Privacy Policy

Last updated: (2025/07/10) Effective Date: (2025/07/28)

1. Purpose

ABA Learning Centre is committed to protecting the privacy, confidentiality, and security of the personal information in our custody. This Policy sets out how we collect, use, disclose, retain, and safeguard personal information in accordance with British Columbia’s Personal Information Protection Act (“PIPA”) and the professional standards and bylaws of the College of Health and Care Professionals of BC (“CHCPBC”) for psychologists. We have appointed a Privacy Officer who is responsible for ensuring our compliance with PIPA and addressing privacy-related inquiries or complaints (see Section 14).

2. Scope

Our website, online forms, and e-mail.
Our clinical and educational services include psychological and psychoeducational assessments, autism diagnostic evaluations, therapy, consultation, and related supports.
Interactions with current and prospective clients, their parents/guardians, caregivers, staff, contractors, and other service providers.

3. Definitions

Personal Information: means information about an identifiable individual (e.g., name, address, IP address, health or educational records) as defined in PIPA.

Health Information: is personal information relating to an individual’s physical or mental health, including diagnostic test data and clinical notes.

Client: includes any child, youth, or adult who receives our psychological services and, where applicable, their parent or legal guardian.

4. Legal and Professional Framework

PIPA (private-sector privacy law).
Health Professions Act and CHCPBC bylaws, standards of practice, and record-keeping requirements for psychologists (e.g., minimum retention periods).
Other legislation (e.g., Child, Family and Community Service Act duty to report, Income Tax Act, court orders, or other applicable legislation).

5. What We Collect

In the course of providing psychological services, we collect a range of personal and health-related information through in-person sessions, secure email (e.g., Microsoft Outlook), and virtual platforms (e.g., Zoom) used for intake interviews, feedback meetings, and some diagnostic assessments (e.g., ADIR interviews). All digital communications and virtual sessions are conducted using secure platforms and follow our confidentiality and data protection protocols. The types of personal information we collect fall into the following categories:

6. Purposes of Collection

Provide, coordinate, and evaluate psychological and educational services.
Communicate appointment reminders, assessment results, and service updates.
Process payments, insurance claims, and accounting.
Meet legal, regulatory, and risk-management obligations (e.g., practice audit, quality assurance, mandatory reporting).
Improve our programs, website, and client experience.
Respond to feedback, inquiries, or complaints.

Clients also have the right to access and request corrections to their personal information, withdraw consent (subject to limitations), and file privacy-related complaints.

We recognize that Indigenous clients and communities may have distinct perspectives and rights regarding the ownership, control, access, and stewardship of personal and collective information. We are committed to respecting Indigenous data sovereignty and are open to working with clients or communities to honour culturally appropriate data practices, where possible and appropriate. We strive to align with principles such as OCAP® when appropriate and in consultation with Indigenous communities.

7. Consent

We rely on express consent (written or verbal) for sensitive health information and service delivery. In some cases, we may rely on implied consent, such as when a client voluntarily provides information for an obvious purpose (e.g., sharing an email address to receive appointment reminders). You may withdraw your consent at any time by providing reasonable notice. However, doing so may limit our ability to provide services and does not override legal or professional requirements to retain certain records.

8. Use & Disclosure

Personal information is used or shared only for the purposes listed above, or as otherwise permitted or required by law. Examples:

With other health-care or educational professionals involved in a client’s care, but only with consent or as authorized.
With third-party service providers (e.g., secure electronic record platforms, cloud backup), who must safeguard data to our standards.
When required for CHCPBC investigations or disciplinary proceedings (note: complainant name and details may be shared with the registrant as mandated by the Health Professions Act).
To comply with a subpoena, warrant, court order, or statutory duty (e.g., risk of serious harm, child protection).

9. Retention & Destruction

Clinical records are kept at least seven (7) years after the last service date for adults, or seven (7) years after a minor client turns 19, whichever is longer, or such longer period as legal requirements dictate. Administrative and website logs are retained only as long as necessary for the purposes described. When records are no longer required, they are securely destroyed, deleted, or anonymized.

10. Safeguards

Physical safeguards: locked filing cabinets and secure office premises;
Administrative safeguards: role-based access controls and privacy training;
Technical safeguards: encryption in transit and at rest, multi-factor authentication.

11. Cookies & Website Analytics

Our website uses cookies and similar technologies to maintain session security and understand aggregate visitor behavior. You may adjust your browser settings to refuse cookies; however, doing so may affect site functionality.

12. Access, Correction & Portability

You have the right to request access to, or correction of, your personal information in our custody, subject to limited exceptions (e.g., records containing third-party information, legal privilege). Please submit written requests to our Privacy Officer (see point 14). We will respond within the time limits set by PIPA. A minimal administrative fee may apply for access requests, in accordance with PIPA. You will be notified in advance if this fee applies.

13. Breach Notification

We take privacy breaches seriously. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner for BC in accordance with PIPA requirements.

14. Contact & Complaints

Joseph Carpenter

Managing Director and Privacy Officer

1110-6900 Graybar Road,

Richmond, BC, V6W 0A5

Phone: 604-232-4122

E-mail: joseph@abacentre.ca

If you have a concern about our privacy practices, please contact us in writing. We will investigate and respond within 30 days. If you are not satisfied, you may contact:

Office of the Information and Privacy Commissioner for British Columbia

PO Box 9038,

Stn. Prov. Govt., Victoria BC V8W 9A4

Phone: 250-387-5629

Email: www.oipc.bc.ca

15. Changes to this Policy

We may amend this Policy from time to time. Material changes will be posted on our website at least 15 days before taking effect.