Privacy Policy (Patient)

Greenspace Mental Health Ltd. (“Greenspace”, “we” or “our”) provides a digital platform that facilitates: (i) the measurement of patient progress and outcomes; (ii) the display of measurement information to patients and their health care provider(s); and (iii) other functions, tools and resources for the purpose of supporting the delivery of mental health care services (collectively, the “Services”). We know that the users of our Services are entrusting us with personal and sensitive information and the privacy of our users is extremely important to us. We are committed to protecting privacy and safeguarding personal information.

Patients (as defined below) who create their own account to use our Services must accept this Privacy Policy as part of the account registration process. For all other Authorized Users (as defined below) by using the Services or otherwise providing us with personal information, you consent to our collection, use and disclosure of such personal information in accordance with the terms of this Privacy Policy. If you do not agree with the terms and conditions of this Privacy Policy, please do not use our Services.

If you have any questions or concerns regarding this Privacy Policy, please don’t hesitate to contact us at support@greenspacehealth.com.

Plain Language Summary

While this summary is not exhaustive, here are some of the key provisions in this Privacy Policy that you should be aware of:

1. We are a service provider to our customer: In providing our Services, Greenspace acts as an electronic service provider to healthcare organizations or individual therapists, who are our Customers. All personal information (including all personal health information) collected, used or disclosed by Greenspace is done in accordance with our agreement with our Customer, as reflected in this Privacy Policy.

2. You must be an authorized user of our customer: In order to use the Services, you must be an Authorized User (Administrator, Treatment Provider or Patient) of our Customer.

3. We collect and use only what is needed and with consent: We only collect and use personal information that is required to provide our Services on behalf of our Customer. This information is provided: (i) directly by you (in the case of Administrators, Treatment Providers and Patients who create their own accounts); (ii) indirectly and with your consent by your Treatment Provider or an Administrator, in the case of Patients where a file is created on their behalf but are not invited to create an account; or (iii) indirectly by your parent, legal guardian or substitute decision-maker if you are a minor Patient without the capacity to consent.

4. We do not trade, rent or sell personal information: We will not disclose, trade, rent, sell or otherwise transfer your personal information, without your consent, except as otherwise set out in this Privacy Policy.

5. We safeguard your information: We have implemented reasonable administrative, technical and physical measures to safeguard personal information. All personal health information is stored and processed in Canada. We securely dispose of or de-identify personal information once it has served its purpose, in accordance with applicable law.

6. Contact us: You can contact us at anytime to exercise your privacy rights, as described below. Since we are processing your personal information in our capacity as a service provider, certain requests will be forwarded to our Customer for response.

This Privacy Policy describes how Greenspace collects, uses and discloses your personal information. It applies to any personal information that is collected by us for the purposes described in this Privacy Policy. It applies whether such information is collected electronically, in person, over the telephone, in writing, via email messages, or via your use of any website or other platform (each referred to as a “Site”) on which this Privacy Policy appears. We may provide additional “just-in-time” disclosures or additional information about our data collection, use and sharing practices. These notices may supplement or clarify our Privacy Policy or may provide you with additional choices about how we will process your personal information.

For additional information regarding our privacy practices, including on our website, please see the Website Privacy Policy.

Access to the Services

In providing the Services, Greenspace acts as an electronic service provider to our customers, such as healthcare organizations or individual therapists (“Customers”), who may be classified as health information custodians, custodians or trustees of personal health information as such terms are defined in applicable privacy statutes. In our capacity as an electronic service provider, Greenspace supplies services for the purpose of enabling our Customers to use electronic means to collect, use, modify, disclose, retain or dispose of personal information (including personal health information). Our collection, use and disclosure of your personal information is done in accordance with our agreement with our Customer, which is reflected in this Privacy Policy.

You are entitled to use the Services if you fall within one of the following categories of authorized users of our Customer:

• supervisors, managers or administrators of the Customer that do not provide direct clinical treatment for Patients (each, an “Administrator”)
• treatment providers, therapists or clinicians of the Customer, (including, but not limited to, psychiatrists, psychologists, social workers, occupational therapists, and psychotherapists) (each a “Treatment Provider”)
• individuals with whom the Customer or its Treatment Provider(s) have a clinical health care relationship for whom a file has been created on the Site (whether such file has been opened by: (i) that individual; (ii) a Treatment Provider or Administrator for that individual; or (iii) a parent or legal guardian of that individual for that individual or themselves) (each, a “Patient” and collectively, with Administrators and Treatment Providers, the “Authorized Users”).

Patients receiving mental health services from a Treatment Provider may receive additional information regarding access, use and disclosure of their personal information from their Treatment Provider or an Administrator.

What is Personal Information?

For the purpose of this Privacy Policy, “personal information” means any information that could be reasonably used on its own, or in combination with other information, to identify an individual or as otherwise defined under applicable privacy statutes. “Personal health information” is a subset of personal information. It may be defined differently under applicable privacy statutes but generally refers to any identifying information about an individual’s physical or mental condition, including family medical history; the provision of health care to the individual; and a plan of service for the individual. It may also include the individual’s eligibility for health care coverage and the individual’s health number issued by the applicable governmental authority, as well as the identity of a health care provider(s) and a substitute decision-maker(s) for the individual.

What is De-identified Information?

Information that has been de-identified, aggregated and/or anonymized in accordance with applicable law so that it does not identify an individual (collectively referred to as “De-identified Information”). Any De-identified Information within Greenspace’s control will not be used by us, either alone or in combination with other information, to identify a specific individual.

We use De-identified Information we receive from responses to assessments, feedback on our Services and the frequency and way you use our Services for certain purposes, including: (i) to improve our Services; (ii) to publish data and/or information regarding our Services through various media platforms and academic journals; and (iii) for marketing purposes. None of this information will identify or be linked back to any Patients, other Authorized Users or Customers.

How We Collect and Use Your Personal Information

Below is a summary of the ways we collect and use your personal information:

• Creating an Account:
• In order to use the Services, each Authorized User must create an account, or in the case of some Patients, (i) have a file created for you by an Administrator or Treatment Provider; and/or (ii) have an account created on your behalf by a parent or legal guardian if you are a minor.
• The information required to create an account for Administrators and Treatment Providers consists largely of business contact information such as your first and last name, title/designation, work email address, work phone number and password.
• Patient information required to create an account include first and last name, email address, phone number and password, as well as additional personal information and personal health information set by our Customer.
• Delivery of Assessments: In order to deliver assessments to Patients, we use a Patient’s name, email address, phone number, as set by the preferences in the Patient’s user account, to send a link to the personalized assessment(s).
• Completing Personalized Assessments: We collect personal health information from Patients such as responses to assessment questions and quantitative assessment scores when Patients respond to a personalized assessment delivered by Greenspace. We use this information to provide Patients and their Treatment Provider(s) with a display of assessment responses and a presentation of progress.
• Interacting With You: When any Authorized User contacts us with a comment, question or complaint, you may be asked for personal information that identifies you such as your name, address, email address and a telephone number along with any additional information we may need to promptly answer your question or respond to your comment or complaint. We use this personal information to respond to your inquiry and improve our Services’ offerings.
• Sharing our Newsletter and Other Updates: If you are an Administrator or Treatment Provider, we may use your name and email address, in accordance with applicable law, to provide you with copies of our newsletter or other updates about our Services that we believe may be of interest to you. You can unsubscribe at any time by clicking on the unsubscribe link included in every email or by contacting us as set out below under the “Contact Us” heading. We do not send newsletters or Site updates to Patients.

Sharing or Disclosure of Personal Information

We will not disclose, trade, rent, sell or otherwise transfer your personal information, without your consent, except as otherwise set out in this Privacy Policy.

• Authorized Service Providers: In order to provide our Services, we have arrangements with our affiliated companies or certain necessary service providers that are subject to contractual agreements that include appropriate privacy standards. We may transfer (or otherwise make available) your personal information to such affiliates and other third party service providers for the purpose of enabling such parties to provide certain services on our behalf. Our affiliates and service providers are given only the information they need and solely for the purpose of performing their designated functions, and are not authorized to use or disclose personal information for their own marketing or other purposes. For example, we may use service providers to authorize and process payments, host our Site, deliver assessments, operate certain of its features, send email or other communications, and manage and analyze data.
• Sale of Business: In the event of a sale of our business, the use of your personal information by the new entity would continue to be governed by this Privacy Policy and limited by applicable law. Personal information may be provided to a potential acquiror in connection with a merger or sale involving all or part of our company (including transfers made as part of insolvency or bankruptcy proceedings) or as part of a corporate reorganization or stock sale or other change in corporate control, including for the purpose of determining whether to proceed or continue with such transaction or business relationship, in accordance with applicable law.
• Legal, Compliance and Loss Prevention: Greenspace, our affiliates and our service providers may be required to provide your personal information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable law. Your personal information may also be disclosed where necessary for the establishment, exercise or defence of legal claims and to investigate or prevent actual or suspect loss or harm to persons or property.

Safeguards and Retention

We have implemented reasonable administrative, technical and physical measures in an effort to safeguard the personal information in our custody and control or that we process on behalf of our Customers to protect against theft, loss and unauthorized access, use, modification and disclosure.

Such measures, which may necessarily evolve over time as the availability and effectiveness of methods vary, include physical, organizational and technological safeguards, such as:

• restricting access to personal information to employees, contractors and service providers who require access to fulfill their job or services, are bound by confidentiality and non-disclosure requirements and who are required to abide by this Privacy Policy and Greenspace’s privacy and security policies;
• restricting access to our systems, accounts and electronic databases or other electronic formats that may contain personal information through password protection and internal security policies; and
• implementing technical security measures such as firewall technology, anti-malware screening and data encryption technology.

While Greenspace employs advanced data encryption technology when interfacing with our users, third party service providers and other partners, you should be aware that there is a residual risk in transmitting any data electronically. Despite our efforts, no security measures are perfect or impenetrable and no method of data transmission can be guaranteed against any interception or other type of misuse. This risk is inherent in all Internet dealings.

We have personal information retention processes designed to retain personal information for no longer than necessary for the purposes stated above or to otherwise meet legal requirements. We securely dispose of or de-identify personal information once it has served its purpose, in accordance with applicable law.

Storage and Processing of Personal Information

All personal health information is stored and processed in Canada.

Other types of personal information (for Authorized Users other than Patients) may be stored or processed by Greenspace or our authorized service providers in the U.S. or another foreign jurisdiction outside of Canada. When this occurs, your personal information may be accessible without notice to you by the courts, law enforcement and national security authorities of that jurisdiction. You can obtain more information about our policies and practices with respect to the use of third party service providers outside of Canada by contacting us as described below, under “Contact Us”.

Personal Information of Minors

We do not knowingly collect personal information of minors (as defined by applicable law), unless such minors have the capacity at law to consent to the collection, use and disclosure of their personal information, or with the consent of their parents, legal guardians or substitute decision-makers. Minors may only register for an account on our Services, if/when a Treatment Provider or Administrator has created a file on behalf of the minor and a parent, legal guardian or substitute decision-maker has created a participant account, which then permits the minor to create an account and participate on the Service. If you become aware that a minor has provided us with his/her personal information without appropriate capacity or consent, we encourage the parent, legal guardian or substitute decision-maker to contact us to have this information removed from our records.

Your Privacy Rights

You have the right to access, update and correct inaccuracies in your personal information, subject to certain exceptions prescribed by law. You may also withdraw your consent to our collection, use or disclosure of your personal information, however, in accordance with applicable law, such withdrawal of consent will not have retroactive effect.

You may exercise the above rights or raise any questions or concerns about our privacy policies and practices by emailing us at the contact information set out below. We may request certain personal information for the purposes of identify verification. Other than responding to customer support requests such as password resets, since Greenspace is acting in the capacity as a service provider, we will forward requests for the exercise of user rights under privacy laws (i.e., access to or rectification of personal information and withdrawals of consent) to our Customer for response to you.

Third Party Links

The Site may contain links to third party platforms. While we try to link only to platforms that share our high standards and respect for privacy, please understand that we are not responsible for the content of, or the privacy practices employed by, other platforms and this Privacy Policy does not apply to those platforms. We encourage you to review the privacy policies of each platform you visit.

Changes to the Privacy Policy

We may amend this Privacy Policy from time to time as our business evolves, in response to legal developments, as new technologies become available, or as we introduce new features, products or services.

When we make changes to this Privacy Policy we will revise the “Last Updated” date at the top of the policy. You should check back here periodically to find out if any changes have been made to this Privacy Policy. If we make substantial changes we will, as appropriate, prominently post these changes to our Site and notify registered users of our Services.

If you disagree with any change to the Privacy Policy, please refrain from using our Site or Services or otherwise providing us with your personal information. By continuing to use our Site or Services or by providing us with personal information after we post or communicate a change to the Privacy Policy, you will signify your consent to the revised terms of the Privacy Policy.

Contact Us

Please contact our Privacy Officer at support@greenspacehealth.com if:

• you have any questions or comments about this Privacy Policy;
• you wish to access, update or correct inaccuracies in your personal information;
• you wish to withdraw your consent to our collection, use or disclosure of your personal information as described in this Privacy Policy; or
• you otherwise have a question or complaint about the manner in which we or our service providers treat your personal information.

Since email communications are not always secure, please do not include sensitive information in your emails to us.

Last Update: April 8, 2022