Privacy

Privacy Policy

Last updated:

This policy explains how NoorMinds Psychotherapy handles personal information. Sections 1 to 9 cover the personal health information of people who contact or see our clinicians, which is governed by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). Sections 10 to 16 cover this website and the NoorMinds companion app: what they collect, what they keep on your device, and the choices you have. For information collected through the website that is not part of a health record, we follow the principles of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

In brief

  1. Your clinical record is kept in Jane, our electronic records and booking system, and is confidential within the limits the law sets. Sessions take place by video through Jane and are never recorded.
  2. We share your health information outside NoorMinds only with your consent, or where the law requires or allows it.
  3. We keep clinical records for at least 10 years, as our regulator requires. You can see your record and ask us to correct it.
  4. This website uses Google Analytics and Google Ads to measure visits and which ads lead to bookings. Ad personalization and remarketing are turned off. If your browser sends Global Privacy Control, our code sends Google no page views or events.
  5. The companion app keeps what you write on your own device. Nothing you write is uploaded.
  6. Email, WhatsApp and other messages are not secure, and they are not monitored for emergencies.

1. Who we are

NoorMinds Psychotherapy is a virtual psychotherapy practice in Ontario: all sessions take place online. It is operated by Ghazal Sheikhtaheri, Registered Psychotherapist (Qualifying), CRPO #21300, Founder and Clinical Director. Tina Abadi, Registered Psychotherapist, CRPO #13777, and Roya Dadollahi Sarab, Registered Psychotherapist, CRPO #008767, also see clients at NoorMinds.

For PHIPA purposes, Ghazal Sheikhtaheri, who operates the practice, is the health information custodian responsible for the records of every NoorMinds client, whichever clinician they see. Tina Abadi and Roya Dadollahi Sarab work on the practice’s behalf as its agents under PHIPA and follow this policy.

Our privacy contact is Ghazal Sheikhtaheri. You can reach her at hello@noorminds.ca or (647) 699-5142.

2. The health information we collect

We collect the personal health information we need to provide and manage your care. Depending on the services you use, this can include:

  1. your name, contact details and the other information you give us when you book or complete intake forms;
  2. what you tell us about your reasons for seeking therapy, your health and your history, in consultations, sessions, forms and messages;
  3. your clinician’s notes, assessments, treatment plans and correspondence about your care;
  4. your consent forms, and the names of anyone you authorize us to speak with;
  5. appointment, fee, payment and receipt records.

We collect this information mainly from you. We collect it from someone else, such as a referring professional or a person legally authorized to act for you, only with your consent or where the law allows it.

3. How we use it

  1. To provide psychotherapy, including the free 15-minute consultation.
  2. To schedule appointments and communicate with you about your care.
  3. To issue receipts and keep financial records.
  4. For clinical supervision. As CRPO requires of a Registered Psychotherapist (Qualifying), Ghazal Sheikhtaheri practises under clinical supervision, so her clinical supervisor may review information about the care she provides. The supervisor is bound by the same duty of confidentiality.
  5. To meet our legal and professional obligations, including CRPO’s record-keeping standards, and to respond to complaints or legal proceedings.
  6. To manage the practice.

We do not sell personal health information. We do not use the contents of your record, such as session notes or the reasons you came to therapy, for marketing or advertising.

4. When we share it

What you discuss in therapy is confidential. Nothing is shared with your family, your community, or anyone else in your life without your consent. We disclose personal health information outside NoorMinds only:

  1. with your consent, for example to your family doctor or another provider, or to your insurer if you ask us to (we do not bill insurers directly; you submit your own receipts);
  2. to service providers that handle it on our behalf, such as Jane, which holds our records and bookings and is also the video platform we use for sessions (sessions are never recorded);
  3. to the College of Registered Psychotherapists of Ontario, when it requires records for its regulatory work, such as investigating a complaint;
  4. where the law requires or allows disclosure without consent. Confidentiality does have limits required by law, the same for every therapist: for example, risk of serious harm to yourself or others, suspected child abuse or neglect, sexual abuse by a regulated health professional, or a court order. These are explained clearly at the start of therapy.

When we do share information, we share only what is needed for the purpose.

5. How we protect it

  1. Clinical records and bookings are kept electronically in Jane (Jane App), an online practice-management and records system, behind individual password-protected accounts.
  2. Only the people who need your information for your care or to run the practice can see it, and everyone who acts for the practice is bound by confidentiality.
  3. Sessions take place over a secure, encrypted video platform.
  4. This website is served only over encrypted (HTTPS) connections.

If personal health information in our care is stolen, lost, or used or disclosed without authority, we will tell you at the first reasonable opportunity, as PHIPA requires, and report it to the Information and Privacy Commissioner of Ontario where the law requires.

6. How long we keep it

CRPO’s record-keeping standards require us to keep clinical records, appointment records and financial records for at least 10 years from our last interaction with you, or for 10 years from your 18th birthday, whichever is later. After that, we destroy them securely.

Because of this requirement, we cannot delete your record at your request while it must be kept. You can still ask us to correct it (see section 7).

7. Seeing and correcting your record

You have the right to see your record of personal health information and to get a copy, subject to the limited exceptions set out in PHIPA. To ask, write to our privacy contact (email is fine). We may need to confirm your identity first. A person legally authorized to act for you, such as a substitute decision-maker, can make the request on your behalf.

We will respond within 30 days. If we need more time, PHIPA allows us to extend this once, by up to 30 more days, and we will tell you why. We may charge a fee for copies, limited to what PHIPA permits, and if we do, we will give you an estimate first.

If you believe your record is inaccurate or incomplete, you can ask us in writing to correct it, and we will respond within the same time limits. We do not have to change a professional opinion made in good faith, but if we do not make a correction you asked for, you can have a statement of disagreement attached to your record.

If we refuse any part of a request to see or correct your record, we will tell you in writing and explain that you can complain to the Information and Privacy Commissioner of Ontario.

You can also withdraw or limit your consent to how we share your information at any time by telling us. Withdrawing consent does not undo a disclosure already made, and it does not stop a disclosure the law requires.

8. Questions and complaints

If you have a question or concern about how we handle your information, please contact our privacy contact, Ghazal Sheikhtaheri, at hello@noorminds.ca or (647) 699-5142. We will look into it and reply to you.

You also have the right to complain to the Information and Privacy Commissioner of Ontario (IPC), which oversees PHIPA. A complaint should be made within one year of when you became aware of the problem (the IPC can allow longer) or, for a refused request to see or correct your record, within six months of the refusal.

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8
Phone: 416-326-3333 or 1-800-387-0073
TTY: 416-325-7539
Email: info@ipc.on.ca
Website: www.ipc.on.ca

For a concern about information collected through this website that is not part of a health record, you can also contact the Office of the Privacy Commissioner of Canada, which oversees PIPEDA (www.priv.gc.ca). A concern about a clinician’s professional conduct can be raised with the College of Registered Psychotherapists of Ontario (www.crpo.ca).

9. Your consultation and booking on Jane

Consultations and sessions are booked on our Jane booking site (noorminds.janeapp.com), and any intake forms you complete there become part of your record in Jane. Jane runs that website under its own privacy policy. Section 10 explains how our website’s measurement connects to bookings made there.

10. This website

This section describes what happens when you visit noorminds.ca. The companion app, which works differently, is covered in section 12.

Hosting

The site is hosted by Netlify. Like any web host, Netlify’s servers receive the standard technical details of each request, such as your IP address, the address requested, your browser type and the time, and may keep them in server logs for security and operations, under Netlify’s own privacy policy. The site’s fonts, images and videos are served from our own domain.

Google Analytics and Google Ads

Apart from the pages listed under “Pages that load no outside code” below, every page of this site loads two Google tags: Google Analytics 4 (measurement ID G-2S7WG8HQYY), which shows us how people use the site, and the Google Ads tag (AW-18012062070), which shows us whether our ads lead people to contact or book with us.

These tools receive the address and title of each page you view (including any tracking codes in the address, such as those added to ad links), the site that referred you, your browser, device, screen size and language, and your approximate location, which Google estimates from your IP address. The data is pseudonymous: it is linked to a random identifier stored in a cookie in your browser, not to your name. It is not anonymous, and it shows which of our pages a browser has viewed, including pages about particular mental health concerns.

We have turned off ad personalization for both tags, and Google signals for Google Analytics. These settings tell Google not to use information from this site to personalize ads, and not to combine it with data from signed-in Google accounts for cross-device or demographic reports. We do not use remarketing (showing you our ads elsewhere because you visited this site).

Google Analytics keeps user-level and event-level data for the retention period set in our account; for a standard account, the longest available setting is 14 months. Reports built from that data, such as totals and trends, are kept longer.

What we measure

Besides page views, our site’s code sends these interactions to both Google Analytics and Google Ads:

  1. clicks on booking links: where on the page the link was, the booking address as it appears on our page, whose calendar it opens (Ghazal’s, Tina’s, Roya’s or the practice’s) and the link’s wording;
  2. taps on our phone number, our WhatsApp link and our email addresses: where on the page the link was and which one it was (never a message);
  3. clicks on links to other websites (the link’s address);
  4. opening a question in an FAQ list, or a “Who we help” card on the home page: only its position (for example, the third question), never its text. Because every event includes the address of the page, the position can be matched to the question on that page;
  5. sharing an article (copying its link, sharing to WhatsApp or using your device’s share menu);
  6. opening the mobile menu, and dismissing the booking bar.

Two things are never sent: taps on crisis lines (calling 911, or calling or texting 988), and the text of FAQ questions. Depending on our account settings, Google Analytics may also record some interactions automatically, such as how far a page is scrolled.

Ad clicks and bookings

When you arrive from a Google ad, Google adds a click identifier to the page address (gclid, gclsrc, wbraid or gbraid). Our site saves these identifiers, with the time they were saved, in your browser’s local storage under the name nm_gads_click, and adds them to the links to our Jane booking site. Bookings are completed on Jane, a separate website, and cookies do not carry over from one website to another, so without this step a booking could not be matched to an ad. Jane’s booking site then reports the completed booking to Google Analytics and Google Ads as an “appointment booked” event, which shows us which ads lead to bookings. That event includes the name of the service you booked (for example, the type of session), but not your name, email address or phone number. This means Google can connect the ad you clicked with the fact that a booking was made, and for which kind of service.

The saved record is kept for 90 days from your most recent ad click. After that, it is deleted the next time you open a page on this site. The identifiers are random codes; they do not contain your name or contact details.

Google’s tag also adds a linking code (_gl) to links to our Jane booking site, so that Google Analytics can count a visit that continues on the booking site as one visit rather than two.

Cookies

Our own code sets no cookies. Google’s tags set the following cookies on noorminds.ca, with Google’s default lifetimes (we do not change them):

  1. _ga (Google Analytics): a random identifier that distinguishes your browser; up to 2 years from your last visit.
  2. _ga_2S7WG8HQYY (Google Analytics): keeps track of your current visit; up to 2 years from your last visit.
  3. _gcl_au (Google Ads): used to match ad clicks with conversions; 90 days.
  4. _gcl_aw and other cookies beginning _gcl_ (Google Ads), when you arrive from a Google ad: the ad click identifier; 90 days.

Google’s tags may also read or set cookies on Google’s own domains, depending on your browser’s settings; those are covered by Google’s privacy policy. For a browser that sends Global Privacy Control, our code does not set up either Google tag (see section 11).

Other things kept in your browser

  1. Local storage: the ad click record described above (nm_gads_click), only if you arrived from a Google ad.
  2. Session storage: nm-sticky-shown and nm-sticky-dismissed remember that the booking bar at the bottom of the screen has been shown or dismissed, so it appears at most once per visit. Your browser deletes them when you close the tab.
  3. Offline copies: the site installs a service worker, a small script that keeps a copy of each page of this site you open, along with the site’s styles, scripts, fonts and images, so that pages you have read can open without a connection. Each page is saved under its address without the part after any “?”, so ad click codes are not saved with it. Nothing from other websites and nothing from the companion app is saved this way. The copies stay on your device and are never sent to us. They are replaced when we publish a new version of the service worker, and removed when you clear this site’s data. Like your browsing history, they could be seen by someone using the same browser profile.

Psychology Today and TherapyOwl badges

Most pages show a “verified” badge from Psychology Today in the footer. To draw it, your browser loads a script from Psychology Today (member.psychologytoday.com), which fetches the badge from Psychology Today’s servers. Psychology Today receives your IP address and browser details and can tell that the request came from noorminds.ca, under its own privacy policy. The TherapyOwl badge is an image stored on our own site, so nothing loads from TherapyOwl unless you follow the link.

Pages that load no outside code

Our “page not found” and “page removed” pages, and the companion app, load no Google or Psychology Today code.

11. Your choices about website tracking

This site does not have its own switch for turning tracking off. You can limit it in these ways.

Global Privacy Control (GPC). If your browser sends a GPC signal (some browsers, such as Brave, do this by default; others, such as Firefox, let you turn it on), our code does not set up Google Analytics or Google Ads, sends no page views or events, and does not save or pass on ad click identifiers. Your browser still downloads Google’s tag file and the Psychology Today badge script, so those companies receive the ordinary details of those requests, such as your IP address. Our site does not pass ad click identifiers to Jane in this case, but Jane’s booking site is run by Jane, and whether it responds to GPC is up to Jane.

Browser settings. You can block or delete cookies and clear this site’s data at any time. Clearing the site’s data also removes the ad click record, the session storage items and the offline copies. Content-blocking extensions can stop the Google and Psychology Today scripts from loading.

Google’s tools. Google offers the Google Analytics opt-out browser add-on and ad controls in My Ad Center, and explains how it uses information from sites that use its services.

12. The NoorMinds companion app

The companion at noorminds.ca/app/ is a free tool for the time between sessions, with check-ins, journaling, worksheets and grounding exercises. It needs no account.

  1. What you write stays on your device. Check-ins, journal entries, worksheets, letters and unsaved drafts are kept only in your browser’s storage on that device. Nothing you write is uploaded to us or to anyone else, and your clinician cannot see it unless you choose to show or send it.
  2. No analytics. The companion loads no analytics or advertising code, and its security settings block connections to other websites.
  3. Unencrypted unless you add a passcode. By default your entries are stored unencrypted, so anyone who can use your unlocked device could read them. If you add the optional passcode, they are encrypted with a key made from your passcode, and the companion locks once it has been put away for a minute. The passcode never leaves your device, so no one, including us, can recover it; if you forget it, the only way back in is to erase everything and start again.
  4. Shared browser storage. The companion’s storage belongs to the noorminds.ca website as a whole. In the same browser, scripts on our other pages, including the Google and Psychology Today scripts described in section 10, are technically able to read entries kept without a passcode. We have no indication that they do. With a passcode, only encrypted data is stored.
  5. Export and erase. You can export everything as a text file, which is then yours to keep safe, and you can erase everything on the device from the Journal screen.
  6. Booking links. Booking links in the companion add a label to the address (utm_source=noorminds_app) so that the booking site can tell a booking began in the companion. Jane, and any analytics running on Jane’s booking pages, can see that label.
  7. Offline use. The companion keeps a copy of its own files (not your entries) so that it opens without a connection, and asks your browser not to clear its storage automatically. On iPhone and iPad, a browser tab’s storage can still be cleared after about a week without a visit, and the Home Screen app keeps a separate copy.

The companion also keeps a few settings on the device: whether you have finished the welcome screens or dismissed the install prompt and, if you use a passcode, a count of wrong attempts. Its storage names are noorminds_companion_v1, noorminds_drafts_v1, noorminds_lock_state, noorminds_onboarded and noorminds_install_dismissed. Erasing removes all of them.

13. Email, phone, WhatsApp and Instagram

You are welcome to contact us by email, phone or WhatsApp, or through our Instagram account. Email and messaging aren’t secure channels, so please keep personal health details for your session. WhatsApp and Instagram are run by Meta, and email and phone services by their providers, each under its own privacy policy. Comments and follows on Instagram are public. Messages that relate to your care may be added to your record.

Calls and messages aren’t monitored for emergencies. If you are in immediate danger, call 911. If you are in crisis, call or text 988, the Suicide Crisis Helpline, available 24/7.

14. Links to other websites

This site links to other websites, including Jane, WhatsApp, Instagram, Psychology Today and TherapyOwl. When you follow those links, the other site’s privacy policy applies. Your browser tells those sites at most that you came from noorminds.ca, not which page, but anything in the link itself, such as the ad click identifiers added to Jane links, is passed along.

15. Where information is processed

Some of our service providers, including Google and Netlify, are based outside Canada. Information they receive may be stored or processed in other countries, where it is subject to those countries’ laws.

16. Changes to this policy

We will update this page when our practices change and change the date at the top. For any question about this policy, please contact us:

NoorMinds Psychotherapy
Privacy contact: Ghazal Sheikhtaheri, Registered Psychotherapist (Qualifying)
(647) 699-5142
hello@noorminds.ca