Statement of Health Information Practices

Last Updated: September 15, 2026

As required under Section 16 (1) of the Personal Health Information Protection Act (PHIPA), 2004 (Ontario), the Personal Health Information Act (PHIA) (Newfoundland and Labrador), and the Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada).

I, Christina McGrath, am committed to protecting the privacy and confidentiality of your personal health information. This statement outlines my information practices as a Registered Social Worker across the jurisdictions in which I practice.

1. My Information Practices

I collect, use, and disclose personal health information to provide Social Work Counselling and Goal Focused Coaching.

Collection: I collect personal health information directly from you, with your consent, to:

• Understand your biopsychosocial needs,
• Provide appropriate clinical interventions
• Maintain accurate professional records.

*This may include your health history, employment history, experiences of workplace trauma or moral injury, and other relevant information.

Use: Your personal health information is used to:

• Provide Social Work assessment, support, and intervention.
• Plan and manage your service goals within a social work framework.
• Communicate with you regarding appointments and professional services.
• Ensure the quality and safety of the clinical services provided.
• For billing and administrative purposes related to your care.

Disclosure: I will only disclose your personal health information:

• With your express consent
• As permitted or required by law (e.g., in cases of risk of serious harm, legal proceedings, or as required by regulatory bodies).
• I may share information within your "circle of care" (e.g., with other healthcare providers involved in your care) with your implied consent, unless you instruct me otherwise.

**Systemic Intervention & Advocacy: When social work services are provided to address health and safety within an organizational system, personal health information shared by an individual remains strictly confidential. I do not disclose the private health or personal details of individuals to employers or organizational leadership without explicit, written consent, except where required by law. My role in these settings is focused on systemic health and advocacy, not individual disclosure.

2. Safeguards & Technology

I implement reasonable administrative, technical, and physical safeguards to protect your personal health information against theft, loss, unauthorized access, disclosure, copying, use, or modification.

• International Data Storage: To provide secure telehealth services, I utilize Carepatron and Protonmail. Please be advised that personal information may be stored on secure, encrypted servers located in the United States, Singapore, or Switzerland. While this data is protected by industry-leading encryption, it is subject to the laws of the jurisdiction in which it is stored, which may differ from Canadian privacy laws.

• Breach Notification: In accordance with PHIA (Newfoundland and Labrador) and PHIPA (Ontario), I maintain a protocol to notify you at the first reasonable opportunity if your personal health information is stolen, lost, or accessed by an unauthorized person.

3. Access to and Correction of Your Information

You have the right to access your record of personal health information held by me, subject to limited exceptions. You also have the right to request a correction or amendment to your personal health information if you believe it is inaccurate or incomplete.

To request access or correction, please submit a written request to thrive@christinamcgrath.ca with the subject line "ACCESS TO INFORMATION REQUEST." I will respond to your request within 30 days, as specified by provincial and federal guidelines.

4. Contact Information & Complaints

For questions or concerns about my information practices, please contact:

Privacy Contact Person: Christina McGrath, RSW Phone: (807) 335-0238 Email: thrive@christinamcgrath.ca

If you are not satisfied with my response, you have the right to make a complaint to the appropriate Commissioner:

• Ontario: Information and Privacy Commissioner of Ontario | 2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8 | www.ipc.on.ca

• Newfoundland & Labrador: Office of the Information and Privacy Commissioner | P.O. Box 13004, St. John’s, NL A1B 3V8 | www.oipc.nl.ca

• Canada (Federal): Office of the Privacy Commissioner of Canada | 30 Victoria Street, Gatineau, QC K1A 1H3 | www.priv.gc.ca