enlee takes the following steps to protect personal health information:

• Role-based access controls and password-protected systems
• Confidentiality agreements signed by all clinicians, supervisors, interns, students, volunteers, and contractors
• Training on PHIPA and Enlee's privacy practices before accessing any client information
• Secure disposal of physical records by cross-cut shredding
• No transmission of PHI via unencrypted email without explicit client consent and documented acknowledgment of risk

9.1 Right of Access Individuals have the right to request access to their personal health information held by Enlee. Requests must be made in writing to the Privacy Officer. Enlee will respond within thirty (30) days or as otherwise required by law.

9.2 Right to Request Correction Individuals may request correction of information they believe is inaccurate or incomplete. Where a correction is not made, the request will be noted in the record.

9.3 Right to Withdraw Consent Individuals may withdraw consent to collection, use, or disclosure at any time, subject to legal and ethical obligations. Withdrawal of consent does not affect information already collected or Enlee's mandatory reporting obligations.

9.4 Right to File a Complaint Individuals who have concerns about Enlee's privacy practices may:

• Raise the concern directly with Enlee's Privacy Officer (Executive Director)
• File a complaint with the Information and Privacy Commissioner of Ontario (IPC): ipc.on.ca | 1-800-387-0073
• File a complaint with the CRPO (where the concern involves a regulated therapist): crpo.ca | 1-844-712-2776

A privacy breach occurs when personal health information is collected, used, disclosed, retained, or disposed of in a manner not authorized under PHIPA or this Policy. Any Enlee staff member, intern, student, volunteer, or contractor who becomes aware of an actual or suspected breach must report it immediately to the Privacy Officer.

Upon becoming aware of a breach, Enlee will:

• Take immediate steps to contain the breach
• Assess the severity and scope
• Notify affected individuals where there is a real risk of significant harm
• Notify the Information and Privacy Commissioner of Ontario where required
• Document the breach and the response
• Review and strengthen practices to prevent recurrence

Enlee operates as a practicum and internship site. All clinical services are provided by interns and students under the supervision of qualified supervisors. The following practices govern privacy in this context:

• Interns and students access only the information required to provide services under supervision
• Case discussions in supervision use the minimum identifying information necessary
• Supervisors are bound by their own professional codes of ethics and PHIPA obligations
• Client consent is obtained for involvement of interns in their care as part of the standard informed consent process

Enlee is deeply committed to serving communities for whom privacy concerns carry heightened stakes, including refugee claimants, survivors of state-sponsored violence, individuals with precarious immigration status, and those with histories of institutional harm. In this context, Enlee:

• Takes particular care to explain, in plain and accessible language, what information is collected, who can see it, and the limits of confidentiality — including mandatory reporting obligations — before any information is shared
• Recognizes that fear of disclosure is rational for many of the individuals we serve and treats this with respect rather than minimization
• Provides privacy information in plain language and, where possible, in the individual's preferred language
• Does not share immigration-related information or information that could affect an individual's immigration or refugee claim without explicit, informed written consent, except where required by law

This Policy is reviewed annually or more frequently as required by changes in legislation, professional standards, or Enlee's programs. Material changes will be communicated to active service recipients and to all individuals bound by confidentiality obligations at Enlee.