Privacy policy

Who we are

This website and client portal belong to the private online psychotherapy practice of Khaled Albanna, Registered Psychotherapist (Qualifying), in Ontario. The practice handles personal health information under Ontario’s Personal Health Information Protection Act (PHIPA).

What we collect

Account details: your name, your email address, your sex and date of birth, and a protected (hashed) form of your password. The practice never sees your password itself. Your sex and date of birth are stored encrypted; your date of birth fills in your first intake form, and the therapist sees both in your record.

Booking details: the service, date and time you choose, your time zone, and your reminder and contact preferences. Your mobile number, only if you choose text message reminders.

Care records: intake and consent forms, session records, messages, and files the practice shares with you or keeps in your record.

Payment records: invoices, receipts and payment status. Card details are entered with Stripe and are never stored by the practice.

Technical information: one essential cookie keeps you signed in. Your IP address and browser type are kept with your active sign-in session and deleted after it ends. Records of sign-in attempts, which hold your IP address, are deleted within a day.

Your browser also remembers your language, time zone and display theme choices in its own storage on your device.

Optional visit counts: only if you tick the box to share them, anonymous counts of public page visits (page, language, device type and how the visit arrived, such as a direct visit) are kept. No names, messages or form answers are collected, and no advertising or tracking cookies are used.

Why we use it

To provide psychotherapy, schedule appointments and send reminders, send invoices and receipts, keep the records the law and the College of Registered Psychotherapists of Ontario (CRPO) require, and keep the website secure. Your information is never sold or used for advertising.

Service providers

The practice uses a small number of service providers. They process information only to provide their service:

Cloudflare: website hosting, database and file storage, the Turnstile security check on the sign-in, contact, waitlist and inquiry forms, and its own request logs, which include IP addresses.

Stripe: card payments.

Resend: email, such as confirmations, reminders and receipts.

Twilio: text message reminders, only if you choose them.

Google Workspace and Google Meet: video sessions and practice scheduling.

Some of these providers may store or process information outside Canada.

No artificial intelligence

No artificial intelligence (AI) tools are used to read, analyse or make decisions about client information.

How we protect it

Information is encrypted when it travels to and from the website and when it is stored. Some clinical records receive an extra layer of encryption. Only the therapist can open client records, and therapist sign-in requires two-step verification. Uploaded files are kept in private storage.

How long we keep it

Clinical and billing records are kept for the period the CRPO requires: at least 10 years after the last contact or, for clients who were under 18, until 10 years after their 18th birthday if that is later.

You can ask the practice to close your account or delete files kept in your record. Your sign-in is removed, and files are deleted where the law allows. Records that must be kept for the required period are kept securely until then.

Encrypted backups may still hold deleted information until those backups expire.

Your rights

You can ask to see or receive a copy of your records, and to correct information that is wrong. Email the practice to make a request.

If you have a concern about how your information is handled, please contact the practice first. You can also complain to the Information and Privacy Commissioner of Ontario (ipc.on.ca).

Built Different workshops

The Built Different waitlist forms collect a contact email address and phone number, the participant’s first name and age or birth year, a preferred city or area, availability (with an optional note) and interest in the complete program or individual sessions. When a parent or guardian registers, which is required for participants under 18, their name is collected too.

The organization inquiry form collects a contact name, email address and phone number, and organization details: the organization’s name and type, the edition and format of interest, estimated group size, age range, city, preferred dates and an optional message.

Each submission also keeps the language you used on the site and a protected (hashed) form of your IP address, which is used to limit repeated submissions.

This information is used only to contact you about Built Different cohorts and inquiries, including a confirmation email. It is not used for marketing beyond that.

Only Khaled Albanna can see it, through the practice’s secure admin dashboard. Confirmation emails are sent through Resend, the email provider listed above.

It is stored encrypted in the practice database, separate from psychotherapy records.

Joining the Muslim Edition waitlist shows interest in a faith-based program, so it is treated as sensitive. The website’s reply never shows whether someone is already on a waitlist.

You can ask for your waitlist entry or inquiry to be deleted at any time through the contact form. The practice deletes it on request.

Encrypted backups may still hold deleted information until those backups expire.

Workshop participation is not psychotherapy, and no clinical record is created.

In an emergency

This website and portal are not monitored for emergencies. If you are in immediate danger, call 911. For suicide crisis support, call or text 988 at any time.