Your information deserves a clear framework.

1. Scope and Privacy Officer

This policy applies to personal information collected by Judy Turcotte, S.W., through her private practice and judyturcotte.com. Judy Turcotte is the Privacy Officer. For questions, requests, concerns or complaints, email [email protected].

2. Information collected and collection methods

The contact form collects information you choose to provide: first name, last name, email address, preferred language, general reason for contacting and message. First name, email and message are required to send and process the request; other fields are optional. A reason or message may reveal sensitive information. Do not enter a diagnosis, health insurance number, detailed clinical information or information about another person.

Information may also be collected by email, telephone or video call. If professional services begin, information needed for the social functioning assessment, intervention plan, professional record, billing, receipts and clinical safety is collected separately within the professional setting.

Technical providers may generate operational and security information such as IP address, connection date and time, browser type and error logs.

3. Purposes and consent

Initial contact information is used only to respond, assess service fit, confirm Quebec residency, arrange an introductory call or session and provide administrative follow-up. Professional-record information is used to provide services, meet ethical and legal duties, issue receipts and handle billing.

The form is submitted only after your express consent. You may choose not to use it and email a minimal callback request instead. Without the required information, the online request cannot be processed. Information is never sold or rented and is not used for profiling, behavioural advertising or fully automated decisions.

4. Access and disclosure

Within the practice, access is limited to Judy Turcotte and, when necessary, providers processing information on her behalf. Cloudflare hosts the site. Web3Forms receives and routes form submissions. The email provider receives the resulting email. The secure clinical platform used after initial contact separately processes professional information. Providers may use the information only to deliver their services, subject to their legal obligations.

Information may also be disclosed without consent where authorized or required by law, including to prevent an act of violence involving a serious risk, protect a child, comply with a valid order or manage a privacy incident.

5. Processing outside Quebec

The current form uses Web3Forms, whose servers are in the US East region. According to Web3Forms documentation, free-plan submissions are retained for 30 days. Cloudflare, the email provider and their subprocessors may also process information outside Quebec or Canada, where it may be subject to local law.

Before entrusting information outside Quebec, the practice must assess privacy factors and ensure adequate protection. In the meantime, the form is limited to general initial contact and must never be used for detailed clinical or urgent information.

6. Retention and destruction

Web3Forms states that free-plan submissions are retained for 30 days. If no professional relationship begins, initial-contact messages held by the practice are deleted no later than 12 months after the request is closed, unless required for a legal obligation or dispute. If services begin, relevant information is added to the professional record and retained for at least five years after the last professional service, in accordance with the rules applicable to OTSTCFQ members. Information is then securely destroyed, subject to legal retention duties.

7. Security and incidents

Safeguards are proportionate to information sensitivity and include HTTPS transmission encryption, restricted access, protected accounts and a separate clinical platform. No system can provide absolute security.

Privacy incidents are assessed, entered in the required register and addressed to reduce risk. Where an incident creates a risk of serious harm, the Commission d’accès à l’information and affected individuals are notified as required by law.

8. Cookies, fonts and analytics

The site does not install advertising or behavioural analytics tools. Cloudflare may use technical cookies and logs necessary for security and operation. Fonts load from Google Fonts; that request may send technical information, including an IP address, to Google. External sites apply their own policies when you follow a link.

9. Your rights and complaints

You may ask what information is held about you, access it, have it corrected or updated, withdraw consent where the law allows and, where applicable, receive computerized information in a structured, commonly used technological format. Withdrawal does not affect prior lawful processing, and some information must be retained for professional or legal duties.

Email [email protected] with “Personal information protection” in the subject line. Your identity may be verified. Requests and complaints are handled confidentially within applicable legal time limits. You may also contact the Commission d’accès à l’information du Québec.

10. Changes

This policy is reviewed when practices or providers change. Material changes are clearly identified on the site and the date above is updated.

Reference framework: Commission d’accès à l’information du Québec — private organizations, Act respecting the protection of personal information in the private sector and the professional record-keeping regulation.