Privacy Governance Policy

Therapeutic Atlas Menu

Adopted November 1, 2026 by Kim Lavigne, owner and person in charge of the protection of personal information. Reviewed every year in November.

This policy sets out how Therapeutic Atlas protects personal information through its whole life: collection, use, sharing, keeping and destruction. See also our Privacy Policy.

Roles

• Kim Lavigne, person in charge of the protection of personal information: approves this policy, answers access and complaint requests, keeps the incident register, does privacy impact assessments, and approves any new service that handles personal information. Contact: kim@therapeuticatlas.com.
• Anyone who works with Therapeutic Atlas (contractors, assistants, editors): signs a confidentiality agreement before getting access, uses only the information needed for their task, and reports any incident to Kim the same day.

Principles

1. Collect only what we need for a stated purpose, with consent.
2. Never collect clients’ health information. The free tools and the Atlas app keep entries on the user’s device.
3. Default to the most private setting. Statistics and advertising cookies stay off until a visitor turns them on.
4. Never put tracking pixels on the free tools, the Atlas app, or any page a client uses.
5. Offer every public page, form and policy in French and English.

Retention and destruction

Information	Kept for	Then
Email list contacts	While subscribed	Deleted within 30 days of unsubscribing, except the unsubscribe record
Customer and payment records	6 years, for tax purposes	Deleted
Emails with the public	2 years after the last message	Deleted
Website statistics	14 months	Deleted or kept only as anonymous totals
Incident register entries	At least 5 years	Reviewed, then deleted

Requests and complaints

1. Requests and complaints go to kim@therapeuticatlas.com.
2. Kim acknowledges within 5 business days and answers within 30 days.
3. Kim records each complaint, its outcome and the date it closed.
4. The answer tells the person they can go to the Commission d’accès à l’information if they disagree.

New services and transfers outside Quebec

Before adopting any new tool that handles personal information, or sending personal information outside Quebec, Kim does a privacy impact assessment and signs a written agreement with the provider. Each tool is added to the list in the Privacy Policy.

Confidentiality incidents

Any incident is contained the same day, assessed for risk of serious harm, reported to the Commission d’accès à l’information and the people affected when required, and recorded in the incident register.

Training

Kim and anyone who handles personal information for Therapeutic Atlas review this policy and the incident steps once a year, and on joining.