Privacy Policy

Introduction

The purpose of this Privacy Policy is to inform you about the types of personal information Red Leaf Wellness (as follows, “Red Leaf Wellness” “we” or “us”) collects, uses and discloses. redleafwellness.ca (the “Website”) is a website owned by Red Leaf Wellness, with a registered address of 10623 129 Street NW, Edmonton, AB T5N1X2, Canada. This Privacy Policy sets out how we obtain and use the personal information which you provide us. As the legal environment, technology, and operations change, it may become necessary for us to make changes to this Privacy Policy and all such changes will be posted on the Website.

Our Privacy Commitment

At Red Leaf Wellness, we protect your privacy by:

  • Collecting only the personal information required to provide medical and wellness related services to you.
  • Advising you how your information might be disclosed and obtaining your consent.
  • Safeguarding your personal information.
  • Sharing your personal information only for the purposes stated and agreed to in a signed consent form or otherwise permitted by law.
  • Ensuring any contractors we hire who may have access to your information also protect the privacy of your information.
  • Training staff and adapting the office space to ensure maximum protection of your privacy.
  • Ensuring personal information is current, complete and accurate.
  • Providing you access to your personal information and a mechanism for requesting corrections.
  • Having our privacy officer available to answer your questions.
  • Periodically reviewing our privacy policy to ensure it provides adequate protection for your personal information.

Consent

Red Leaf Wellness handles two categories of information under different legal frameworks. Health information, such as your health history, treatments, and test results, is collected, used, and disclosed by Red Leaf Wellness as a custodian under Alberta’s Health Information Act (HIA), which authorizes and limits how that information may be handled in connection with providing health services and maintaining your health record. Other personal information, such as contact details used for newsletters, website interactions, payment for products and services, and images captured by video surveillance at our clinic, is handled in accordance with Alberta’s Personal Information Protection Act (PIPA) and, where applicable, federal privacy legislation.

Consent to the collection, use, and disclosure of personal information can be provided in several ways. Consent may be:

  • Expressed: For example, orally, electronically, or by completing a form you submit to us.
  • Implied: For example, when you provide information necessary for a service you have requested, or where we have notified you of our intentions regarding your personal information, and you have not withdrawn your consent (e.g., by using an “opt-out” option provided).
  • Provided by an Authorized Representative: For example, a legal guardian or someone with power of attorney.

By providing us with personal information, you are deemed to consent to its collection, use, and disclosure for the purposes identified in this Privacy Policy or as otherwise explained at the time of collection. You may withdraw your consent at any time, subject to legal or contractual obligations and reasonable notice. Please note that withdrawing consent for certain uses of your personal information may affect our ability to provide you with some services. Certain collections, uses, and disclosures of health information are authorized by the HIA and are necessary to provide care and maintain your health record; these are described in this Privacy Policy and in the privacy notice provided at intake.

We collect, use, and disclose your personal information only as described in this Privacy Policy or as otherwise permitted or required by law. In specific circumstances, we may collect, use, or disclose personal information without your consent, such as:

  • In response to a court order or subpoena;
  • To comply with local, provincial, or federal regulations; or
  • To collect a debt owed to us.

How We Gather Information

We may gather personal information in several different ways:

  • Through our Website and/or electronic health record sign-up/registration process;
  • Through the provision of medical or wellness services to you;
  • Through your orders of products and/or services;
  • Through providing support to our registered account holders and/or customers and/or potential customers;
  • Through video surveillance of our clinic reception area and select exterior locations, as described under “Video Surveillance at Our Clinic” below; and
  • Through your payment to third-party payment processors which we use.

Use of Analytics Tools

We partner with Microsoft Clarity to capture how users interact with our website through behavioral metrics, heatmaps, and session replays. This information helps us analyze user behavior to improve our website’s usability and services. Clarity is configured to mask the content of form inputs, so information you type into forms on our Website is not captured in session replays. Website usage data is collected using first-party cookies and other tracking technologies to determine the popularity of features and understand user engagement, and is used for site optimization only. We do not use this information for advertising. For more information on how Microsoft collects and uses data, please see the Microsoft Privacy Statement.

Information Collected

  • The personal information collected is required to provide you with medical and wellness services and facilitate payment for services rendered.
    • Contact information: your name, phone number, address, email address and an emergency contact person.
    • Health information: your health history, treatment received, names of other health-care providers, family medical history, your subjective complaints, objective findings, diagnoses, reason for discharge, and discharge plan.
    • Financial information: your insurance benefit coverage information, credit card information, employer’s name, and other information to facilitate payment for services provided.
    • Video surveillance images: images of individuals in our clinic reception area and at select exterior locations, collected for security purposes as described below.
  • Other Information – we also gather other information (“Other Information”), which cannot identify you unless it is used in conjunction with actual personal information. For example, we may collect your computer’s Internet Protocol address (i.e. IP address), browser type, browser version, the pages of our Website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data. We may receive and store certain information whenever you visit the Website. We may use your IP address to help diagnose problems with our server and to administer the Website, and to help identify you. Your IP address may also be used to gather broad demographic information, and for other purposes. Such Other Information cannot generally be used by us to identify you, and as such is not considered Personal Information.

Use of Artificial Intelligence (AI)

Red Leaf Wellness uses secure artificial intelligence (AI) tools in two limited ways: to assist providers with the documentation of your visits, and to process incoming documents into our electronic health record. AI does not make medical decisions and does not replace the judgment of your healthcare provider. All AI-generated or AI-processed content is reviewed and verified by an authorized person before it becomes part of your health record.

AI in Clinical Documentation

To support accurate, timely, and high-quality care, your provider may use AI tools to assist with documenting your visits. These tools may include real-time or post-appointment speech-to-text transcription, summarization of clinical notes, and assistance with organizing documentation and workflow. All notes generated or supported by AI tools are reviewed, corrected, and approved by your licensed healthcare provider before being finalized in your health record.

If you prefer that AI-assisted documentation tools not be used during your appointment, please inform your provider or our administrative team in advance. Manual documentation methods will be used instead.

AI in Document Processing

Red Leaf Wellness uses intelligent document processing (IDP) technology, provided by Documo, Inc. under a formal Information Manager Agreement, to read, classify, and file incoming faxed documents, such as laboratory results and reports, into our electronic health record system, JaneApp. This supports the accurate and timely maintenance of your health record and is performed under staff supervision. All AI-processed content is reviewed and verified by an authorized person before it is added to your record. Because this function is integral to maintaining your health record, it is not subject to patient opt-out.

We only use vendors who are bound by written Information Manager Agreements and who comply with applicable privacy and security laws, including Alberta’s Health Information Act (HIA) and Personal Information Protection Act (PIPA) and, where we provide virtual care to patients in other provinces, the applicable provincial health privacy legislation. Your information is never used to train, tune, or improve AI models, used for marketing purposes, or sold to third parties. AI-generated or AI-processed information in your health record remains subject to your rights of access and correction, described under “Accessing and Correcting Your Personal Information” below.

What Do We Use Your Information For?

  • We use contact information to open and update your patient file, invoice for services, remind you of appointments and/or the need for further treatment, and to provide informational materials about our clinic. We may also contact you to notify you of changes to our services, allow you to participate in interactive features of our services when you choose to do so, and to provide customer support. We may also provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about, unless you have opted not to receive such information
  • We use health information to assess, diagnose, provide, and evaluate medical and wellness treatments.
  • We use financial information to arrange payment for services rendered.
  • We use video surveillance images only for the security purposes described under “Video Surveillance at Our Clinic” below.
  • We use Other Information to:
    • To provide and maintain our Website and to provide you with our goods and/or services.
    • To gather analysis or valuable information so that we can improve our services
    • To monitor the usage of our Website and to track our customer’s ordering of products or services
    • To detect, prevent and address technical issues.

How Do We Protect Your Personal Information?

  • We are a paperless clinic. We store all electronic records on secured hardware, use antivirus software and passwords on all computers and take care to protect screen monitors from public viewing.
  • We transfer digital records outside our office by secure methods and are made anonymous wherever possible.
  • We conduct telephone discussions with sensitivity to ensure that your personal information is not inadvertently disclosed.
  • We do not share your personal information outside our office for any marketing, promotional, publicity, educational, or research purposes without your consent.
  • We train staff to handle your information only through the protected measures outlined in our privacy procedures. If consultants or contractors are hired, we take steps to ensure the consultant or contractor also protects your privacy

With Whom Do We Share Your Information?

  • Contact information – may be disclosed to third-party health benefit providers/insurers when reimbursement claims for all or part of the treatment cost have been submitted.
  • Health information – may be disclosed to:
    • Third-party health benefit providers and insurance companies when a claim is submitted for reimbursement or payment of all or part of the cost of treatment or we have been asked to submit a claim on your behalf.
    • The WCB or your employer if you made a WCB claim.
    • Other health-care professionals also providing you with treatment.
    • Your lawyer, if you were injured in an accident.
    • Research teams in an anonymous form to facilitate outcome research.
  • Financial information – may be disclosed to your insurer or credit card company as required to facilitate payment.
  • Video surveillance images – may be disclosed to law enforcement, our insurer, or our legal counsel in connection with an investigation, claim, or legal proceeding, or where required by law.
  • Service Providers – we may employ third-party companies and individuals (“Service Providers”) to facilitate our website, clinical operations, and business functions. These service providers may assist us by managing administrative tasks, scheduling, communications, billing, or technical support, in addition to marketing, analytics, content management, and payment processing.

    Service providers have access only to the information required to perform their specific functions on our behalf and are not permitted to use that information for any other purpose. All service providers are bound by confidentiality obligations and contractual safeguards consistent with Alberta’s privacy legislation, including the Personal Information Protection Act (PIPA) and, where applicable, the Health Information Act (HIA). Red Leaf Wellness maintains Privacy Impact Assessments (PIAs) and Information Manager Agreements (IMAs) with vendors that handle health information on our behalf, to ensure appropriate protection and lawful handling of that information.

Note: Personal information can also be disclosed without your consent if we are required to do so by law. We may also release such information if we feel it is necessary in order to protect our rights or the rights of our customers, affiliates, partners, or any other party, and for purposes of protection from fraud and credit risk. We may disclose your personal information in the good faith belief that such action is necessary to:

    • To comply with a legal obligation
    • To protect and defend our rights or property
    • To prevent or investigate possible wrongdoing in connection with our service
    • To protect the personal safety of users of our service or the public
    • To protect against legal liability

Virtual Reception, Administrative Support, and Global Workforce

We partner with CallHero, a Canadian company that provides reception and administrative support to healthcare organizations in Canada and internationally. CallHero’s global workforce assists our clinic with scheduling, reception, and communication tasks through secure, encrypted systems. All access is limited to the minimum information required, follows Alberta’s Personal Information Protection Act (PIPA) and Health Information Act (HIA), and is governed by our approved Privacy Impact Assessment and Information Manager Agreements.

Video Surveillance at Our Clinic

Our reception area and select exterior locations at our Edmonton clinic are under visible video surveillance. These cameras record video only. They do not record audio.

Surveillance recordings are collected to deter and investigate theft, to protect the safety of our patients and staff, and to identify individuals who behave disruptively or cause damage to clinic property. Surveillance is not used in treatment rooms, classrooms, restrooms, or any other area where privacy is expected. Signage identifying the surveillance and its purposes is posted at our entrance and in the reception area.

Recordings are retained for up to 30 days, unless a longer period is required in connection with a law enforcement, insurance, or legal matter. Recordings are encrypted in transit and at rest. Access is restricted to authorized members of our leadership team, and accounts are protected by multi-factor authentication.

Our video surveillance service provider, Arlo Technologies, Inc., is located in the United States, and recordings are stored and processed in the United States. Information stored in the United States may be subject to access by United States courts, law enforcement, and government authorities under the laws of that country. Arlo is authorized to store and process these recordings solely to provide the surveillance service to us, and is not permitted to use them for any other purpose.

You may obtain written information about our policies and practices respecting our use of service providers outside Canada, and ask any questions about this arrangement, by contacting our Privacy Officer, Daniel Lalonde, at privacy@redleafwellness.ca.

Photography, video recording, and audio recording by patients and visitors are not permitted on our premises.

Information Stored Outside Of Alberta

We take all reasonable steps to ensure your information is treated securely and in accordance with this Privacy Policy. Except as described in this Privacy Policy, we do not transfer or store health information outside of Canada unless adequate privacy and security controls are in place, including compliance with Alberta’s Personal Information Protection Act (PIPA), the Health Information Act (HIA), and our approved Privacy Impact Assessment and Information Manager Agreements.

Documents sent to or received through our fax and document processing provider, Documo, Inc., are hosted on secure cloud infrastructure located in Canada. Intelligent document processing of incoming documents may occur temporarily in the United States, limited to the minimum extent and time needed to perform the service, under an Information Manager Agreement that includes the safeguards required under Alberta’s Health Information Act and its regulations, including encryption, access controls, and mandatory deletion once processing is complete.

Video surveillance recordings from our Edmonton clinic are stored and processed in the United States by Arlo Technologies, Inc., as described under “Video Surveillance at Our Clinic” above.

Our operational preference is always to contract with Canadian service providers whenever possible. However, in some cases, trusted service partners may use a global workforce or access limited information from outside Canada to support administrative or technical functions. Any such access occurs through secure, encrypted systems and is restricted to the minimum information necessary. These arrangements are governed by contractual and technical safeguards designed to provide protections equivalent to those required under Alberta law.

Although rare, personal information may be accessed or processed from outside your province, country, or other jurisdiction where data protection laws may differ from those in Alberta. For further information about our storage or access practices outside of Canada, or about Red Leaf Wellness’s policies and safeguards for such access, please contact our Privacy Officer using the details at the end of this Privacy Statement.

If you are located outside Canada and choose to provide information to us, please note that we transfer the data, including Personal Data, to Canada for processing and storage in accordance with this Privacy Policy.

Accessing And Correcting Your Personal Information

You can get access to view your personal information by asking a staff member who may refer you to our privacy officer. We will attempt to help you understand the reasons we collect, store and use the information in your records. You may request a change to your personal information if it is inaccurate, incomplete, no longer current, or if you believe there is a factual mistake. You can also request a copy of your patient record. Requested copies will be provided in a reasonable period. If there is a charge for the cost of producing a copy, we will advise you of the cost in advance.

Your rights of access and correction apply to all information in your record, including information that was generated, drafted, or processed with the assistance of AI tools and subsequently reviewed and approved by our team.

How Long Is Information Kept?

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. We are required by legislation to keep all health records containing personal information for 10 years from the last date of service. Or in the case of a minor, 10 years past the minor’s eighteenth birthday. After that time, we destroy the records. When discarding hardware, we ensure the hard drive is destroyed.

Video surveillance recordings are retained for up to 30 days, as described under “Video Surveillance at Our Clinic” above.

We may also retain Other Information for internal analysis purposes. Other Information is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our services, or we are legally obligated to retain this data for longer time periods.

Marketing, Cookies, and Website Analytics

  • Marketing Communications – We may use your contact information to send you newsletters and information about our programs, services, and events that may be of interest to you. You may opt out of receiving any, or all, of these communications by following the unsubscribe link or instructions provided in any email we send, or by emailing us at info@redleafwellness.ca. We do not use health information for marketing, we do not sell personal information, and we do not use behavioural remarketing or interest-based advertising technologies on our Website.
  • Our Use of Cookies and Web Beacons – Non-personal information and data may be automatically collected through the standard operation of our Website’s internet servers or through the use of “cookies”. Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. Examples of Cookies we may use:
    • Session Cookies. We use Session Cookies to operate our Website.
    • Preference Cookies. We use Preference Cookies to remember your preferences and various settings.
    • Security Cookies. We use Security Cookies for security purposes.
  • Log Files – As with most other websites, We collect and use the data contained in log files. The information in the log files may include your IP address, your ISP, the browser you used to visit Our Website, the time you visited our Website and which pages you visited throughout our Website.
  • Analytics – We may use third-party Service Providers to monitor and analyze the use of our Website, such as Microsoft Clarity (described under “Use of Analytics Tools” above) and Google Analytics. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. You can opt out of having your activity on the Website made available to Google Analytics by installing the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en.
  • External Links – The Website may contain links or references to other websites to which this Privacy Policy does not apply. These sites are not owned or controlled by us and We are not responsible for the collection, use and disclosure of personal information or the privacy practices of other organizations or other websites to which our site may refer visitors or provide links for. When submitting Personal Information on such other websites, we encourage you to read the privacy policy of those sites.

Children’s Privacy

Our Website is not directed at children, and we do not knowingly collect personal information from children through the Website. Persons under the age of majority in their jurisdiction should ask a parent or legal guardian for permission before sending any information about themselves through the Website or to our payment processors. As a healthcare clinic, we do provide care to minors; health information about minor patients is collected through our clinical intake process with the consent of a parent or legal guardian, or as otherwise permitted by law, and is protected in the same manner as all other health information we hold. If you believe a child has submitted personal information to us through the Website without appropriate consent, please contact our Privacy Officer and we will take steps to address it.

Transfer of Customer Information

Customer information is a valuable business asset. If for any reason we transfer or divest ourselves of our business assets, our customer information may be transferred as one of these business assets. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

Security of Data

The security of your data is important to us. However, please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. Although we take strong precautions to safeguard your personal information, when you voluntarily disclose personally identifiable information (such as your name, email address, or telephone number) on our website or through other digital channels (including text message or web chat) that do not encrypt or otherwise secure that information beyond standard web server technology, any substantive information disclosed in those communications may be vulnerable to unauthorized collection by third parties. Such activity is beyond our control.

If you transmit personal information to us over a non-secure channel, we may require that future communications occur through our secure messaging system to protect your information. We will provide you with instructions on how to do so at that time.

Red Leaf Wellness maintains Privacy Impact Assessments (PIAs) and Information Manager Agreements (IMAs) with vendors that handle health information on our behalf, to ensure that information is handled in accordance with Alberta’s privacy legislation and our clinic’s approved privacy and security framework.

Where data may be accessed from outside Canada, we ensure equivalent protections through encryption, role-based access controls, and contractual obligations that meet or exceed the privacy and security standards required under Alberta law.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Updated versions will be posted on this page, and the “Last updated” date below will be revised accordingly. Where a change is significant, we may also highlight it on relevant program pages or in our newsletter. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

More information

If you have a concern or question about how your personal information is handled, please speak with the clinician providing your care or a member of our administrative team. If your concern is not resolved, you may contact our Privacy Officer in writing at:

Daniel Lalonde, Privacy Officer
Email: privacy@redleafwellness.ca

We will review your inquiry promptly and respond in accordance with Alberta’s privacy legislation.

This Privacy Policy and the practices described herein are reviewed and updated periodically to reflect operational and regulatory changes. This statement and the policies outlined herein are not intended to, and do not, create any contractual or other legal rights on behalf of any party.

Last updated: 2026-08