Home/Privacy Policy
Effective Date: April 20, 2026|Last Updated: April 20, 2026
PHIPA and PIPEDA Compliance Statement
WOXY Health Inc. is a health information custodian operating in Ontario under the Personal Health Information Protection Act (PHIPA, S.O. 2004, c. 3, Sched. A) and the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose personal health information (PHI) only with your consent or as expressly permitted by law.
WOXY Health Inc. has designated a Privacy Officer responsible for overseeing compliance with PHIPA and PIPEDA, and for handling all inquiries, requests, and complaints relating to personal health information.
WOXY Health Inc.
Privacy Officer
Unit 356, 4750 Yonge Street
Toronto, ON M2N 0J6, Canada
Email: privacy@woxy.ca
Phone: +1 365-698-5115
Response Time: Within 30 calendar days of receiving your request
Under PHIPA s.4, "personal health information" (PHI) means identifying information about an individual that relates to their health. We collect only the minimum information necessary to provide our services.
Under PHIPA s.29, a health information custodian may use PHI only (a) with the individual's consent, or (b) as expressly permitted by law. We use your PHI for the following purposes:
Important: We do not use your PHI for marketing purposes and do not sell or share it with third parties without your explicit consent.
Under PHIPA ss.18-20, we must obtain your informed consent before collecting, using, or disclosing your PHI. Consent must be voluntary, specific, and based on adequate information.
We require your express consent for:
You may withdraw consent for the use or disclosure of your PHI at any time, except where (a) law requires us to retain or use the information, or (b) withdrawal would affect our ability to provide care and you have been informed of that consequence.
To withdraw consent, contact our Privacy Officer in writing at privacy@woxy.ca. We will confirm your request within 30 days and explain any consequences.
We do not sell your personal health information. Under PHIPA ss.38-41, we disclose PHI only in the following circumstances:
We may share PHI with service providers acting as our agents, who are contractually bound to use PHI only as directed by us and subject to equivalent privacy protections:
Under PHIPA ss.43-45, we may disclose PHI without consent in limited circumstances including:
We retain your personal health information in accordance with PHIPA and applicable Ontario regulations. The following are our retention schedules:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Personal health records | 10 years from date of last service | PHIPA s.13; O. Reg. 329/04 |
| Minor health records | 10 years from 18th birthday | PHIPA s.13; O. Reg. 329/04 |
| Account and contact information | 7 years after account closure | PIPEDA; CRA requirements |
| Transaction and billing records | 7 years | Income Tax Act; CRA |
| Consent records | Duration of consent plus 7 years | PHIPA s.18 |
| Breach incident records | 2 years from incident | PHIPA s.12.2 |
| Marketing preferences | Until consent withdrawn or deletion requested | CASL; PIPEDA |
Upon expiry of retention periods, we will securely destroy or anonymize your information.
Your personal health information is primarily stored on servers located within Canada. PHIPA requires health information custodians to ensure PHI transferred or stored outside Canada receives equivalent protection.
Our Data Storage Arrangements
If your information must be transferred outside Canada, we will ensure appropriate contractual safeguards are in place and will notify you in advance where feasible.
Under PHIPA ss.52-55 and PIPEDA, you have the following rights regarding your personal health information. To exercise any right, contact our Privacy Officer at privacy@woxy.ca. We will respond within 30 calendar days.
Right to Access (PHIPA s.52)
You have the right to request access to a copy of the PHI we hold about you. We will provide access within 30 days or explain any legal exceptions.
Right to Correction (PHIPA s.55)
If you believe PHI we hold is inaccurate or incomplete, you may request a correction. If we disagree, we will attach a statement of disagreement to the record.
Right to Accounting of Disclosures (PHIPA s.54)
You have the right to receive a list of disclosures of your PHI made without your consent in the past 3 years.
Right to Restrict Disclosure (PHIPA s.41)
You may request that we restrict disclosure of your PHI to specific persons or organizations, even where such disclosure would otherwise be permitted.
Right to Withdraw Consent (PHIPA s.20)
You may withdraw consent for the use or disclosure of your PHI at any time, except for legally required uses.
Right to Complain
If you believe we have violated PHIPA, you may file a complaint with the Information and Privacy Commissioner of Ontario (www.ipc.on.ca, phone: 1-800-387-0073).
Under PHIPA s.12, we must take reasonable technical, administrative, and physical safeguards to protect PHI against unauthorized access, use, disclosure, modification, disposal, or destruction.
Under PHIPA s.12.2, if a privacy breach involving your PHI occurs and there is a real risk of harm to you, we must notify you as soon as reasonably possible.
Containment (Immediate)
Immediately investigate and take steps to contain the breach and prevent further unauthorized access.
Risk Assessment (24-72 hours)
Assess the scope of the breach, the type of PHI affected, and the real risk of harm to affected individuals.
Notify Affected Individuals (As Soon As Possible)
If there is a real risk of harm, we will directly notify affected individuals by email or phone, describing the nature of the breach, the PHI affected, and steps we have taken.
Report to IPC (Where Applicable)
Under PHIPA s.12.2, we will report significant breaches to the Information and Privacy Commissioner of Ontario.
Documentation (2 Years)
We maintain records of all breach incidents for a minimum of 2 years, including the nature of the breach, notification steps, and remediation actions.
We use cookies and similar technologies to collect non-health-related website usage information. Cookies are not used to collect PHI.
You can manage cookie preferences through your browser settings or our cookie consent tool on the website.
For health services involving minors (under 18), we require parental or legal guardian consent to collect and process PHI. Parents or guardians may exercise all PHIPA privacy rights on behalf of their children.
If you believe we have mistakenly collected information from a minor, please contact our Privacy Officer immediately at privacy@woxy.ca.
Our website may contain links to third-party websites. This Privacy Policy does not apply to those third-party services. We encourage you to review their privacy policies.
Key third-party services we use include:
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will post the updated policy with a new effective date and notify you in advance by email.
Your continued use of our services after changes take effect constitutes acceptance of the updated policy. If you disagree with any changes, please discontinue use and contact our Privacy Officer.
WOXY Health Inc. complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and adheres to the following 10 fair information principles:
WOXY Health Inc. is a health information custodian under the Personal Health Information Protection Act (PHIPA, S.O. 2004, c. 3, Sched. A). The following summarizes our key obligations under PHIPA:
2 Bloor Street East, Suite 1400
Toronto, ON M4W 1A8
Phone: 1-800-387-0073
Website: www.ipc.on.ca
我们使用 Cookie
我们使用 Cookie 分析网站流量并改善您的体验。您可以选择接受或拒绝非必要 Cookie。 了解更多
我們使用 Cookie 分析網站流量並改善您的體驗。 了解 Cookie 政策