Privacy Policy and statement of information practices

Part One

This website, and your enquiry

What we collect, and why

Each item below is collected for the purpose stated beside it, and not for other purposes.

Request records. Our host records standard information about every request made to this site: your IP address, the time, the page requested, the page you arrived from, and your browser and device type. This is how the site is served and kept working. Separately, if a page fails to load, your browser may send Cloudflare a short report about the failure — the error type and rough location, not the page content — which Cloudflare says it holds only in temporary memory. Successful visits are not reported this way.

Analytics. Google Analytics 4 records which pages are viewed, in what order, for how long, roughly where in the world the visitor is, and what kind of device they use. It attaches a long-lived identifier to your browser so that repeat visits are recognised as the same visitor. We use it to see which pages people actually read.

Advertising measurement. A Google Ads tag loads on every page, whether or not you arrived from one of our advertisements, and tells Google which page you are on. Where a visit did follow one of our advertisements, it also lets us see that. The same tag is capable of building advertising audiences — lists of people who visited particular pages, which can be used to show them further advertising. Three actions are reported to Google as conversion events, described by what you did rather than by who you are: clicking a link through to our booking site, sending the contact form, and tapping the phone number. We send Google the fact that one of those actions happened, and the page it happened on. We do not send your name, your email address, or anything you wrote. Google can still connect that event to the advertisement click it served you, and for someone signed in to a Google account that means Google can connect it to that account. We cannot prevent that while we advertise on Google.

Contact form. Your name, your email address, a phone number if you choose to give one, your message, and a hidden field recording which page you sent the form from. The hidden field tells us which page prompted people to get in touch. We use all of it to reply to you.

The free workbooks. No name, no email address, no sign-up. The fourteen PDFs are ordinary files you can download without telling us anything, and we do not build a list of who took which one. The download is still a request to this site like any other, so it appears in the request records described above, and Google Analytics records that a file was downloaded and which file it was, against the same browser identifier. Neither is linked to a name.

The Same Team tool. Nothing reaches us. What you type into the conflict tool at /same-team is saved in your own browser so that you can come back to it, and it stays on your device. There is no account and no sign-in, and we never receive it.

Cookies

Google’s tags set cookies on this site named _ga, _ga_ followed by a property code, and _gcl_ followed by a suffix. Despite belonging to Google, these are set as first-party cookies on teocounselling.com. The first two identify a browser across visits for analytics. The third records that a visit followed an advertisement, for conversion measurement. This website’s own code sets no cookies, but it does store two things on your device. If you arrive from one of our advertisements, the advertising click identifier Google puts on the web address is kept for the length of your visit only, so that it can be added to the booking link if you go on to book — that is how we tell whether an advertisement led to an appointment. It is held in what browsers call session storage, which your browser discards when you close the tab, and it is not a cookie and not kept afterwards. Separately, the Same Team conflict tool at /same-team keeps your language and settings, and the entries you write in it, in your browser’s local storage. That information never leaves your device and is never sent to us or to anyone else, but it stays in the browser until you delete it from within the tool or clear your browsing data. If you share a device, it is worth deleting your entries when you finish, or using a private window.

You can remove or block them through your browser’s cookie settings, through Google’s own Ads Settings at adssettings.google.com, and by installing the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout.

Your choice about analytics and advertising

We are telling you plainly how this works at the moment, rather than describing something better than what we do. As this version is published, the analytics and advertising tags load on every page as soon as the page opens. You are not asked first. If you do not want them: blocking cookies in your browser stops both tags. Google’s Ads Settings page changes what Google shows you, but it does not stop this site’s tags collecting; only the Google Analytics opt-out add-on does that, and it is a desktop browser extension that cannot be installed on a phone. The honest answer today is that on a phone the reliable route out is your browser’s own cookie and script blocking, or a private window.

We think that is the wrong default for a site about mental health and we are working to change it, so that nothing loads until you choose. Until that is actually in place, the position is exactly as described above and we are not going to describe it as anything better. If it changes, this section will be rewritten and the version number at the top of this page will go up.

Whatever you decide, it changes nothing else. Declining analytics does not restrict your access to this site, to the free workbooks, or to the contact form, and it has no effect on being accepted as a client or on the care you receive.

The contact form

The contact form is ordinary email, not a secure clinical channel. Please keep the detail light at that stage. A sentence about what you are looking for is enough, and the detail belongs in the session, where it is protected properly.

If you do write something about your health anyway, we treat it as confidential health information from the moment it reaches us. It is handled to the clinical standard, and it is not kept in any marketing or advertising system.

Your message reaches us as email, and a copy is also held in our Formspree account in the United States. Neither copy expires on its own, so deleting is something we do rather than something that happens: on a fixed schedule every three months we delete enquiries older than twelve months, from both places. We keep them that long so that we can recognise you if you come back after thinking it over. You can ask us to delete yours sooner at any time and we will.

The tick box on the form is consent to be replied to, and nothing else. There is no newsletter, no mailing list, and no marketing email. You can ask us to stop contacting you at any time and we will.

Booking

Booking does not happen on this website. Every booking link takes you to teo-counselling.janeapp.com, a separate site operated by Jane Software Inc., our practice-management provider, under its own privacy notice. Nothing from Jane is embedded in these pages, so no information reaches Jane until you click through. When you do click, the Google Ads tag records that a booking link was followed. We do not tell Google who you are, which clinician you chose, or what the appointment is for — Jane holds that, not Google. Google may still be able to connect the click to an account of its own, as described above.

Who else is involved, where they are, and what they may do

Information that leaves Canada

Information handled by Google, Formspree and Cloudflare is transferred to, stored in, and processed in the United States. While it is there, it may be accessible to United States courts, law enforcement agencies and national security authorities under the laws of that country, and those laws are not the same as Canada’s.

We remain responsible for personal information that we transfer to these companies for processing, and we use contractual or other means to provide a comparable level of protection while it is in their hands.

You can ask us in writing for information about our practices regarding service providers outside Canada, and the Privacy Officer named below can answer questions about the collection, use, disclosure and storage of personal information by them.

How long we keep things

Contact-form enquiries from people who do not become clients are kept for twelve months and then deleted. Clinical records are kept far longer, for the periods set by the regulator of the clinician you see, and Part Two and Part Three deal with those. Analytics and advertising information is kept by Google for a period we set in our own account: event-level data for two months, and the user-level data tied to a device or advertising identifier for fourteen months, after which Google deletes it. Request records are held by our host under its own retention practices.

How information is protected

This site is served over an encrypted connection, and the contact form is transmitted over one. Access to enquiries is limited to the people in the practice who need it in order to reply. Clinical records are held in Jane, which is designed for health records and is access-controlled. We scale our safeguards to how sensitive the information is. We do not claim that any system is perfectly secure, because no honest organisation can.

Sessions run over video on Jane — the same Canadian system that holds your booking and your clinical record, so the session does not travel through a further company. Zoom and Google Meet are kept as a backup for the occasions when Jane’s video will not connect. Those connections are encrypted by the platform that carries them, and we do not record sessions.

Before we sign up for a platform we read what it publishes about security, where it stores information, and what it commits to, and we keep a dated record of what we reviewed. What we cannot do is inspect those systems from the inside. Nobody — us included — can promise you that someone else’s platform will never fail.

What we can tell you is this. We remain accountable for the information we place with them to handle on our behalf, and we use contractual or other means to keep the protection comparable while it is in their hands. That accountability is not something we can sign away, and we are not trying to. If we learn that one of these platforms has had a breach involving information about you, we will tell you at the first reasonable opportunity rather than wait for a harm test to require it, and where the platform cannot tell us exactly who was affected we will tell everyone who could have been. When we tell you, we will say what happened, what information was involved, what we are doing about it, and who you can complain to.

If you would rather not use one of these platforms, tell us and we will move you to another of them. If none of them works for you we will say so plainly rather than pretend to an option we do not have: there is no in-person office, and every session is by video.

Your rights

Access. You can ask what personal information we hold about you, how we have used it, and to whom we have disclosed it. Write to the Privacy Officer below. We respond within thirty days under the federal Act and under British Columbia’s Act, and within forty-five days under Alberta’s Act.

Correction. If something we hold about you is wrong, tell us and we will correct it. Where we do not make a correction you have asked for, we note your request on the record itself, and where it matters we tell anyone we have already given the information to.

Withdrawing consent. You can withdraw your consent at any time, on reasonable notice, subject to legal and professional record-keeping obligations. We will tell you what the consequences are before it takes effect — for example, we cannot continue to provide therapy without keeping a clinical record of it.

If something goes wrong

If personal information in our control is lost, or accessed or disclosed without authorisation, and it is reasonable to believe that this creates a real risk of significant harm to you, we report it to the Privacy Commissioner of Canada and notify you. We also notify any other organisation that could reduce the risk. We keep a record of every such incident for twenty-four months. Where Alberta’s Act applies, we notify the Information and Privacy Commissioner of Alberta without unreasonable delay, and that Commissioner decides whether individuals must be notified.

This paragraph sets the minimum we must report and notify under those Acts, and it is not the only rule on this page. Under “How information is protected” above we commit to telling you about a platform breach whether or not it meets a harm threshold, and where the information is the clinical record of an Ontario client the rule in Part Two applies and has no harm threshold either. Where more than one applies, the one that gives you more notice governs.

Questions, requests and complaints

Mohamad Shabib is the Privacy Officer for TEO Counselling Services Inc. and is the person accountable for the practices described here.

Please bring a complaint to us first, and we will investigate it and tell you what we found. If you are not satisfied, you can complain to the privacy regulator that covers you: the Office of the Privacy Commissioner of Canada (1-800-282-1376, priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), or the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

A complaint about a clinician’s professional conduct is a different thing and goes somewhere else — to that clinician’s regulator, not to a privacy commissioner. Those are named in Part Two and Part Three.

Part Three

Clinical records — British Columbia, Alberta, Saskatchewan, Manitoba, and Newfoundland and Labrador

We handle clinical records to the same standard everywhere. What differs is the statute behind it and where a complaint goes.

For clients in British Columbia, records are governed by British Columbia’s Personal Information Protection Act, and complaints may go to the Office of the Information and Privacy Commissioner for British Columbia.

For clients in Alberta, records are governed by Alberta’s Personal Information Protection Act, and complaints may go to the Office of the Information and Privacy Commissioner of Alberta.

For clients in Saskatchewan, Manitoba, and Newfoundland and Labrador, records are governed by the federal Personal Information Protection and Electronic Documents Act, and complaints may go to the Office of the Privacy Commissioner of Canada.

A complaint about professional conduct goes to the clinician’s own regulator: the British Columbia Association of Clinical Counsellors for Alison Shaji, the College of Registered Psychotherapists of Ontario for Mohamad, or the Ontario College of Social Workers and Social Service Workers for Rola.

Access, correction, and who to contact

Wherever you live, you can ask to see your record, ask for corrections to it, ask what we hold about you and to whom we have disclosed it, and withdraw your consent on reasonable notice. Ask your clinician, or write to the Privacy Officer:

We respond within thirty days under the federal Act and within forty-five days under Alberta’s Act. Access is subject to the narrow exceptions those Acts set out. If we do not make a correction you have asked for, we tell you why, note your request on the record, and tell you how to have that decision reviewed. Confidentiality and its limits work as described in Part Two, and the specifics for your province are set out in the intake and consent documents you receive before therapy begins.

Clinical records are kept for the period the clinician’s regulator requires — for clients of a Registered Clinical Counsellor in British Columbia, at least seven years after the last contact, or seven years after the client turns nineteen — and are then deleted or shredded. If clinical information about you is lost, or accessed or disclosed without authorisation, we handle it as set out in Part One under “If something goes wrong”, and we tell you.

Changes to this statement

When we change how we handle information, we change this document and raise the version number at the top. We keep earlier versions, and you can ask us for them.

Version 1.0 · Effective 17 August 2026