Privacy, Confidentiality & Records Policy

Fireweed Counselling & Healing Arts
Effective Date: JUNE 1, 2026

1. Purpose

Fireweed Counselling & Healing Arts is committed to protecting the privacy, confidentiality, dignity, and personal information of every client.

This policy explains how personal information and personal health information are collected, used, stored, disclosed, protected, accessed, corrected, retained, and destroyed in the course of counselling, consultation, expressive arts, land-informed healing, workshops, and related services.

This policy applies to:

  • individual counselling

  • walk-and-talk or outdoor sessions

  • expressive arts and creative healing sessions

  • consultation and supervision-related documentation

  • intake forms and consent forms

  • email, phone, text, voicemail, and website inquiries

  • online booking and payment systems

  • clinical records

  • workshop registration, if applicable

  • website contact forms and newsletter forms, if used

2. Guiding Principles

Fireweed Counselling & Healing Arts follows these privacy principles:

  • collect only what is needed

  • explain why information is being collected

  • use information only for appropriate service-related purposes

  • obtain informed consent whenever required

  • protect client information with reasonable safeguards

  • limit access to information

  • disclose information only with consent or when legally/ethically required

  • document carefully and respectfully

  • allow clients to request access to their own records where permitted

  • maintain privacy in supervision, consultation, and electronic communication

  • respond appropriately to privacy concerns or breaches

The CASW Code of Ethics states that social workers have a duty to uphold privacy and confidentiality for information shared and documented in written or electronic records, and to discuss limits of confidentiality early and throughout the professional relationship.

3. Information Collected

Fireweed Counselling & Healing Arts may collect personal information and personal health information such as:

  • name, address, phone number, email, and date of birth

  • emergency contact information

  • health card number, if required for a specific program or billing purpose

  • counselling history

  • mental health, emotional health, trauma, grief, family, relational, cultural, spiritual, or social history

  • medical information relevant to counselling

  • medication information voluntarily provided by the client

  • risk and safety information

  • goals for counselling

  • session notes

  • consent forms

  • payment and billing information

  • referral information

  • communication records

  • insurance or third-party funding information, if applicable

  • workshop registration information, if applicable

Only information that is reasonably necessary for providing safe, ethical, and appropriate services will be collected.

4. How Information Is Used

Client information may be used to:

  • provide counselling and related services

  • assess client needs, goals, risks, and strengths

  • plan and document care

  • schedule appointments

  • communicate with clients

  • process payments or receipts

  • complete insurance, benefit, or direct billing paperwork when authorized

  • consult with supervisors or professional consultants while protecting privacy

  • meet legal, ethical, professional, and regulatory obligations

  • respond to emergencies or safety concerns

  • maintain business and clinical records

  • improve administrative practice and service quality

Client information will not be sold, rented, traded, or used for unrelated marketing purposes.

5. Consent

Clients will be asked to provide informed consent before services begin.

Consent may include agreement to:

  • participate in counselling services

  • allow collection and use of personal information for service delivery

  • communicate by email, phone, voicemail, text, or online booking platform

  • participate in virtual, outdoor, walk-and-talk, expressive arts, or land-informed sessions

  • share information with another professional, agency, family member, insurer, school, physician, lawyer, or other third party

  • allow limited consultation with a supervisor or clinical consultant

  • receive receipts, invoices, reminders, or administrative communication

Clients may withdraw or limit consent, except where information must be retained, used, or disclosed because of legal, ethical, professional, safety, or record-keeping obligations.

6. Limits of Confidentiality

Confidentiality is central to counselling. However, there are limits.

Information may be disclosed without client consent when required or permitted by law, professional standards, or safety obligations. This may include situations involving:

  • serious, imminent, or foreseeable risk of harm to the client or another person

  • child protection concerns

  • abuse, neglect, or safety concerns where reporting is legally required

  • court order, subpoena, warrant, or other legal requirement

  • professional complaint, investigation, audit, or regulatory process

  • medical emergency

  • consultation with a supervisor, clinical consultant, lawyer, insurer, or other professional where necessary and appropriate

  • collection of unpaid fees, limited to the minimum necessary information

  • other circumstances required or permitted by applicable law

When disclosure is required, only the minimum necessary and relevant information will be shared whenever possible. CASW ethics guidance also states that confidential information may be disclosed with valid consent, when required by law or court order, or when necessary to prevent serious, imminent, or foreseeable harm.

7. Supervision and Consultation

Fireweed Counselling & Healing Arts may use clinical supervision, peer consultation, legal consultation, insurance consultation, or cultural consultation to support ethical and safe practice.

When consultation occurs:

  • identifying information will be avoided whenever possible

  • only information necessary for consultation will be shared

  • consultants/supervisors are expected to maintain confidentiality

  • consultation may be documented when clinically or ethically appropriate

  • client privacy will be protected as much as possible

8. Storage and Safeguards

Client records may be stored electronically, physically, or both.

Safeguards may include:

  • password-protected devices

  • encrypted or secure practice software, where available

  • secure electronic health record or booking system

  • locked filing cabinets

  • restricted access to records

  • secure disposal and shredding of paper records

  • strong passwords and multi-factor authentication where possible

  • updated antivirus/security software

  • clean desk practices

  • limiting printed records

  • avoiding unnecessary identifying information in emails or texts

  • using secure platforms for clinical documentation and virtual care

Saskatchewan IPC guidance explains that HIPA requires administrative, technical, and physical safeguards to protect personal health information, including policies, access restrictions, passwords, locked cabinets, secure storage, and destruction schedules.

9. Electronic Communication

Email, text, voicemail, online booking systems, and virtual platforms are convenient but may carry privacy risks.

Potential risks include:

  • messages sent to the wrong person

  • unauthorized access to an email account or phone

  • information stored on third-party servers

  • interception or technical failure

  • others seeing notifications on a shared device

  • limited control once a message is sent

Clients are encouraged not to send highly sensitive clinical information by regular email, text, contact form, or voicemail.

Electronic communication should generally be used for:

  • scheduling

  • appointment changes

  • brief administrative questions

  • forms

  • receipts

  • general service inquiries

Urgent mental health concerns, crisis information, or emergency information should not be sent through email, website forms, or social media.

10. Website Inquiries and Contact Forms

The website may collect information when a person:

  • submits a contact form

  • requests a consultation

  • joins a newsletter, if offered

  • uses online booking

  • completes an intake form

  • submits a workshop inquiry

  • sends an email through the website

Website contact forms are not intended for crisis support or detailed clinical information.

Website visitors should submit only the minimum information needed, such as their name, contact information, and a brief reason for reaching out.

Submitting a website inquiry does not create a therapist-client relationship. A therapeutic relationship begins only after intake, consent, acceptance of services, and confirmation by the practitioner.

11. Online Booking, Payment, and Third-Party Platforms

Fireweed Counselling & Healing Arts may use third-party platforms for:

  • website hosting

  • online booking

  • forms

  • payment processing

  • video sessions

  • email

  • document storage

  • accounting

  • newsletters

  • analytics

Examples may include Squarespace, Notion, Google Workspace, Jane, Owl Practice, Stripe, Square, Zoom, or other platforms, depending on the practice’s choice.

These platforms may collect, process, or store personal information in accordance with their respective privacy policies and terms.

Before using any platform, the practice will make reasonable efforts to choose services that support privacy, security, and professional obligations.

Where possible, clients will be informed if sensitive information may be stored on servers outside Saskatchewan or outside Canada. CASW guidance specifically notes the importance of informing service users where their private/confidential data is stored, including when it is stored outside Canada.

12. Social Media

Social media is not confidential and is not an appropriate place to share personal counselling information.

The practitioner will not provide counselling through social media comments, direct messages, public posts, or social media interactions.

To protect confidentiality:

  • clients should not use social media to contact the practitioner about clinical issues

  • the practitioner will not publicly confirm or deny whether someone is a client

  • the practitioner will not request client testimonials where this could create pressure or privacy risk

  • the practitioner will not search clients online unless there is a clear safety, clinical, legal, or ethical reason, and this will be handled carefully

13. Workshops, Groups, and Community Offerings

For workshops, circles, groups, or community-based offerings, additional privacy limits apply.

Participants may share personal information in group settings. While participants will be asked to respect confidentiality, the practitioner cannot guarantee that other participants will keep information private.

Group/workshop consent forms should explain:

  • confidentiality expectations

  • limits of confidentiality

  • group participation boundaries

  • photography/social media rules

  • whether art images may be shared

  • whether names or contact information will be visible to others

  • what records are kept

14. Art, Images, Creative Work, and Expressive Arts Records

Creative work made in sessions may contain personal meaning or sensitive information.

Client artwork, photos of artwork, writing, images, symbols, or creative process notes will be treated as confidential clinical material when connected to counselling services.

The practice will not share, photograph, display, post, or use client creative work for marketing, teaching, social media, supervision, or portfolio purposes without specific written consent.

Clients may choose to take their artwork home unless there is a clinical, safety, storage, or documentation reason to discuss otherwise.

15. Outdoor, Walk-and-Talk, and Public Spaces

Outdoor and walk-and-talk sessions have additional privacy limits.

The practitioner will make reasonable efforts to protect confidentiality, but privacy cannot be fully guaranteed in public spaces. Clients may be seen, recognized, overheard, or interrupted.

Before outdoor sessions begin, clients will review an outdoor session consent policy that explains public privacy risks, boundaries, weather, injury, wildlife, transportation, and safety planning.

16. Access to Records

Clients may request access to their own clinical record.

Requests should be made in writing.

Access may be provided unless there is a legal, ethical, clinical, safety, third-party privacy, or professional reason to limit or refuse access.

The practice may need time to review the record before release. A fee may apply for copying, preparation, or administrative time, where permitted.

Clients may also request correction of factual errors in their records. If the practitioner does not agree to change the record, the client may add a written statement of disagreement.

HIPA identifies rights related to access, amendment, consent, revocation of consent, being informed about uses/disclosures, and requesting a review by the Information and Privacy Commissioner.

17. Record Retention and Destruction

Client records will be retained in accordance with applicable legal, professional, ethical, and insurance requirements.

Records will be securely stored during the retention period.

When records are eligible for destruction, they will be destroyed securely. Paper records will be shredded or professionally destroyed. Electronic records will be securely deleted where possible.

The practice will not destroy records if there is an active legal, regulatory, insurance, complaint, or safety reason to retain them.

18. Privacy Breaches

A privacy breach may include unauthorized collection, use, disclosure, access, loss, theft, or exposure of personal information or personal health information.

If a privacy breach occurs, Fireweed Counselling & Healing Arts will take reasonable steps to:

  • contain the breach

  • assess what happened

  • identify what information was involved

  • reduce risk of further harm

  • notify affected individuals where appropriate or required

  • notify regulatory, privacy, legal, or insurance bodies where required

  • document the breach and response

  • update safeguards to prevent recurrence

Saskatchewan IPC guidance recognizes that privacy breaches may involve unauthorized collection, use, or disclosure; inaccuracy; missing information; or unauthorized access.

19. Complaints or Concerns

Clients may ask questions or raise concerns about privacy at any time.

Privacy concerns should be directed to “Contact Me”.

Clients may also contact the appropriate professional regulator, privacy commissioner, or legal authority if they believe their privacy rights have not been respected.

20. Policy Review

This policy will be reviewed at least annually or when there are changes to:

  • law

  • professional standards

  • practice platforms

  • website tools

  • booking or payment systems

  • insurance requirements

  • service delivery format

  • privacy risks