Effective 26 September 2026.
Who we are
MedRehab Group operates physiotherapy and rehabilitation clinics in Ontario. As a health information custodian under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA), we are responsible for the personal health information we collect about you. Information you give us as a website visitor that is not about your health is handled under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Our Privacy Officer is Alex Giambagno. You can reach Alex by email at [email protected], by phone at (905) 264-6311, or by mail at MedRehab Group, Attn: Privacy Officer, 8333 Weston Road, Suite B05, Woodbridge, ON L4L 8E2.
What we collect
- When you are a patient: your name, contact details, date of birth, health card and insurance details, your health history, and the records of your assessments and treatment. This is personal health information.
- When you use this website: what you type into our forms (name, contact details, the clinic and service you are asking about), and technical information about your visit such as pages viewed, the page that brought you here, and the device and browser you use.
- When you call us: calls to our clinics may be recorded for quality, training and to follow up missed calls. Calls to our new-patient line are answered by an automated assistant that helps direct you to the right clinic.
- When you leave feedback: the score and any comment you give after a visit, and public reviews you post on Google.
How we use it
We use your personal health information to provide and coordinate your care, to communicate with you about appointments, to bill you or your insurer, to meet our obligations to our regulatory colleges and to the law, and to run and improve our clinics. We use website information to answer your enquiry, to understand how the site is used, and to measure our advertising.
To understand how our clinics are performing, we keep a reporting database that is separate from your clinical record. It holds appointment and attendance information only. Your name, contact details, date of birth and clinical notes are never stored in it, and each patient is represented by a code that cannot be traced back to you from that system.
Consent
Within your circle of care we rely on your implied consent to share your information with the people treating you. We ask for your express consent before we use your contact details for anything else, including news and offers from our clinics. You may withdraw consent at any time by telling your clinic or our Privacy Officer; this will not affect the care you receive, except where the law requires us to keep or share information.
Marketing emails and text messages are sent in line with Canada’s Anti-Spam Legislation (CASL). Every message identifies us and includes an easy way to unsubscribe: the link in any email, replying STOP to any text, or contacting your clinic.
Who we share it with
We do not sell or rent your information. We share it only with the people treating you, with your insurer or WSIB when you make a claim, where the law requires, and with service providers who work on our behalf under agreements that limit what they may do with it:
| Provider | What they do for us | Where the information is held |
|---|---|---|
| Juvonno, our practice management system | Clinical records, scheduling, billing and appointment reminders | Canada; reminder emails and texts may pass through providers in the United States |
| Clinic Launchpad | Operates our website, patient feedback and reporting systems on our behalf | Ontario, Canada |
| Hostinger | Hosts our website, website forms, patient feedback platform and reporting server | United States |
| CallHero | Call tracking, call recording and missed-call follow-up for our clinic phone lines | Canada |
| Vapi | Automated assistant on our new-patient phone line; recordings and transcripts are deleted after 30 days | United States |
| Brevo | Sends our clinic newsletters and text messages to people who have consented, receiving only the name, email address or mobile number, clinic and roughly when they last visited (for example, within the last six months). For new patients it also receives the date they joined and the date of their first visit, so welcome messages arrive at the right time. It receives nothing else | European Union |
| Cloudflare | Protects our website and secures access to our internal reporting dashboards | Global network |
| Business email (including website form notifications), website analytics and advertising measurement | United States |
Where information is held outside Ontario, it may be subject to the laws of that country. We choose providers with strong safeguards and contractual limits on how they may use your information.
How we protect it
Clinical records are held in a system built for health care, with access limited to your care team and the administrative staff who need it. Our reporting data is de-identified as described above, held and backed up in encrypted form, and accessible only to named managers who sign in with a one-time code, with every access logged. Our staff are trained in privacy and bound by confidentiality obligations. If a privacy breach affects you, we will notify you and, where required, the Information and Privacy Commissioner of Ontario.
How long we keep it
We keep clinical records for as long as our regulatory colleges require, which is at least ten years from your last visit or, for patients under 18, at least ten years from your 18th birthday, and then destroy them securely. Website enquiries are kept only as long as we need them to respond to you and to keep a record of our communication. Recordings and transcripts from our automated new-patient line are deleted after 30 days. Backups of our reporting data are kept for 14 days.
Cookies and analytics
Our website uses cookies that it needs to work, and Google Analytics and Google Ads measurement to understand how visitors use the site and which advertising brings them to us. This information is about your visit, not your health. You can block or delete cookies in your browser settings, or opt out of Google Analytics with Google’s browser add-on at tools.google.com/dlpage/gaoptout. We do not use visits to health-related pages to target advertising to you.
Your rights
You may ask to see your personal health information, request a copy, and ask us to correct anything that is inaccurate or incomplete. Write to our Privacy Officer; we respond within 30 days, and may charge a reasonable fee for copies. If you are not satisfied with how we have handled your information or your request, you may complain to our Privacy Officer and, if it is not resolved, to the Information and Privacy Commissioner of Ontario, 2 Bloor Street East, Suite 1400, Toronto ON M4W 1A8, 1-800-387-0073, www.ipc.on.ca.
Children
We collect information about patients under 16 with the consent of a parent or guardian, except where the young person is capable of consenting to their own treatment under Ontario law. This website is not directed at children.
Changes to this policy
We review this policy at least once a year and post any changes here with the date they take effect. This version is effective 26 September 2026.
Contact us
Alex Giambagno, Privacy Officer
MedRehab Group
8333 Weston Road, Suite B05, Woodbridge, ON L4L 8E2
Phone: (905) 264-6311
Email: [email protected]