Privacy Policy

Effective date: October 26, 2026

Last updated: October 26, 2026

​

1. Who We Are

Richard Xiao carries on business as a sole proprietor under the registered business name Physio Soleil (the “Practice”).

The Practice provides physiotherapy assessment and treatment services in Québec, within the professional scope, competence and legal authorizations of the physiotherapist providing them.

Head office: 3744, rue Ontario Est, Montréal (Québec) H1W 1S2

Québec enterprise number (NEQ): 2280857410

Website: [www.physiosoleil.com]

General email: [physiosoleil@gmail.com]

Telephone: 438-493-2998

The expression “Practice” refers to Richard Xiao carrying on business as Physio Soleil. It does not refer to a separate corporation or other legal person.

Services are provided at the Practice’s treatment location and at the client’s home. The clinical record is created and held by the Practice.

​

2. Applicable Privacy Regime

Personal information collected or held by the Practice in the course of its activities, including health information concerning its clients, is governed by the Act respecting the protection of personal information in the private sector.

Health information is sensitive personal information. Consent to its use within the Practice and to its communication outside the Practice must be express.

The physiotherapist providing services is also subject to professional secrecy and to the ethical, professional and record-keeping obligations applicable to members of the Ordre professionnel de la physiothérapie du Québec.

​

3. Purpose and Scope of This Policy

This Policy explains how the Practice collects, uses, communicates, safeguards, retains, destroys and, where permitted, anonymizes personal information.

It applies to information collected or held in connection with:

• visits to the Practice’s website;

• inquiries and requests for information;

• appointment bookings and service requests;

• physiotherapy assessment and treatment, at the treatment location or at the client’s home;

• telephone calls and electronic communications;

• intake, consent and authorization forms;

• professional client records;

• billing, payments, receipts and reimbursement requests;

• access, correction and other privacy requests;

• complaints and confidentiality incidents; and

• the administration and operation of the Practice.

​

4. Information We May Collect

The Practice collects only information reasonably necessary for an identified purpose.

Depending on the interaction and the service requested, the Practice may collect the following categories of information.

​

4.1 Identity and Contact Information

This may include name, date of birth, residential, billing or service address, telephone number, email address, preferred language, emergency contact information, and information reasonably required to verify identity.

​

4.2 Appointment and Service Information

This may include the service requested, appointment dates and times, the service location, availability, attendance, rescheduling and cancellation history, communications concerning scheduling, and information needed to determine whether a service can be provided safely and appropriately, including information concerning access to and the safety of a client’s home where a home visit is requested.

​

4.3 Health Information

This may include information concerning:

• the reason for consultation and the history of the condition;

• symptoms, pain, functional limitations and their evolution;

• relevant medical and surgical history, including previous injuries and procedures;

• medications, allergies and relevant treatments;

• findings of physical and functional assessment, such as movement, strength, mobility, flexibility, balance and posture;

• the treatment plan, the interventions performed and the response to treatment;

• home exercises, instructions and recommendations;

• other healthcare professionals involved in the client’s care;

• referrals and follow-up; and

• documents, reports, imaging results or measurements provided by the client or by another professional for care purposes;

• the home exercise programs prescribed to the client, the exercises they contain and the instructions given;

• information recorded by the client concerning the completion of a home exercise program, including adherence, repetitions, difficulty, pain and other progress information; and

• any document, photograph or video uploaded by the client or by the physiotherapist in connection with a home exercise program.

​

4.4 Information Concerning a Child or Represented Person

Where services concern a child or a person who cannot consent personally, the Practice may collect the identity and health information of the person concerned, the identity and contact information of a parent, tutor, mandatary or other authorized representative, information reasonably required to verify authority to consent, communicate or receive information, and information concerning any restriction affecting parental authority, tutorship, custody, access, communication or decision-making.

​

4.5 Communications, Consent and Authority Information

This may include intake and consent forms, instructions and preferences provided to the Practice, consents, refusals, restrictions and withdrawals, proof of parental, tutorship, representational or other legal authority, emails and telephone notes, information submitted through the website or a booking platform, communications with another healthcare professional when authorized or permitted by law, complaints, comments and privacy requests, and evidence of any consent or authorization relied upon by the Practice.

​

4.6 Billing and Transaction Information

This may include the services rendered, the fees and any other disclosed amounts, invoices and receipts, payment status, reimbursement or insurance receipt requests, and information concerning a late cancellation or missed appointment.

Payment is accepted in cash or by e-transfer. The Practice does not keep a payment card on file, does not use a payment-card processor and does not hold a complete payment-card number, a card token or any other payment-card information.

​

4.7 Website and Technical Information

To the extent that the relevant technologies are actually used, the Practice may collect, through its website, the Internet Protocol address, browser and device information, the date and time of access, the pages visited, the referring website, cookie identifiers, analytics information, and information concerning errors, security events or attempted misuse of the website.

The Practice does not collect health information through its website. An appointment request submitted through the website is limited to the client’s name, contact information and the time requested. Information concerning a client’s condition is collected in the Practice’s record system or in person.

The final list of technical information collected will be based on the technologies actually implemented on the Practice’s own website.

​

5. How Information Is Collected

Information may be collected:

• directly from the person concerned;

• verbally during a telephone call or an appointment;

• through a paper or electronic intake, booking, consent or follow-up form;

• through the Practice’s website or its record system;

• from a parent, tutor, mandatary or other person legally authorized to act for the person concerned;

• from another healthcare professional or organization, with valid authorization or where otherwise permitted by law;

• from an insurer or other payer at the client’s request; and

• automatically through the website, but only to the extent that the relevant technology is actually used; and

• through the home exercise platform used by the Practice, where the client records information concerning the completion of a program.

​

6. Purposes for Which Information Is Collected and Used

The Practice may collect and use information only where reasonably necessary for one or more of the following purposes:

• responding to an inquiry or request for information;

• identifying the person concerned and verifying the authority of a representative;

• determining whether a requested service falls within the physiotherapist’s professional scope, competence, legal authorizations and availability;

• scheduling, confirming, modifying or cancelling an appointment;

• determining whether a service can be provided safely at the client’s home;

• preparing for, providing, documenting and following up on physiotherapy assessment and treatment;

• determining whether a referral, further investigation or urgent care is required;

• communicating instructions, education, recommendations and referrals;

• creating and maintaining professional client records;

• coordinating with another healthcare professional where authorized or permitted by law;

• issuing invoices and receipts and collecting payment;

• administering previously disclosed cancellation and missed-appointment arrangements;

• preparing documentation requested by a client for an insurer, the CNESST or the SAAQ;

• protecting the health and safety of clients and of the physiotherapist;

• responding to access, correction, consent-withdrawal and other privacy requests;

• receiving and resolving complaints;

• preventing, detecting, investigating and responding to confidentiality incidents, fraud, misuse or security threats;

• managing professional-liability, legal, regulatory or disciplinary matters;

• satisfying legal, tax, accounting, insurance, professional and record-keeping obligations; and

• operating, maintaining and securing the Practice’s website and technological systems; and

• preparing, delivering and following up on a home exercise program, and reviewing the information the client records about it.

The Practice does not sell, rent or exchange personal information, does not use it for advertising, audience matching or targeted advertising, and does not authorize an advertising provider to use it for those purposes.

​

7. Necessity, Consent and Client Choices

The Practice limits collection to information reasonably necessary for an identified purpose.

Whether particular information is required will be determined case by case, having regard to the service requested, the client’s condition, the related clinical risks and the physiotherapist’s professional obligations.

Where information is reasonably necessary to assess a condition, to determine whether a service can be provided safely and appropriately, or to provide or follow up on the requested service, the Practice will explain why it is required and the purposes for which it will be used. If the client declines to provide it, the physiotherapist may be unable to assess the condition or to provide or continue the service safely, and may recommend consultation with another healthcare professional or recourse to urgent or emergency services.

Information that is not reasonably required in the circumstances is optional and will be identified as such where reasonably practicable. A refusal to provide optional information, or to consent to an optional use, does not by itself affect access to physiotherapy services.

Where consent is required, it must be manifest, free and informed, given for specific purposes and requested for each of those purposes in clear and simple language. Where it is requested in writing, the request is presented separately from any other information.

Consent on behalf of a person under 14 years of age is given by the person having parental authority. A person 14 years of age or over may consent personally.

A separate consent or written authorization will be obtained where required by law or by professional obligations. The Practice retains the completed and signed form, together with any available electronic submission record, as evidence of the consent or authorization on which it relies.

Consent may be withdrawn prospectively, subject to applicable legal and professional restrictions. Withdrawal does not require the destruction of a professional record or of other information the Practice is legally or professionally required to retain.

The Practice may use or communicate information without consent only where authorized or required by applicable law.

​

8. Access Within the Practice

Access to personal information held by the Practice is limited to:

• the physiotherapist providing services to the client;

• any other person exercising functions within the Practice, to the extent required by their duties;

• the Practice’s accountant, whose access is limited to client names, amounts paid, invoices, receipts and other billing information reasonably necessary for accounting and tax purposes;

• an authorized technological or operational service provider, but only to the extent that access is reasonably necessary to perform an identified service for the Practice.

The Practice occupies premises within the clinic of a third party. The personnel of that clinic are not authorized to access the Practice’s client records.

No person is given access solely because they are a spouse, partner, family member, emergency contact or person responsible for payment.

Access rights are limited according to the person’s role, the purpose of the access and the sensitivity of the information. Every person authorized to access information is subject to confidentiality, security, training and written contractual requirements appropriate to their role and level of access. Access is limited to the minimum information necessary for the identified function and is withdrawn when it is no longer required.

​

9. Identity and Authority Verification

Before communicating sensitive information, the Practice may require reasonable verification of the identity of the person making the request, the identity of the person concerned, parental authority, tutorship, mandate or other legal authority, the authenticity of a consent or authorization, and any restriction affecting access, communication or decision-making.

Depending on the sensitivity of the information and the circumstances, identity may be verified during a telephone call by confirming information already contained in the client’s record, such as the client’s full name, date of birth, address, contact information or details of a recent appointment. Caller identification or recognition of the caller’s voice alone is not sufficient.

Additional verification is required where a request is unusual or particularly sensitive, involves the communication of records, concerns another person, changes contact or access information, or appears to have been submitted by a spouse, family member or other third party.

The Practice may suspend or refuse a communication until it is reasonably satisfied as to the requester’s identity and authority.

​

10. Circumstances in Which Information May Be Communicated

Subject to applicable consent requirements and legal restrictions, information may be communicated:

• to the person concerned or a person legally authorized to act for them;

• to another healthcare professional or organization involved in the person’s care, with valid authorization or where otherwise permitted by law;

• to a service provider acting on behalf of the Practice for an identified operational or technological function;

• to a private insurer, the CNESST or the SAAQ at the client’s request or with the client’s authorization;

• to an employer, only with the client’s specific authorization;

• to professional advisers, legal counsel or a professional-liability insurer where reasonably necessary and legally permitted;

• to the Ordre professionnel de la physiothérapie du Québec, the Commission d’accès à l’information or another competent authority where required or authorized by law;

• in response to a subpoena, warrant, court order or other legally enforceable demand;

• where there are reasonable grounds to believe that a serious risk of death or serious bodily injury threatens an identifiable person or group and the nature of the threat creates a sense of urgency; or

• in another circumstance expressly authorized or required by law.

Only the information reasonably necessary for the authorized purpose is communicated.

The specific authorizations given by a client for communications to a family doctor, a referring professional, a private insurer, the CNESST, the SAAQ or an employer are recorded in the consent and service form signed by the client, and may be withdrawn at any time.

​

11. Service Providers and Technological Services

The Practice uses selected service providers for functions such as website hosting and maintenance, online booking, electronic professional records and charting, appointment reminders, email and communications, cloud storage and backups, information security and document management.

The Practice remains responsible for information under its control when a service provider performs a function on its behalf. The provider acts on the Practice’s instructions and may not use the information for its own purposes.

Before entrusting information to a service provider, the Practice assesses, as applicable, the provider’s function and access, the information involved, security safeguards, retention and destruction practices, processing and support locations, subcontractors, confidentiality commitments, incident-notification obligations, the return or deletion of information at the end of the relationship, and the provider’s contractual and privacy terms.

The Practice enters into the written agreements required by law. 

The Practice’s public register of technological products and services is available at:

[INSERT LINK TO TECHNOLOGICAL PRODUCTS AND SERVICES REGISTER]

Jane

Jane is used for appointment management, client information, clinical records and related practice-management functions. The Practice’s account is hosted in Jane’s Canadian data centre, which comprises servers located in the Montréal region and in Alberta. Jane states that client data is encrypted in transit and at rest.

Under Jane’s terms, the Practice controls the information in a client’s record and Jane acts as a service provider. Jane accesses that information only on the Practice’s instructions, or to resolve a technical problem, to answer a support request, or where the law requires it. Jane states that information is protected by firewalls, encryption in transit and authentication procedures, that access is limited to personnel with a business need to know, that its data centres hold security certifications such as ISO 27001 and SOC 2, and that its personnel sign confidentiality agreements and receive periodic training. Jane publishes the list of the providers it relies on, and the Practice reviews it.

Jane’s artificial-intelligence documentation feature is not enabled for the Practice’s account. The Practice does not use Jane’s payment processing.

Wibbi

Wibbi is used to prepare, deliver and follow up on home exercise programs. It operates alongside Jane: the physiotherapist opens Wibbi from the client’s chart, builds the program there, and the completed program is returned to Jane and filed in the client’s record.

Wibbi states that it acts as a processor and that the licensee, here the Practice, is the party responsible for the client information it holds. For a licensee in Canada, Wibbi states that both client information and licensee information are stored on Amazon Web Services infrastructure in Montreal, and that its support personnel in Canada may access client information for support and troubleshooting purposes.

The information held by Wibbi concerning a client may include their name, email address and telephone number, the name and email address of the physiotherapist, the exercise program, the information the client records about its completion, and any document, photograph or video uploaded in connection with the program. Wibbi states that it relies on Amazon Web Services and Google Cloud, among other providers, and that client information is retained according to the Practice’s instructions and deleted when the Practice requests it.

Wibbi allows a licensee to limit the client information transmitted to it. The Practice transmits only the information necessary to deliver and follow up on a home exercise program.

Wix

Wix operates the Practice’s website, including its online forms and booking functions. For information submitted by visitors to the website, the Practice is the party responsible and Wix acts as a processor on its instructions, under the data processing addendum forming part of its terms.

Wix states that it maintains PCI DSS certification, that access to its services is provided over HTTPS, that information submitted through its forms is protected by transport encryption, and that its systems are reviewed regularly for vulnerabilities. Wix does not fix retention periods for visitor information; the Practice instructs it to delete information no longer needed.

​

12. Privacy Impact Assessments

Before acquiring, developing or materially redesigning a technological product, technological service, information system or electronic service-delivery system involving personal information held by the Practice, the Practice completes the privacy impact assessment required by law and consults the person responsible for the protection of personal information from the outset of the project.

The assessment is proportionate to the sensitivity of the information, the purposes for which it will be used, the quantity and distribution of the information, the persons who may access it, the technology and security safeguards involved, the retention and destruction arrangements, the processing locations and the risks to the persons concerned.

A separate or supplemental assessment is completed before information is entrusted or communicated outside Québec. The Practice documents the assessment and any risk-mitigation measures that must be implemented before the technology is placed in service.

​

13. Processing or Communication Outside Québec

The following flows involve processing or storage outside Québec:

• the storage of client records in Jane’s Canadian data centre, which comprises servers located in Alberta as well as in the Montréal region;

• the operation of the Practice’s website by Wix, which states that it may store and process personal information in the United States, in Europe and in Israel, and that information concerning visitors to a website built on its platform is processed in the European Union, in Israel or in another country recognized as providing an adequate level of protection;

• where they are used, appointment reminders and messages sent by text message, which are delivered through providers located in the United States, the content of the message being capable of temporary storage there;

• where it is used, telehealth, in which limited technical information such as an Internet Protocol address may be processed outside the selected region, the video and the chat content of a session not being stored;

• where they are used, sign-in with a Google account and synchronization of the schedule with a Google calendar; and

• where applicable, the storage of client information by the home exercise platform. [To be confirmed or removed once the hosting region is known.]

Before information is entrusted or communicated outside Québec, the Practice completes the assessment required by law and determines whether the information would receive adequate protection. The Practice considers the sensitivity of the information, the purpose of the processing or communication, the provider’s security measures, the provider’s processing and support locations, the laws applicable in the destination jurisdiction, the possibility of access by a foreign governmental or law-enforcement authority, the provider’s use of subcontractors, and the contractual measures available to mitigate identified risks.

​

14. Cookies, Analytics and Tracking Technologies

The Practice’s website uses cookies and similar technologies. Wix states that it and the providers it relies on place cookies for the stability, the security, the functionality and the performance of a site, for analysis and for advertising, and that it does not change its practices in response to a “Do Not Track” signal sent by a browser.

The Practice does not use advertising, audience-matching or behavioural-profiling technologies on its website. If any such technology is later proposed, it will not be activated until its operation has been assessed and the applicable notice, consent and configuration requirements have been implemented.

The website’s cookie interface identifies the technologies actually used, the provider of each technology, the purposes for which it is used, its duration and the choices available to the visitor.

The Practice does not authorize a third-party advertising or tracking provider to use identifiable health information.

​

15. Communications With Clients

The client chooses, in the intake form and at any time afterwards, which methods of communication the Practice may use and what those communications may contain. Where the client has not indicated otherwise, email and text messaging are used for administrative purposes only.

Ordinary email and text messaging may present risks, including transmission to an incorrect address or number, unauthorized access to a shared device or account, interception or insecure storage, incomplete deletion, and access by a telecommunications or platform provider.

Clients are asked not to send clinical questions or clinical information by ordinary email or text message. If a client does so, the Practice may redirect future communications to another channel, limit its response, verify the client’s identity before responding, document the communication and the client’s stated preference, or decline to communicate sensitive information through that channel.

The Practice cannot control the security of a client-owned device, account or communication channel before a message reaches a system under the Practice’s control. This does not reduce the Practice’s obligations once the information is under its control.

Clinically or administratively relevant communications may be copied, summarized or documented in the professional record.

Electronic communications are not continuously monitored and must not be used for emergencies or urgent concerns.

​

16. Automated Technologies and Artificial Intelligence

The Practice does not use personal information to render a decision about a client based exclusively on automated processing, and does not use an artificial-intelligence tool to produce or draft clinical notes.

If the Practice later implements an artificial-intelligence documentation tool, it will be used only to assist the physiotherapist in preparing a draft note or organizing information for documentation. It will not replace assessment, direct client communication, professional judgment, record review, referrals, instructions, or the physiotherapist’s responsibility to review, correct and approve the final professional record.

Before implementing such a tool, the Practice will assess whether it processes typed text, whether it captures or temporarily processes audio, whether it produces or retains a transcript, whether it retains source material, whether the provider’s personnel may access information, whether information is used for model training, where information is processed, the applicable deletion and return mechanisms, and whether a separate authorization is required.

The Practice will not authorize identifiable client information to be used for advertising, unrelated profiling or the independent training of a general-purpose model. 

​

17. Safeguards and Continuity

The Practice uses physical, administrative and technological safeguards that are reasonable in light of the sensitivity, purpose, quantity, distribution and format of the information.

Depending on the system and the circumstances, safeguards may include role-based access controls, strong passwords and multi-factor authentication, secure professional platforms, encryption where appropriate, device security and automatic locking, secure storage of paper records, backups and recovery measures, confidentiality obligations, service-provider oversight, privacy and security training, incident-response procedures, and periodic reviews of technological products and services.

The Practice takes reasonable measures to ensure that information remains available and usable following an incident affecting its medium or technological system.

No method of transmission or storage is entirely risk-free. This Policy does not constitute a guarantee that a confidentiality or security incident can never occur.

​

18. Information Governance and Periodic Reviews

As the owner and the person exercising the highest authority in the sole proprietorship, Richard Xiao is responsible for the protection of the personal information the Practice holds, approves its policies and practices, and is responsible for their application throughout the life cycle of the information, from collection to destruction.

The Practice’s information-governance framework addresses roles and responsibilities, authorized categories of access, confidentiality and security, evidence of consent, permitted communications, retention, destruction and anonymization, confidentiality incidents, privacy complaints, training, privacy impact assessments, service-provider oversight, technological-services monitoring and business continuity.

At least annually, the Practice reviews whether authorized categories of access remain appropriate, evaluates the effectiveness of its safeguards, reviews the available audit records of its record system, and updates its measures where necessary.

At least once every two years, and more frequently where a material change requires it, the Practice evaluates the technological products and services it uses, including the published privacy terms of its providers.

​

19. Training and Awareness

Every person who exercises functions within the Practice, including any employee, student or trainee, receives privacy training at the beginning of their functions, and their knowledge is updated at least annually regarding their roles and responsibilities, retention, destruction and anonymization, safeguards, confidentiality incidents, the secure use of technological products and services, and any material change to the Practice’s systems or procedures.

The Practice retains reasonable evidence of required training and annual updates. No person is given access to information before the applicable confidentiality instructions and required initial training have been completed.

​

20. Retention Periods

The Practice retains information only for as long as reasonably necessary for the identified purposes and for applicable legal, tax, accounting, insurance and professional obligations.

Unless a longer period is required because of a complaint, investigation, claim, audit, litigation hold or proceeding, the anticipated retention periods are:

• Professional client records: Minimum of 5 years, as required by the regulation applicable to members of the Ordre professionnel de la physiothérapie du Québec. 

• Billing, transaction and tax records: seven years after the end of the taxation year to which they relate, or longer where required by law or because of an audit, objection, appeal, claim or litigation hold;

• Inquiries that do not result in a professional record: three years after the Practice’s final response. If the exchange involves a clinical assessment or individualized professional advice, the information forms part of the professional record and is retained accordingly;

• Website security and technical logs: twelve months after their creation, unless a shorter retention cycle is applied by the service provider or a longer period is necessary to investigate a security event or confidentiality incident or to comply with a legal hold;

• Cookie and analytics information: according to the duration disclosed in the cookie interface;

• Privacy requests and complaints: three years after final resolution, unless a longer period is necessary because of an investigation, proceeding, claim or litigation hold;

• Confidentiality-incident records: for the period required by law and by the incident-response procedure;

• Consent and authorization records: for as long as required to establish the consent or authority relied upon; and

• Proof of destruction: for the period established in the Practice’s retention schedule.

A backup copy may remain for a limited period in accordance with the applicable secure backup-rotation schedule.

​

21. Destruction and Anonymization

At the end of the applicable retention period, information is securely and irreversibly destroyed or, where legally permitted, anonymized in accordance with the criteria and procedures established by law and with generally recognized best practices.

Electronic client records maintained in the Practice’s record system are deleted after the applicable retention period. The Practice records the date on which deletion is initiated and retains any available deletion confirmation or audit-log entry, and periodically verifies, through the provider’s written terms or written confirmation, that deleted records and all related copies and backups are irreversibly purged within the provider’s documented deletion cycle.

Paper records containing personal information are destroyed using a cross-cut shredder or an equivalent secure method before disposal. The Practice maintains a destruction log identifying the date of destruction, the general category or date range of the records destroyed, the method used and the person who performed or supervised the destruction, without reproducing the contents of the destroyed records.

If destruction is entrusted to a third party, the Practice enters into the required written agreement governing the destruction process, accountability, confidentiality and any subcontracting.

An original document belonging to a client is not destroyed without the client’s authorization or without giving the client a reasonable opportunity to retrieve it.

Anonymized information is used only for a serious and legitimate purpose and only where the risk of re-identification is very low in the circumstances.

​

22. Individual Rights

Subject to applicable conditions and exceptions, a person may:

• request confirmation of whether the Practice holds information concerning them;

• request access to that information and a copy of it;

• request correction of inaccurate, incomplete or equivocal information;

• request that a written comment or clarification be added to a professional record;

• request the computerized information they provided in a structured and commonly used technological format;

• request that the Practice cease disseminating personal information concerning them or de-index a link attached to their name, in the circumstances provided by law;

• withdraw an optional consent prospectively;

• modify their communication preferences; and

• submit a privacy complaint.

These rights do not permit the alteration or destruction of a professional record that the Practice must retain, and do not require the removal of an accurate professional opinion or clinical observation. A written comment or clarification may instead be added to the record where appropriate.

​

23. Access, Correction and Privacy Requests

A request should be submitted in writing and provide sufficient information to identify the person concerned, the information requested and the nature of the request.

The Practice may require reasonable proof of identity and, where the request is made for another person, proof of legal authority.

The Practice responds in writing, with diligence and no later than 30 days after receiving the request. A failure to respond within that period is treated as a refusal.

Access is generally provided without charge. Reasonable transcription, reproduction or transmission costs may be charged where permitted by law and after advance notice.

A refusal is given in writing, states the applicable reasons and legal basis, and identifies the available recourses. A person who disagrees with the Practice’s response, or who receives no response within 30 days, may apply to the Commission d’accès à l’information for a review.

​

24. Complaints

A person who has a complaint about the way the Practice handles personal information may submit it to the person responsible for the protection of personal information, using the contact information in the following section.

The Practice acknowledges receipt of the complaint, examines it, and informs the person in writing of the result and of the reasons for its decision. A person who is not satisfied with the result may contact the Commission d’accès à l’information.

The Practice records privacy complaints and the measures taken in response, and reviews them periodically to identify any change required to its policies and practices.

​

25. Person Responsible for the Protection of Personal Information

Richard Xiao

Physio Soleil

Email: [physiosoleil@gmail.com]

Mailing address: 3744, rue Ontario Est, Montréal (Québec) H1W 1S2

Telephone: 438-493-2998

Requests for access, correction, consent withdrawal, communication-preference changes and privacy complaints may be submitted using this contact information.

A person who is dissatisfied with the handling of a privacy request or complaint may exercise any available recourse before the Commission d’accès à l’information du Québec or another competent authority.

​

26. Confidentiality Incidents

A confidentiality incident is unauthorized access to personal information, unauthorized use, unauthorized communication, the loss of personal information or any other breach of its protection.

The Practice maintains a procedure for identifying, containing, assessing, documenting and responding to confidentiality incidents. Where an incident occurs or is reasonably suspected, the Practice takes reasonable measures to reduce the risk of harm, prevents similar incidents, assesses the nature and seriousness of the potential harm, records the incident in the register, notifies the persons and authorities required by law, and cooperates with its legal, professional, insurance and technological advisers.

The Practice keeps a register of confidentiality incidents, in which every incident is recorded whatever its seriousness, and provides a copy to the Commission d’accès à l’information on request.

​

27. Changes to This Policy

The Practice may update this Policy to reflect changes in its services, its technological systems, its service providers, its legal or professional obligations, or its privacy and information-governance practices.

The current version and its effective date are posted on the website. Material changes are brought to the attention of affected persons by an appropriate means, and notice of an amendment is published in the same manner as the Policy itself.

​

28. Language

A complete French version of this Policy is available at: [INSERT LINK TO FRENCH VERSION]

The French version is published before or at the same time as the English version and is at least as accessible and prominent. The English version is made available to persons who choose to consult it.

Consumers of goods and services have the right to be informed and served in French. A client’s choice to be bound by the English version of a document does not affect that right.

The language requirements applicable to service agreements, consent forms and other documents are addressed separately and are not replaced by this Policy.

​

29. Relationship with the Practice’s Other Documents

This Policy is a privacy and information-governance notice. It does not constitute or replace the consent and service forms, the intake form, the Terms and Conditions, the applicable fees or the description of the services offered.

References in this Policy to billing, appointment management or cancellation information identify purposes for which information may be used. They do not independently establish the applicable fees or contractual terms.

Nothing in this Policy limits a mandatory privacy or professional right, excludes a responsibility that cannot lawfully be excluded, limits professional secrecy, or relieves the Practice of complying with applicable law.