Privacy Policy

All Brains Clinic provides multidisciplinary assessments and related care for children, youth and adults. To do that work, we collect personal information — including health information — from the people we assess, from their parents and guardians, from family members, and from referring physicians and other professionals.

We take that responsibility seriously. This policy explains what we collect, why we collect it, who we share it with, how long we keep it, how we protect it, and the rights you have over your own information.

This policy was developed to comply with British Columbia's Personal Information Protection Act (PIPA), which sets out the rules for how organizations in BC collect, use and disclose personal information, and with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

"Personal information" means information that can identify you, either on its own or combined with other information. For our clinic this includes things like your name, date of birth, contact details, the name of your referring physician, your billing and insurance information, and the health and assessment information we gather and produce. It does not include business contact information used solely to contact someone at their workplace.

1. Who is accountable

All Brains Clinic is accountable for the personal information under our control, including information handled on our behalf by staff, contractors and service providers.

Our Privacy Officer is:

Dr. Ali Eslami
Owner, Medical Director & Privacy Officer
All Brains Clinic
6205 West Boulevard, Vancouver, BC V6M 3X4
Email: [email protected]
Phone: +1 604-998-2244

2. What personal information we collect

We collect only what we need to provide our services. Depending on the service, this may include:

Identification and contact information — name, address, telephone number, email address, date of birth, emergency contact, and the name of your referring physician. Where the person being assessed is a child or youth, we also collect the same details for the parent or legal guardian.

Custody, guardianship and decision-making information — for children and youth, we ask about custody and decision-making arrangements and may require a copy of a court order, parenting agreement or similar document. We need this to confirm who has the legal authority to consent to the assessment, receive information, and access the final report.

Billing information — including provincial health plan (MSP) details, private insurer details, and information about third-party or charitable funding arrangements where these apply.

Health and assessment information — information about cognitive and academic functioning; speech, language and communication; sensory and motor functioning; adaptive functioning; behavioural and emotional functioning; developmental history; and physical health. This includes questionnaires, test results, clinical observations, interview notes, recordings where consented to, and the assessment reports we produce.

Information from family members and other third parties — where you have consented, we collect observations, questionnaires, and recordings from parents, family members, schools, and other professionals who can assist with the assessment.

Communications with our clinic — emails, telephone calls, voicemails and faxes sent to our clinic, and our records of those communications.

We collect this information directly from you and, with your consent, from your referring physician, your family members, and the third parties identified in the Schedule A you sign.

3. Why we collect it

We collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate, and only for the following purposes:

to confirm identity and legal authority to consent, particularly for children and youth;
to conduct multidisciplinary diagnostic assessments;
to prepare assessment reports and treatment recommendations;
to provide post-assessment support sessions, coaching and follow-up;
to communicate with you about appointments, results and next steps;
to communicate with your referring physician;
to arrange interpretation services where you request them;
to process payment and bill MSP, provincial health plans, insurers or third-party funders;
to maintain clinical records as required by law and professional regulation;
to operate, administer and improve our clinic, including scheduling, quality assurance and staff training; and
to meet our legal, regulatory and professional obligations.

We do not use personal information for marketing or advertising, and we do not sell personal information.

We obtain consent before collecting, using or disclosing your personal information, except where we are legally authorized or required to act without it.

How we obtain consent. For assessments, we use written consent forms which explain what will be collected, how it will be used, and who it may be shared with. Consent for some routine matters — for example, contacting you about an appointment you booked — may be implied by the circumstances. Consent may be given in writing, electronically or verbally depending on the sensitivity of the information.

Children and youth. Where the person being assessed is under 19, we obtain consent from a parent or legal guardian, and we take reasonable steps to confirm that the person signing has the legal authority to do so. Where a youth aged 13 or older believes they have sufficient maturity to make their own decision, our consent forms allow that youth to provide their own consent in addition to their parent or guardian.

Information about other people. Family members and others who provide information about a client are also providing their own personal information, and they are told how it will be used.

Third parties. Before we contact any school, professional or organization that is not your referring physician, we ask you to complete and sign a separate authorization (Schedule A) naming that party.

Recording. With your knowledge and consent, we may record virtual clinical meetings to assist with the assessment.

Withdrawing consent. You may withdraw your consent at any time by giving us reasonable notice in writing to our Privacy Officer, unless the collection, use or disclosure is authorized or required by law. Please speak with a member of our team first, because withdrawing consent may mean we are unable to complete your assessment, issue a report, or provide further services. We will explain the likely consequences before you decide.

5. How we use and disclose your information

Within our team. To provide a multidisciplinary assessment, your information is used by and shared among our clinical team — psychiatrists, psychologists, speech-language pathologists, occupational therapists, kinesiologists, coaches and educators — and our administrative staff and interview assistants. Access is limited to those who need the information to do their work.

Your assessment report. We disclose the final assessment report only to you (or, where the client is a minor, to the parent or legal guardian), and to the referring physician identified on your consent form. We do not send your report to anyone else — including schools, funders or charitable organizations — without your prior written consent. Once you receive your report, you are free to share it with whomever you choose.

Where we are required or authorized by law. In limited circumstances we may be required to disclose personal information without consent — for example, when billing MSP or a provincial health plan, in response to a court order, subpoena or search warrant, or where disclosure is required to prevent serious harm or is mandated by law such as a duty to report a child in need of protection. In those situations we disclose only the specific information we are legally obliged to disclose.

Service providers. We use carefully selected service providers to operate our clinic — for example, secure email and file storage, fax, interpretation, practice management, and technology services. These providers may handle personal information in order to provide services to us. We remain accountable for that information, and we require our service providers by contract to protect it to a comparable standard and to use it only for the purposes we specify.

6. Service providers, artificial intelligence, and information processed outside Canada

Because this is important to many of our clients, we set it out plainly.

Where your information is held. Our clinical records, email, calendar and file storage are provided by Microsoft 365, hosted in Canada. Our fax service is provided by a Canadian provider and fax data remains in Canada.

Service providers outside Canada. Some of the services we rely on are operated by companies based outside Canada, primarily in the United States, and personal information handled by those services may be stored or processed outside Canada. These include our practice management and client-record platform, our website provider, interpretation services, and the technology providers described below.

Interpretation services. Where you request a translator, we use Language Line Solutions to provide interpretation during appointments. This is identified in the consent form you sign.

Artificial intelligence. We use AI-assisted tools in a limited set of administrative and clinical-support tasks — for example, transcribing and summarizing telephone calls, voicemails and incoming messages; extracting referral details from physician referral documents; and assisting clinicians with drafting and organizing assessment reports. We want to be clear about how we use these tools:

AI tools assist our team; they do not make decisions about you. No diagnosis, recommendation or report is generated by an AI system on its own.
A qualified clinician reviews and approves all clinical content before it is entered into your record or provided to you.
We contract with our AI service providers to protect your information, to process it only on our instructions, and — where available — to configure these services so that your information is not retained on their systems or used to train their models.
We limit the information we send to these tools to what is necessary for the task.

What processing outside Canada means. When personal information is stored or processed in another country, it is subject to the laws of that country, and may be accessible to courts, law enforcement, regulators and government authorities there under the legal processes that apply in that jurisdiction. We remain responsible for your information wherever it is processed, and we use contractual and technical measures to ensure it receives a comparable level of protection.

Remote work. Some members of our team may work remotely from outside Canada. When they do, they access information only through our secured, access-controlled clinic systems, are bound by our confidentiality policies and additional remote-work safeguards, and are not permitted to download or store personal information locally.

7. How long we keep your information

We keep clinical records for a minimum of 16 years after the date of the last entry, or longer where required by law or by the professional obligations of our regulated clinicians. For a child or youth, the retention period runs from the date they reach the age of majority.

Where we use personal information to make a decision that directly affects you, we keep that information for at least one year after the decision so that you have an opportunity to request access to it.

Administrative records — such as general inquiries that do not result in an assessment, and routine correspondence — are kept only as long as needed for the purpose for which they were collected, and then securely destroyed.

When personal information is no longer required, it is destroyed, erased or made anonymous in a secure and irreversible manner, in accordance with applicable professional and regulatory standards.

8. Keeping your information accurate

We make reasonable efforts to ensure the personal information we use is accurate and complete, particularly where it will be used to make a decision about you or disclosed to another organization.

If you believe there is an error or omission in your personal information, you may ask us to correct it by writing to our Privacy Officer. If we are satisfied the correction is reasonable, we will make it as soon as possible, and send the corrected information to any organization we disclosed that information to in the year before the correction. If we are not satisfied the correction should be made, we will note your requested correction on the file.

Please note that clinical records are a record of what was observed and concluded at a point in time. A professional opinion that you disagree with will generally be annotated rather than removed, and we will explain this to you.

9. How we protect your information

We use administrative, physical and technological safeguards appropriate to the sensitivity of the information we hold:

Administrative — written privacy and confidentiality policies; signed confidentiality agreements for every team member; privacy training; access on a need-to-know basis; vendor agreements with our service providers; and oversight by our Privacy Officer.

Physical — secure premises, controlled access to areas where records are kept, and secure storage and destruction of any paper records.

Technological — access controls and individual user accounts, multi-factor authentication, encryption of information in transit, audit logging, and monitoring of our systems.

If something goes wrong. We maintain a breach-response process. If a privacy breach occurs that creates a real risk of significant harm, we will notify the affected individuals and the relevant privacy authorities as required by law, and take steps to contain the breach and prevent a recurrence.

10. Your right to access your information

You have the right to ask us for:

a copy of the personal information we hold about you;
information about how that information has been and is being used; and
the names of the individuals and organizations to whom we have disclosed it.

How to make a request. Write to our Privacy Officer at [email protected], giving enough detail for us to identify you and locate the information. We may ask you to confirm your identity before releasing anything.

Our response time. We will respond within 30 business days, unless we are permitted to extend that time under PIPA, in which case we will tell you.

Fees. We may charge a minimal fee for producing a copy of your personal information. If a fee applies, we will give you a written estimate before proceeding, and you may withdraw your request.

Limits. We can only give you information about you. We cannot disclose personal information that belongs to someone else — for example, a family member's own account of their observations or experiences. In limited circumstances set out in PIPA we may be required or permitted to refuse access, for example where disclosure could reasonably be expected to threaten someone's safety or health. If we refuse, we will tell you in writing, give our reasons, and explain what you can do next.

Requests on behalf of a child. A parent or guardian may make a request on behalf of a child who is not capable of exercising the right themselves. We will ask for confirmation of legal authority, and where a youth is capable of exercising their own rights, we will take their views into account.

11. Questions, concerns and complaints

If you have a question about this policy, or a concern about how we have handled your personal information, please contact our Privacy Officer first:

Dr. Ali Eslami, Privacy Officer
Email: [email protected]
Phone: +1 604-998-2244
Mail: All Brains Clinic, 6205 West Boulevard, Vancouver, BC V6M 3X4

We take complaints seriously and will investigate and respond to you.

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia:

Office of the Information and Privacy Commissioner for BC
PO Box 9038, Stn. Prov. Govt., Victoria, BC V8W 9A4
Telephone: 250-387-5629 · Toll-free in BC: 1-800-663-7867
Website: oipc.bc.ca (opens in a new tab)

You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca (opens in a new tab).

12. Changes to this policy

We review this policy regularly and update it when our practices change. The date below shows when it was last updated. Material changes will be reflected here, and you may request a copy of a previous version from our Privacy Officer.

Last updated: 4 October 2026