Sabine Cox, Registered Psychotherapist
Website: sabinecox.com
Last updated: September 2026

This privacy policy explains how I collect, use, disclose, store and protect personal information in connection with my psychotherapy practice and related professional activities. It is intended to be clear about the different kinds of information I handle, including psychotherapy records, clinical supervision, courses and workshops, newsletter subscriptions, and information collected through my website.

1. My approach to privacy

As a Registered Psychotherapist in Ontario, I take the privacy and confidentiality of the people I work with seriously. I collect and use information only for purposes that are appropriate to the service being provided and in accordance with applicable privacy and professional requirements.

Different laws may apply depending on the nature of the information and the service involved. Personal health information collected in the course of psychotherapy is governed primarily by Ontario’s Personal Health Information Protection Act (PHIPA). Other personal information collected in connection with courses, workshops, newsletters and website activities may be subject to other applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable.

2. Psychotherapy: prospective, current and former clients

When someone contacts me about psychotherapy, I may collect basic contact information such as their name, address, email address and telephone number, together with information they choose to provide about their reason for contacting me. I collect information that is reasonably necessary to respond to the inquiry and, where applicable, to provide psychotherapy. If I meet with a prospective client, I maintain a record as required by the professional standards that apply to Registered Psychotherapists, even if the person does not subsequently become a client.

For current and former psychotherapy clients, records may include contact and identifying information, information provided during assessment and therapy, treatment plans, session and progress notes, communications, relevant documents, appointments, invoices and payment information, and other information required for the provision and administration of psychotherapy.

Psychotherapy information is treated as confidential and is handled with particular care because it may contain highly sensitive personal health information.

3. Clinical supervision

Clinical supervision is part of my professional practice and I handle supervision information with the same care and confidentiality that I bring to psychotherapy.

Supervision records may include information about the supervisee, their professional practice, and, where appropriately authorized, information about people with whom the supervisee works. Generally, supervisees remain responsible for their own clients and for meeting the privacy and consent requirements that apply to their practice. Where identifiable client information is shared with me for supervision, the supervisee is responsible for obtaining any consent or authorization required for that disclosure and for informing their client about supervision as required.

The precise legal responsibilities that apply to information shared in supervision can depend on the circumstances and the roles of the professionals involved.

4. Courses, workshops and groups

I offer professional development courses, workshops and groups, including some groups that have a therapeutic or personal-development teaching component. Participation in these activities does not, by itself, create a psychotherapy treatment record.

For courses and workshops, I may create a basic record in Cliniko for administrative purposes. This generally includes name, address, email address, invoices and relevant correspondence. I do not create psychotherapy treatment notes simply because someone participates in a course, workshop or group.

5. Types of information I collect

• Psychotherapy records: name and contact information; information provided during assessment and therapy; treatment plans; session and progress notes; relevant correspondence and communications; relevant documents; appointment information; invoices and payment information; and other information required for the provision and administration of psychotherapy.
• Prospective-client records: basic contact information and, where I have met with a prospective client, information required to maintain the record required by my professional obligations.
• Clinical supervision: information about the supervisee and their professional practice, together with information about a supervisee’s clients when the supervisee appropriately shares information for supervision and has obtained any consent or authorization required.
• Courses, workshops and groups: basic administrative information, generally including name, address, email address, invoices and relevant correspondence.
• Newsletter subscriptions: name and email address and the information needed to manage your subscription and send the newsletter.
• Website use: information generated through website visits, including limited page-view and technical information associated with Google Analytics, together with information collected by third-party services that operate features you choose to use or interact with.

6. Consent and withdrawal of consent

Where consent is required, I seek consent for the collection, use or disclosure of information and use information only for the purposes for which it was collected, unless another use or disclosure is permitted or required by law.

For psychotherapy, informed consent includes discussion of confidentiality and its limits. I offer clients three consent options for sharing their personal health information with other health-care providers:

• Full consent: consent to appropriate sharing of relevant information for health-care purposes, similar in principle to communication among members of a person’s treating health-care team.
• Limited consent: consent to disclose only information that is directly related to the specific health-care purpose or request identified.
• Refused consent: no disclosure except where disclosure is required or otherwise permitted by law.

These choices are discussed as part of the informed consent process. I generally seek express consent before disclosing psychotherapy information to another care provider.

You may withdraw consent where consent is the basis for a particular collection, use or disclosure, subject to legal, professional or contractual limitations. Withdrawal of consent does not affect information that I am required or permitted to retain or use under applicable law or professional requirements.

For the newsletter, you can unsubscribe at any time using the unsubscribe mechanism provided in the email or by contacting me.

7. When information may be disclosed without consent

I do not disclose psychotherapy information to third parties simply because someone requests it. There are, however, circumstances in which information may be disclosed without consent because the law permits or requires it.

This can include disclosure in response to an appropriate subpoena, court order or other legally binding requirement; certain mandatory reporting obligations; disclosures authorized by PHIPA for specified purposes; and disclosure that is permitted or required to prevent or reduce a significant risk of serious bodily harm. Where disclosure is legally permitted but not required, I will consider whether disclosure is necessary and will disclose only what is reasonably necessary for the purpose. Where permitted and practical, I will make reasonable efforts to inform you before making a disclosure.

8. Email and other electronic communications

I use email for administrative communication, including scheduling, forms and session-related information. Ordinary email is not a completely private method of communication. I therefore ask clients and others not to send detailed personal or health information by ordinary email unless we have discussed and agreed that it is an appropriate method.

Please do not send urgent or emergency information by email. Email is not continuously monitored.

9. Storage, security and third-party service providers

I use reasonable physical, technical and administrative safeguards appropriate to the information I hold. Paper records are kept securely, and electronic records are maintained in systems selected for their security and privacy features. Access to my clinical systems is protected by a security key.

10. Cliniko

I use Cliniko as my practice management and clinical record system. It contains psychotherapy records and other information required to administer my practice. I also use Cliniko for its telehealth function for psychotherapy sessions and for certain email communications such as forms and session information. I do not use Cliniko’s SMS function.

Cliniko has confirmed that my account, its data and backups are stored in Canada in its CA1 server environment. Cliniko also uses subprocessors, and some information may be processed outside Canada by subprocessors in order to provide Cliniko’s services.

I do not maintain separate electronic backups or copies of my clinical records outside Cliniko.

11. Zoom

I use Zoom for clinical supervision groups and some seasonal therapeutic teaching groups. I do not ordinarily record these meetings. Cloud recording, transcripts, AI Companion, meeting summaries and My Notes are disabled.

If a meeting is recorded, I obtain prior verbal consent from all participants and delete the recording after approximately one month. Zoom chat is not ordinarily retained. If I deliberately download a chat for later sharing with participants, I do so with appropriate consent.

Meeting links are sent by email.

12. Payments and registration

Course registration and some payments may be handled through Square. I also offer Square payment processing to clients who choose that method, including through Cliniko. Most payments in my practice are made by e-transfer. Square receives and processes payment information according to its own privacy and security practices.

13. Newsletter and Mailchimp

Newsletter subscriptions are managed through Mailchimp. I use Mailchimp’s consent and unsubscribe processes in accordance with Canada’s anti-spam requirements. Newsletter information is used to send the communications for which you have subscribed.

Cliniko is not integrated with Mailchimp.

14. Website, cookies and analytics

My website is hosted by Bluehost and built using WordPress. I use Google Analytics through Site Kit by Google to understand general website usage and which pages are of interest. I have configured Google Analytics to collect page-view information only; other Enhanced Measurement events such as scrolls, outbound clicks, site searches, file downloads, form interactions and video engagement are not currently enabled.

Analytics may involve cookies or similar online identifiers and may collect information such as pages viewed and certain technical information about a visit. I do not use Google Analytics for advertising or to create psychotherapy profiles. Logged-in website users are excluded from Analytics.

You can control or block cookies through your browser settings. Because third-party technologies and website services can change independently of my practice, this policy may be updated when my website’s analytics or other technical practices change.

15. Google Maps and external links

My website contains an interactive Google Map. When you interact with an embedded Google Map, Google may receive information about your interaction with the map and your device or browser. Google’s own privacy practices apply to information it collects through its services.

My website also contains links to external services, including Psychology Today, Square, Mailchimp and social media platforms. These services are operated by third parties and are subject to their own privacy policies and terms.

The Psychology Today element on my website is a verified badge that links to my Psychology Today profile.

16. Retention and destruction of records

I retain psychotherapy records in accordance with the record-keeping requirements that apply to Registered Psychotherapists. Clinical records are retained for at least 10 years from the last interaction with an adult client, or until 10 years after a minor client reaches 18, whichever is later.

Inactive clients may be archived in Cliniko. When the applicable retention period has passed, I am responsible for arranging appropriate deletion or destruction. When a patient is deleted from Cliniko, communications, file attachments, letters and treatment notes are permanently deleted and cannot be recovered. Certain appointment, invoice and payment information may remain in Cliniko for record-keeping and reporting purposes, subject to Cliniko’s patient-anonymisation settings.

A small number of old paper psychotherapy files remain in my office. They are kept under double lock and are shredded as the applicable 10-year retention period approaches and ends.

17. Access to and correction of information

You may ask to access personal information I hold about you and, where appropriate, request correction of information that is inaccurate or incomplete. Requests relating to psychotherapy records will be handled in accordance with PHIPA and applicable professional requirements. Other requests will be handled under the privacy legislation that applies to the information concerned.

To make an access or correction request, please contact me directly using the contact information provided on my website. I may need to verify your identity before providing access to information.

18. Privacy breaches

I take reasonable steps to prevent unauthorized access, use, disclosure, loss or destruction of personal information. If I become aware of a privacy breach, I will take reasonable steps to contain and investigate the breach and will notify affected individuals and/or the appropriate privacy regulator where required by law.

19. Privacy questions and complaints

I am the privacy contact for my practice. If you have a question, concern or complaint about how I handle your personal information, please contact me directly using the contact information provided on my website.

If you are not satisfied with my response, you may contact the Information and Privacy Commissioner of Ontario regarding matters governed by Ontario’s health privacy legislation, or the Office of the Privacy Commissioner of Canada where federal privacy legislation applies.

20. Social Media and Facebook

I maintain a professional Facebook Page and may maintain other social media profiles for the purpose of sharing information about my psychotherapy practice, clinical supervision, courses, groups, workshops, and related areas of professional and personal exploration.

I do not use social media platforms to collect or maintain psychotherapy records or personal health information. I do not use Facebook Messenger, Facebook forms, booking tools, or other Facebook features to collect information for my practice.

Please do not share personal, health-related, or confidential information about yourself or another person through social media comments, posts, or messages. Social media is not an appropriate platform for communication requiring clinical confidentiality.

Social media platforms are operated by third parties and may collect and process information about your use of their services in accordance with their own privacy policies and terms. I do not control how these platforms collect, use, store, or process information.

If you wish to contact me about psychotherapy, clinical supervision, courses, groups, or workshops, please use the contact information provided on my website rather than sharing personal or confidential information through social media.

21. Contact

Privacy contact: Sabine Cox, Registered Psychotherapist

Please use the contact information provided on my website to contact me about privacy questions, access or correction requests, or concerns.

22. Changes to this policy

I may update this privacy policy from time to time to reflect changes in my practice, technology, privacy requirements or the services I use. The date at the beginning of this policy indicates when it was last updated.

Get in Touch