Privacy Policy

1. Who We Are

This website is operated by La Rose Counselling Services, operating as The OCD Clinic. Our clinical director is Justin La Rose, RP, M.Psy, a Registered Psychotherapist registered with the College of Registered Psychotherapists of Ontario (CRPO) with 25+ years in mental health.

Mailing address: 2 Bloor Street West, Suite 700, Toronto, ON M4W 3E2
Email: theocdclinic@larosecounselling.com
Website: theocdclinic.ca

2. What Information We Collect

We collect only the information necessary to deliver our services and operate this website.

Contact Information

When you book a consultation or contact us, we collect your name, email address, and optionally your phone number. This information is used to confirm your appointment and communicate about your care.

OCD Assessment Responses

Our website includes a screening tool based on the Yale-Brown Obsessive Compulsive Scale (Y-BOCS). This tool is anonymous and self-scoring. Your responses are not transmitted to our servers and are not stored or linked to any identifiable information.

Account Data (Course Purchasers)

If you purchase the OCD Recovery Course, we create an account using your email address and track your course access status. This data is stored in Supabase (see Third-Party Processors below). We do not store your password in plain text. Authentication is handled securely by Supabase.

Payment Information

Payments are processed by Stripe. We never receive, see, or store your raw card number, CVV, or full payment credentials. Stripe provides us with a transaction record (amount, date, a masked card reference) for billing purposes only. Stripe's privacy policy governs their handling of your payment data.

Session Data and Cookies

We use cookies and session tokens to keep you logged in to the course platform and to remember your authentication state. These are functional cookies. They are required for the course platform to operate. We do not use tracking cookies for advertising purposes.

Clinical Records (Therapy and Coaching Clients)

For clients receiving psychotherapy or coaching, Justin La Rose maintains clinical notes and records as required by professional standards. For Ontario psychotherapy clients, these records constitute personal health information governed by PHIPA (see Section 7).

Usage Data

This website is hosted on Vercel. Vercel may collect anonymized web analytics such as page views and general traffic patterns. This data does not identify individual visitors and is used only to understand aggregate site performance.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Booking management: confirming, rescheduling, and following up on consultations and appointments
• Service delivery: providing psychotherapy, coaching, or course access that you have engaged
• Billing: processing payments for sessions and the OCD Recovery Course
• Course access control: verifying that course content is accessible only to purchasers
• Clinical record-keeping: maintaining records as required by CRPO and PHIPA
• Communication: responding to enquiries sent to theocdclinic@larosecounselling.com

We do not sell your data. We do not use your information for marketing without your explicit consent. We do not share your personal information with third parties except as described in this policy.

4. Third-Party Service Providers

We use the following third-party services to operate the clinic and this website. Each processes limited data as described:

5. How Long We Keep Your Data

Ontario Psychotherapy and Coaching Clients

Clinical records for Ontario psychotherapy clients are retained in accordance with CRPO standards and Ontario's Regulated Health Professions Act (RHPA). For adult clients, this is a minimum of 10 years from the date of last service, or 10 years after a minor client reaches the age of 18. Records are stored securely and access is restricted to the treating clinician.

Course Account Data

Your course account (email and access status) is retained for the duration of your course access period. You may request deletion of your account at any time by emailing theocdclinic@larosecounselling.com, subject to any obligations arising from your purchase.

Booking and Contact Data

Booking records (name, email, appointment time) are retained for a reasonable period to support scheduling and billing continuity. Contact enquiries sent to theocdclinic@larosecounselling.com are retained in email correspondence for as long as reasonably needed for business continuity.

6. Your Privacy Rights

Canadian Residents (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request that inaccurate or incomplete information be corrected
• Withdrawal of consent: withdraw consent for uses of your information not required by law or our professional obligations, subject to reasonable notice
• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

EU / UK Coaching Clients (GDPR / UK GDPR)

If you are a coaching client located in the European Union or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access: obtain confirmation of whether we process your data and receive a copy
• Right to erasure: request deletion of your personal data where no legal obligation requires us to retain it
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing of your data based on legitimate interests
• Right to restrict processing: request that we limit how we use your data pending a complaint or correction

To exercise any of these rights, email theocdclinic@larosecounselling.com. We will respond within 30 days. Note that some retention obligations under professional regulations (CRPO, RHPA) may limit the scope of deletion requests for clinical records.

7. Health Information: Ontario Clients

For clients receiving psychotherapy in Ontario, the clinical record constitutes personal health information (PHI) as defined by Ontario's Personal Health Information Protection Act (PHIPA).

Under PHIPA, Justin La Rose, RP acts as a health information custodian. Your health information is collected only for the purpose of providing psychotherapy services, will not be disclosed without your consent except as permitted or required by law, and is retained and secured in accordance with PHIPA requirements.

Exceptions to confidentiality that may require disclosure without consent include:

• A duty to report a reasonable suspicion of child abuse or neglect (Child, Youth and Family Services Act)
• A duty to protect an identifiable third party from serious harm (as per Smith v. Jones criteria)
• A court order or legal obligation
• Where required to report to a regulatory college

These exceptions are discussed in detail in your intake consent form. PHIPA rights and disclosures will also be explained in your first session.

8. International Coaching Clients

Coaching clients located in the US, UK, Ireland, Australia, and other countries should be aware of the following data transfer considerations:

• Primary processing: Your name, email, and coaching records are processed and stored in Canada, which the European Commission has recognized as providing adequate data protection.
• Payment data: Payment processing is handled by Stripe, which operates primarily in the United States and is subject to US privacy law and its own GDPR compliance framework.
• Booking data: Cal.com may process your booking information on infrastructure located in various jurisdictions.
• Coaching records: Justin La Rose maintains coaching notes. These are not regulated health records in your jurisdiction. They are business records governed by Canadian privacy law (PIPEDA).

By engaging OCD coaching services, you consent to the transfer and processing of your personal information to Canada and, for payment purposes, to the United States, as described in this policy.

9. How We Protect Your Information

We take reasonable steps to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

• This website is served over HTTPS (TLS encryption in transit)
• Course account passwords are hashed and never stored in plain text
• Payment card data is handled exclusively by Stripe, and we do not store it
• Database access is restricted and authenticated
• Clinical notes are stored in compliance with CRPO professional standards

10. Contact Us About Privacy

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to raise a concern about how your information has been handled, please contact us:

Email: theocdclinic@larosecounselling.com
Mail: Justin La Rose, RP, The OCD Clinic, 2 Bloor Street West, Suite 700, Toronto, ON M4W 3E2

We will respond to privacy requests within 30 days. If you are unsatisfied with our response, you may escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, for EU/UK clients, to your local data protection authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of this website or our services after an update constitutes acceptance of the revised policy. For material changes affecting how we handle existing clients' data, we will notify affected individuals directly by email.