Privacy & Cookie Policy

This privacy policy (“Policy”) describes how Joint Recovery (“Joint Recovery”, “we”, “us” or “our”) collects, protects and uses the personally identifiable information (“Personal Information”) you (“User”, “you” or “your”) may provide on the jointrecovery.com website and any of its products or services (collectively, “Website” or “Services”). It also describes the choices available to you regarding our use of your Personal Information and how you can access and update this information. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

This Policy applies to all users of the Website and Services. Depending on where you live or receive services, additional protections may apply to you:

• If you are a Canadian Ontario resident receiving health-related services through Joint Recovery, the Personal Health Information Protection Act may apply to your health information.
• If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act applies to our handling of your personal information.
• If you are located in the European Union or European Economic Area, the General Data Protection Regulation applies
• If you are a United States resident and Joint Recovery or its providers are subject to HIPAA in connection with your care.

Joint Recovery has designated a Privacy Officer responsible for ensuring our compliance with applicable privacy laws, including the Personal Health Information Protection Act (Ontario), the Personal Information Protection and Electronic Documents Act (Canada), and, where applicable, the EU General Data Protection Regulation.

Our Privacy Officer can be reached at:

Privacy Officer.  Email: privacy@jointrecovery.com Phone: 416-544-9291 Mail: 55 Queen St East, Suite 804, Toronto, ON Canada M5C 1R6

You may direct any question, concern, access request, correction request, or complaint about our handling of your personal information to our Privacy Officer using the contact information above.

Collection of personal information

We receive and store any information you knowingly provide to us when you fill any online forms on the website. You can choose not to provide us with certain information, but then you may not be able to take advantage of some of the website’s features. Users who are uncertain about what information is mandatory are welcome to contact us.

Personal Information that we collect includes, but is not limited to:

• your name,
• your email address,
• your phone number

Collection of non-personal information

When you visit the website our servers automatically record information that your browser sends. This data may include information such as your device’s IP address, browser type and version, operating system type and version, language preferences or the webpage you were visiting before you came to our website, pages of our website that you visit, the time spent on those pages, information you search for on our website, access times and dates, and other statistics.

Use of collected information

Any of the information we collect from you may be used to personalize your experience; improve our website; improve customer service and respond to queries and emails of our customers; send newsletters; send notification emails such as password reminders, updates, etc.; run and operate our website and services. Non-personal information collected is used only to identify potential cases of abuse and establish statistical information regarding website usage. This statistical information is not otherwise aggregated in such a way that would identify any particular user of the system.

Our legal basis for processing (EU/EEA Users)

Where the GDPR applies, we process your personal data for the following purposes and on the following legal bases. We provide recovery and physiotherapy services and account features because this is necessary to perform our contract with you. We process health-related information you provide on the basis of your explicit consent under Article 9(2)(a) of the GDPR. We respond to inquiries and support requests on the basis of your explicit consent under Article 9(2)(a) of the GDPR. We send marketing communications only with your consent, which you may withdraw at any time. We also process your data where needed to comply with our legal obligations, such as responding to a lawful request.

Because health information is a "special category" of data under Article 9, we only process it with your explicit, freely given consent, or another basis specifically permitted under Article 9(2). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

‍De-identified or Aggregated Data

We may collect, use and share de-identified and aggregated data, such as the pages you visit with our services, for research and analytical purposes and/or to improve user experience.

Aggregated data may be derived from your personal information, but is not considered personal information in law, as this data does not directly or indirectly reveal your identity. However, if aggregate data is combined or connected with your personal data so that it would be able to directly or indirectly identify you, we will treat that combined data as personal information and will only use or disclose it in accordance with this policy.

Data Retention

We will retain your personal information for as long as you have an account with us or continue to use our services. After that, we will keep your information only as long as necessary to respond to inquiries, questions, complaints or claims made on your behalf, to fulfil our legal obligations, and to maintain any required records. In all cases, we retain personal information only as long as necessary for the purposes described in this policy, and no longer than the following periods. Account and profile information is kept for the life of your account plus 10 years. Clinical health information collected through our services is kept for 10 years from your last interaction with us. Your marketing communication preferences are kept until you unsubscribe or withdraw your consent. Website analytics and non-personal data are kept for 10 years.

Where we cannot specify an exact period, we decide how long to keep information based on its amount, nature and sensitivity, the purposes for which we process it, and any applicable legal or regulatory requirements. When we no longer need your information, we will securely delete or destroy it, or de-identify or aggregate it for use as set out in this policy.

Privacy of children

We do not knowingly collect any personal information from children under the age of 13. If you are under the age of 13, please do not submit any personal information through our website or service. We encourage parents and legal guardians to monitor their children’s internet usage and to help enforce this policy by instructing their children never to provide personal information through our website or service without their permission. If you have reason to believe that a child under the age of 13 has provided personal information to us through our website or service, please contact us. You must also be old enough to consent to the processing of your personal data in your country (in some countries we may allow your parent or guardian to do so on your behalf either due to laws relating to age or capacity).

Third-party disclosure:

We may share your personal information with third-party service providers who help us provide our services, or to otherwise fulfil your requests or as required by law. We prohibit our third-party service providers from using your personal information in any way other than for the authorized service they are providing. We will make our best efforts to ensure that third parties maintain reasonable and appropriate safeguards, and we will use our best efforts to ensure they sign confidentiality agreements or have similar confidentiality requirements in their standard agreement.

Newsletters

We offer electronic newsletters to which you may voluntarily subscribe at any time. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or by contacting us.

Fundraising

Joint Recovery does not use your personal or health information for fundraising purposes.

Marketing and Testimonials

We may invite you to share a testimonial or success story about your experience with our services. Where a testimonial references your health condition, treatment, or recovery, we will only publish or use it after obtaining your express written authorization, separate from this policy, specifying what information you are agreeing to share, how it will be used (e.g., on our website, in marketing materials), and confirming that you may withdraw your authorization at any time going forward. We do not sell your personal or health information to third parties.

Do Not Track signals

Some browsers incorporate a Do Not Track feature that signals to websites you visit that you do not want to have your online activity tracked. Tracking is not the same as using or collecting information in connection with a website. For these purposes, tracking refers to collecting personally identifiable information from consumers who use or visit a website or online service as they move across different websites over time. How browsers communicate the Do Not Track signal is not yet uniform. As a result, this website is not yet set up to interpret or respond to Do Not Track signals communicated by your browser. Even so, as described in more detail throughout this policy, we limit our use and collection of your personal information.

Links to other websites

Our website contains links to other websites that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other websites or third-parties. We encourage you to be aware when you leave our website and to read the privacy statements of each and every website that may collect personal information.

Information security

We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. In addition, personal and health information transmitted electronically — including between your device and our servers — is protected using industry-standard encryption and other reasonable safeguards appropriate to the sensitivity of the information, to reduce the risk of unauthorized access or interception in transit. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of personal information in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed. Therefore, while we strive to protect your personal information, you acknowledge that (i) there are security and privacy limitations of the internet which are beyond our control; (ii) the security, integrity, and privacy of any and all information and data exchanged between you and our website cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third-party, despite best efforts.

Data breach

If we become aware of a breach affecting your personal information, we will investigate and take reasonably appropriate steps in response, including notifying affected individuals and, where required, regulators and law enforcement.

Where legally required, we will provide notification within the following timeframes:

• EU/EEA (GDPR): notify the relevant supervisory authority within 72 hours of becoming aware of a breach likely to result in a risk to your rights and freedoms, and notify you without undue delay where the breach is likely to result in a high risk.
• United States (HIPAA): notify affected individuals without unreasonable delay and no later than 60 days following discovery of a breach of unsecured PHI.
• Ontario (PHIPA): notify affected individuals at the first reasonable opportunity, and notify the Information and Privacy Commissioner of Ontario where required.

Consent

By using or accessing the services, you consent to the collection, use and disclosure of your personal information by us in the manner described in this policy. You may always choose not to disclose certain personal information, however this may restrict access to certain features of the services. 

At any time, you may withdraw consent for any communication or use of information for which consent is required. Withdrawing consent will not apply to any actions we have already taken based on your prior consent.

For any requests to withdraw consent, please contact us at hello@jointrecovery.com.

Your Rights

Depending on where you live, you have the following rights regarding your personal and health information. To exercise any of these rights, contact our Privacy Officer at privacy@jointrecovery.com.

Access. You may request a copy of the personal information we hold about you, including your protected health information (PHI), subject to certain exceptions permitted by law (for example, psychotherapy notes or information compiled in anticipation of legal proceedings). You may submit your request in writing, including by email to our Privacy Officer at privacy@jointrecovery.com; if you need assistance putting your request in writing, contact us and we will help you do so. 

Upon receiving your request, we will perform a reasonable search of our records. Where technically feasible, and your record is readily producible in the format requested, we will provide your information in the electronic format you request; where that is not feasible, we will provide it in a mutually agreeable alternative electronic format or as otherwise required by law. If we do not hold the information you have requested, or are denying your request in whole or in part, we will notify you and explain the reason. 

We will respond as soon as possible, and generally within 30 days of receiving your request. Where permitted by law, we may extend this period by up to an additional 30 days; if we do, we will notify you in writing before the original deadline, with the reason for the delay and the date by which you can expect a response.

Correction. You may request that we correct or update inaccurate or incomplete personal information, including PHI, by submitting your request in writing to our Privacy Officer at privacy@jointrecovery.com, stating the information you believe is inaccurate or incomplete and the reason. 

We will respond as soon as possible, and generally within 60 days of receiving your request. Where we accept your request, we will make the correction and, where reasonably practicable, notify any third parties to whom we previously disclosed the inaccurate information. If we are unable to make a requested correction, we will notify you in writing of the reason for the refusal, note your disagreement, and, where required by law, attach a statement of disagreement to the record; you may also request that your statement of disagreement be included with any future disclosures of the disputed information.

Withdrawal of consent. You may withdraw consent to our collection, use, or disclosure of your information at any time, subject to legal or contractual restrictions.

If you are located in the European Union or European Economic Area, you additionally have the right to:

• request erasure of your personal data ("right to be forgotten");
• request restriction of processing;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests or for direct marketing; and
• lodge a complaint with your local supervisory authority (see Section ‘How to file a complaint’).

If this policy serves as notice for protected health information (PHI) subject to HIPAA, you additionally have the right to:

• request restrictions on certain uses or disclosures of your PHI;
• request confidential communications by an alternative means or at an alternative location;
• receive an accounting of certain disclosures of your PHI; and
• obtain a paper copy of this notice at any time, even if you agreed to receive it electronically.

We will not retaliate against you for exercising any of these rights.

Complaints

If you believe we have not handled your personal information in accordance with this policy or applicable law, you may file a complaint with us by contacting our Privacy Officer at privacy@jointrecovery.com. We will document, investigate, and work to resolve your complaint, and will respond to you with the outcome within a reasonable time .

We will not retaliate against you for filing a complaint.

You also have the right to file a complaint directly with the applicable regulator:

• United States (HIPAA): U.S. Department of Health and Human Services, Office for Civil Rights — www.hhs.gov/ocr/complaints
• Ontario (PHIPA): Office of the Information and Privacy Commissioner of Ontario — www.ipc.on.ca
• Canada (PIPEDA): Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• European Union / EEA (GDPR): the data protection supervisory authority in your country of residence, place of work, or the place of the alleged infringement.

Legal disclosure

We will disclose any information we collect, use or receive if required or permitted by law, such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. In the event we go through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of the company’s assets, your user account, and personal data may be among the assets transferred.

Changes and amendments to this policy

We reserve the right to modify this Policy relating to the website or services at any time, effective upon posting of an updated version of this Policy on the Website. When we do we will revise the updated date at the bottom of this page. Continued use of the Website after any such changes shall constitute your consent to such changes.

Acceptance of this policy

You acknowledge that you have read this Policy and agree to all its terms and conditions. By using the website or its services you agree to be bound by this policy. If you do not agree to abide by the terms of this policy, you are not authorized to use or access the website and its services.

Contacting us

If you have any questions about this Policy, please contact us at:

Email: support@jointrecovery.com

Phone: 416-544-9291

Mail: 55 Queen St East, Suite 804, Toronto, ON Canada M5C 1R6

‍

Cookies and Similar Technologies Policy

This policy explains the nature and purpose of Joint Recovery’s use of cookies and similar tracking technologies. This policy should be read together with our Privacy Policy. All defined terms in this policy adopt the definition contained in the Privacy Policy.

Cookies and Tracking Technology

Joint Recovery (“we”, “us”, “our”) uses cookies or similar technologies to analyze trends, administer our website(s), track users' browsing behavior, and to gather demographic information about our user base. You can control the use of cookies at the individual browser level; however, this may prevent you from taking advantage of some of our features.   

What are cookies?

Cookies are text files or identifiers we store on your browser or device so we can recognize your browser, application, or device.  When placed on your computer, cookies or similar technologies such as pixel tags or web beacons allow us to automatically collect standard Internet log information and visitor behavior information, such as how and when various pages and features on our website are visited and by how many people. These technologies help us analyze how our website is used and monitor website performance so we can continuously improve the user experience.   

How do we use cookies?

Joint Recovery uses cookies in a number of ways to improve your experience on our website, including:   

• understanding how you use our website  
• distinguishing you from other users of our website(s)   
• analyzing aggregate trends among users of our website 
• tracking your movements around our website  
• gathering demographic information about our user base

What type of Cookies do we use?

Our website uses the following cookies:   

First Party Cookies: First party cookies are placed by us on your browser or device. These cookies assign you a unique identifier to track your journey on our website. These cookies can be further categorized into the following:   

Session Cookies: session cookies track your actions during a particular browser session and expire each time you close your browser.  

Persistent Cookies: persistent cookies are stored on your device in between browser sessions. They allow your preferences or actions across our website to be remembered. These cookies remain on your device until they automatically expire or until you delete them from your cache.   

Third Party Cookies: These cookies are set by a website other than our website. Our third-party partners, including advertising partners, may use or transmit cookies too, and read cookies from your browser, application, or device when you visit or use our website.

Strictly necessary cookies: These are cookies that are required for the operation of our website and under our terms with you.   These cookies are likely to persist on your computer after you have finished browsing our website.

Analytical / performance cookies: They allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us for our legitimate interests of improving the way our website works, for example, by ensuring that users are finding what they are looking for easily.   These cookies are likely to persist on your computer after you have finished browsing our website.

Targeting / advertising cookies: These cookies record your visit to our website, the pages you have visited, and the links you have followed. We will use this information subject to your choices and preferences to make our Service and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.  These cookies are likely to persist on your computer after you have finished browsing our website.

Our Website is not currently set up to interpret or respond to Do Not Track signals communicated through your browser.  Your browser can be set to block cookies. However, blocking cookies can impair the experience of some of our services.  

For more information about the use and privacy of your data when engaging with Joint Recovery, please see our Privacy Policy.   

Changes to this Policy  Any changes we make to this policy will be posted on our website. Please check this policy frequently for updates.  

Contact Us If you have any questions about our use of cookies or similar technologies, please contact us at: Email: support@jointrecovery.com Phone: 416-544-9291 Mail: 55 Queen St East, Suite 804, Toronto, ON Canada M5C 1R6

‍

‍

‍