Privacy, confidentiality and your records

Confidentiality in counselling, and its limits

What you bring to a session is confidential. It is not shared with your family, your employer, your doctor or your insurer without your written consent. Paying for a session with a benefits plan does not entitle the insurer to your clinical content. A receipt confirms that a session happened, not what was in it.

There are legal exceptions, and they are the same for every counsellor in British Columbia. They are set out in writing before the first session so that nothing about them is a surprise later:

• Risk of serious harm, If there is a real and imminent risk of serious harm to you or to an identifiable other person, a counsellor is obligated to act, which may mean contacting emergency services or a named person.
• A child or vulnerable adult at risk, Suspected abuse or neglect of someone under nineteen must be reported to child protection under BC law. This duty applies to everyone in the province, not only to counsellors.
• A court order or subpoena, A court can compel the release of records. A counsellor can and will object where objection is appropriate, but cannot refuse a valid order.
• Clinical supervision and consultation, Counsellors consult on their work as a condition of good practice. Where that happens, identifying details are removed, and the consultant is bound by the same confidentiality.

What is collected, and why

• Contact and identifying information, Name, email, phone, and the region of BC you are in. The last because a counsellor must know which jurisdiction a client is physically in during a session.
• Intake information, Relevant history, current concerns, medications, and safety information. Collected because working without it is working blind.
• Session records, Brief clinical notes recording what was worked on and what was planned. Notes are working documents, not transcripts.
• Payment records, Amounts, dates and receipts, kept because tax and professional standards require it. Full card numbers are never stored by the practice.
• Nothing collected "just in case", If information is not needed to provide the service or to meet a legal obligation, it is not asked for.

Where records live and how long they are kept

Records are stored in encrypted, access-controlled systems, and video sessions are conducted over a platform that supports the privacy obligations of a BC health professional. Sessions are never recorded, not for notes, not for supervision, not for training.

Records are retained for the period required by professional standards and applicable law, then securely destroyed. You are entitled to ask how long your specific file will be kept, and to receive that answer in writing.

Anything sent through a form on this website. A message, or a request for a guide, is held separately from clinical records and is deleted automatically after 24 months. That is a fixed period rather than a judgement call: the purpose it was collected for is answering you, and that purpose expires. Two years leaves room for someone who enquired, waited and came back, which is a real pattern, without the practice quietly accumulating an archive of what people wrote before they had met anyone.

You have the right to request access to your own records and to request correction of factual errors in them. Requests go to the address on the contact page. Where a portion of a file cannot be released, for example, because it contains information about another person. You are told that, and told why.

Scroll the diagram sideways to see all of it.

What this website itself collects

This is a static website. It is worth being specific about what that means, because "we value your privacy" is not information:

• No advertising or tracking pixels, There is no Meta pixel, no Google Ads remarketing tag, and no third-party advertising script anywhere on this site.
• No cookies unless you sign in, Browsing this site sets no cookies, so there is no consent banner to dismiss. A banner that exists only to be clicked away is theatre. Signing in to the client portal does set one session cookie, because that is what keeps you signed in; it is removed when you sign out.
• No fonts or scripts loaded from other companies, Typography uses fonts already on your device. Nothing on a page you load here reports your visit to a third party by loading an asset from them.
• Forms go to the practice, not to a form processor, The message and checklist forms are handled by this site and by the practice’s own email provider. There is no third-party form service holding a copy. What you write is stored so that it cannot be lost if an email fails to send, is visible only to the practice, and is not used for anything else.
• Search terms are counted, not logged, When the site’s search box is used, the term is added to a tally. The word, and how many times it has been submitted. No timestamp, no IP address, no session, and nothing that connects two searches to the same person. There is no record that any particular search happened, only that a term has been used some number of times, and anything long enough to be a sentence rather than a search term is discarded instead of counted.
• Standard server logs, The hosting provider records ordinary request data: IP address, time, page, user agent: as every web server does. It is used for security and reliability, not for profiling, and it is not combined with any clinical record.

Scroll the diagram sideways to see all of it.

Scheduling and third parties

Booking a consultation is handled through a scheduling service, and the information you enter there. Your name, email and chosen time, is held by that provider under its own privacy terms as well as this practice's obligations. Only what is needed to schedule the appointment is requested at that stage. Clinical information is never collected through a booking form.

Where any third-party service is used, it is chosen on the basis that it can meet the privacy obligations that apply to a BC health professional, and it is named rather than hidden behind "our partners".

Your rights, and where to complain

In British Columbia, private organisations handling personal information are governed by the Personal Information Protection Act (PIPA). Under it you have the right to know what personal information is held about you, to access it, to request correction, and to withdraw consent to further collection or use, recognising that withdrawing consent may make it impossible to continue providing the service.

You can also ask for anything you sent through this website to be erased before the 24 months are up, and it will be, every message from your address, not only the one you happen to remember. Write to the address on the contact page and say so; you will be told when it is done. This is deliberately a request to a person rather than a button on this site: a self-service delete would have to confirm whether an address is in the system before removing it, and on a counselling website confirming that somebody wrote in is itself a disclosure. One available to anyone who could guess an address.

Clinical records are the exception, and not a discretionary one. Once counselling has begun, a counsellor is required by professional standards to keep the file for a set period; it cannot be erased on request, and anyone who tells you otherwise is describing a different kind of service. Erasure here means website enquiries.

If you believe your information has been mishandled, you can raise it with the practice directly, and you can complain independently to the Office of the Information and Privacy Commissioner for British Columbia. You do not need this practice's agreement to do so.

Practical privacy on your own side

Most of what is written about privacy in counselling concerns the practitioner's obligations. Rather less is said about the parts you control, which matter just as much in a virtual practice.

Where you take the session. A door that closes is the single largest factor. Headphones are the second, because they remove the counsellor's voice from the room entirely.

Your device. A shared or work-issued computer is worth thinking about. Employers can generally monitor activity on equipment they own, and a session taken on a work laptop is not private in the way a personal device is.

Your email. Email is convenient and it is not a secure channel. There is no need to put clinical or personal detail in writing to arrange something, and it is better not to.

Insurance claims. Submitting a claim tells your insurer that a session occurred, with which type of practitioner, and on what date. It does not tell them what was discussed. If you are on a family plan, the plan holder may be able to see that a claim was made, which is worth knowing in advance if it matters.

Browser history and notifications. Small things, and they are the ones people mention afterwards. Notifications during a session, or a shared browser, are worth two minutes of thought beforehand.

None of this is a reason for concern about the practice's handling of your information, which is set out above. It is the half of the picture that is within your control and that nobody usually mentions.