Noojimo Health Privacy Policy

Effective Date: February, 2021

Last Revised: October, 2025

Our Promise to You: Privacy as the Foundation for Healing

"Noojimo" means "to heal." At Noojimo Health, we know that healing is not possible without trust, and trust is not possible without safety. Your privacy is the foundation of the safe, sacred space we create together.

We are an Indigenous-owned organization committed to providing culturally safe virtual mental health services to First Nations, Inuit, and Métis peoples across Canada.

Our privacy promise is built on two pillars:

  • We are guided by the First Nations principles of OCAP® (Ownership, Control, Access, and Possession). We respect the right of Indigenous peoples to own, control, and access data about their communities.

  • We are a national organization and adhere to a "highest bar" standard of privacy. This means our policy is designed to meet or exceed the requirements of all applicable federal, provincial, and territorial privacy laws, including the specific Personal Health Information Act in the province or territory where you reside.

Policy

1. Scope and Application

This policy applies to all Personal Health Information (PHI) we collect, use, and disclose while providing you with virtual mental health services, from your first registration to your ongoing care.

As "Health Information Custodians" (or the equivalent in your jurisdiction), our clinicians and all Noojimo Health staff are responsible for protecting your information.

2. What Information We Collect

We only collect the information that is necessary to provide you with safe, effective, and funded care. This includes:

  • Personal Information: Your name, date of birth, address, phone number, and email.

  • Identifying Information: Your provincial/territorial health card number and/or your NIHB (Non-Insured Health Benefits) client identification number.

  • Personal Health Information (PHI): Information about your mental and physical health history, family health history, and details from your sessions (e.g., assessments, treatment plans, and session notes).

  • Billing Information: Information required to bill NIHB or other third-party payers on your behalf.

3. Why We Collect and Use Your Information

Your information is used only for specific, necessary purposes:

  • To Provide Care: To deliver virtual counselling and mental health services to you.

  • To Coordinate Care (Your "Circle of Care"): To communicate with other health providers who are directly involved in your care (e.g., your family doctor or a nurse practitioner, but only with your consent).

  • To Bill for Services: To submit required information to NIHB or other third-party funders to pay for your sessions, so there is no cost to you.

  • To Meet Legal & Professional Obligations: To comply with the laws of your jurisdiction and the standards of our clinicians' professional colleges (e.g., College of Social Workers).

  • To Improve Our Services: For internal quality improvement (e.g., ensuring our services are safe and effective) using de-identified data.

  • To Support Our Communities & Partners (De-identified Reporting): This is a critical part of our mission. (See Section 4).

4. Community Reporting & Data Stewardship

We have reporting obligations to our Indigenous community partners and funders who help make these services possible. We are proud to share information that helps with community planning and demonstrates the value of our services.

Our commitment to you is that this reporting is never done using individual names or any information that could identify you.

All reports use summarized, aggregated, and de-identified data. For example, a report might say, "We provided 200 sessions for clients in a specific region" or "50 clients accessed services for grief and loss." Your personal story remains yours and is never shared.

5. Your Consent

Your consent is the most important part of this process. We will always explain what you are consenting to.

Express Consent: We will ask for your clear, direct permission (verbally or in writing) before:

  • Beginning treatment.

  • Sharing your information with anyone outside your direct Circle of Care (e.g., a family member, a community agency, your school).

  • Using your information for any purpose not listed in this policy.

Implied Consent: When you begin care with us, we may assume your "implied consent" to use your information for routine care purposes, such as your clinician consulting with a clinical supervisor at Noojimo Health to ensure you are getting the best possible care.

You have the right to withdraw your consent at any time. You can tell your clinician or our Privacy Officer. We will explain if withdrawing consent has any consequences (e.g., we may not be able to bill NIHB for your sessions).

6. Privacy in a Virtual Clinic (Our Safeguards)

Protecting your information in a digital world is our top priority. We use a combination of strong safeguards to keep your data secure.

Administrative Safeguards:

  • All our staff, clinicians, and contractors sign strict confidentiality agreements.

  • Access to your information is limited to a "need-to-know" basis.

Technical Safeguards:

  • Secure Platform: We use a secure, encrypted, and compliant virtual care platform (e.g., Jane App) for booking, video sessions, and storing your clinical notes. Our platform partners are vetted to ensure they meet Canadian privacy and data security standards.

  • Encryption: All data is encrypted when it is stored and when it is transmitted.

  • Data Residency: We take all reasonable steps to ensure your Personal Health Information is stored securely on servers located within Canada.

Physical Safeguards:

  • While we are a virtual clinic, any physical devices (e.g., laptops) are encrypted and secured. Clinicians must work from private, secure locations.

7. Limits to Confidentiality (When We Must Disclose)

This is a critical, legal requirement in every province and territory. In rare and specific situations, all health providers in Canada are legally and ethically required to break confidentiality without consent.

We will always try to discuss these situations with you first, if it is safe and legal to do so.

These situations are:

  • Risk of Serious Harm: If we have reason to believe you are at serious, imminent risk of harming yourself or another identifiable person.

  • Child Protection: If we have reasonable grounds to suspect a child (under the age defined by your province) is in need of protection (e.g., being abused or neglected).

  • Legal Order: If we are served with a court order, subpoena, or search warrant that legally requires us to release information.

  • Public Health: If we are required to report to a public health authority (e.g., for a specified communicable disease).

8. Your Rights

You have the right to:

  • Access Your Information: You have the right to ask for a copy of your health record. We must respond to your request within the time limit set by your province (e.g., typically 30 days).

  • Correct Your Information: If you believe there is a mistake in your record, you have the right to request a correction.

  • Ask Questions: You can ask us who we have shared your information with and why.

  • Make a Complaint: You can make a complaint to us or to the Privacy Commissioner in your province/territory.

9. Questions and Complaints

We want to be fully transparent and accountable to you. If you have any questions or concerns about your privacy, please speak to your clinician or contact our office.