Luna Privacy Policy

Last updated: October 22, 2025

Luna Health Corp. (“Luna,” “we,” “us,” or “our”) helps people navigate and access mental-health care. This notice explains what we collect, why we collect it, who we share it with, and how we protect it—without the legalese.

By using Luna’s website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please discontinue use of the website and services.

1. About Luna and the Scope of this Privacy Policy

Luna provides coordination and support services (the “Luna Services”) designed to make mental-health care easier to access. These services may include:

  • Intake and matching

  • Referral triage and scheduling

  • Care coordination

  • Delivery of digital resources, education and support

  • Communications facilitating your connection to Clinicians

Luna may connect you with independent, regulated health professionals (“Clinicians”) who provide psychotherapy, psychology, psychiatry, social work or other regulated Clinical Services.

Who handles what?

  • Luna keeps coordination-data (intake, matching, scheduling, messages about logistics).

  • Clinicians keep clinical-data (session notes, assessments, treatment files) under their professional college rules.

This Privacy Policy applies to information collected or handled by Luna when you engage with the Luna Services or website. It does not apply to the clinical records held by your Clinician. For those, please contact your Clinician directly. We’ll gladly help direct your request.

Virtual-care notice: While we use safeguards to protect data in virtual sessions, no online system is completely risk-free. We recommend you join from a private location and avoid shared or employer-managed devices.

2. Legal Framework

Our privacy approach is guided by applicable Canadian laws, including:

  • The Personal Information Protection and Electronic Documents Act (PIPEDA)

  • The Personal Health Information Protection Act, 2004 (PHIPA) of Ontario

  • The Canada Anti-Spam Legislation (CASL)

  • Applicable professional regulatory and college standards

If you are not satisfied with our response regarding your privacy concerns, you may contact the Information and Privacy Commissioner of Ontario (IPC) at www.ipc.on.ca.

3. What Personal Information Means

  • Personal information: any data about an individual that can identify them, directly or indirectly (PIPEDA).

  • Personal health information (PHI): information about your physical or mental health, health history, care provision, or identity (PHIPA).

  • De-identified information: data that has been stripped of identifiers so that you cannot reasonably be identified.

We aim to collect only the personal information that is reasonably necessary for the purposes described in this policy.

4. What We Collect and Where It Comes From

4.1 Information you give us directly

  • Name, date of birth, email, phone, address, pronouns/gender identity

  • Intake questionnaires, service preferences, goals, feedback

  • Insurance or billing details (if applicable)

  • Communications you send to us (questions, messages)

4.2 Coordination-related health information

  • When you are referred by your primary care provider (for example, to participate in a publicly funded group CBT for insomnia program), we collect only the information necessary to coordinate your care. This typically includes:

    • Referral information provided by your family doctor or other referring provider (such as health card number, diagnosis, or treatment summary relevant to the referral).

    • Intake assessment completed by Luna to determine eligibility for the program.

    • Feedback to your provider: after the intake, we send a brief summary back to your referring provider to confirm whether you have been accepted into the program.

4.3 Information from other sources

  • Clinicians or other healthcare providers (with consent or lawful authority)

  • Insurers, third-party payors or benefits providers

  • Vendors or partners who provide services on our behalf

4.4 Technical & website information

  • IP address, device/browser type, operating system, session duration, pages visited

  • Cookies, pixels and similar technologies (see Section 13)

5. Why We Collect and Use your Information

We use your personal information for purposes that include:

  • Delivering and coordinating the Luna Services (intake, matching, scheduling, referrals)

  • Communicating with you and your Clinician or other providers as needed

  • Ensuring quality, safety and continuous improvement of services

  • Operating and securing our website, applications, and systems; preventing fraud or misuse

  • Business operations (vendor management, accounting, audit, legal compliance)

  • Complying with legal or regulatory obligations (court orders, professional requirements)

  • Responding to urgent health or safety situations

  • Research, service planning, evaluation and innovation

  • Creating de-identified or aggregated data for internal improvement or external partner work

  • Sending educational or promotional messages (with consent) under CASL

  • Other purposes you consent to or as permitted by law

We will not use your personal information for other purposes without obtaining your additional consent or unless legally permitted.

6. When and How We Disclose Your Information

We do not sell or rent your personal information. We may disclose your information in the following circumstances:

  • To Clinicians or care providers: for the purpose of assessing compatibility, making referrals, coordinating care

  • To service vendors: secure hosting, EMR systems, communication platforms, scheduling software, payment processors, analytics, security firms
    – These vendors access only what is necessary and are contractually bound to confidentiality

  • To insurers or payors: to verify eligibility and process payments

  • To government or legal authorities: when required by law, court order, or to protect rights/safety

  • In emergencies: if needed to protect your health or safety

  • In business transactions: such as a merger, acquisition, or corporate restructuring, under confidentiality safeguards

7. Consent

We collect, use, and disclose your information on the following bases:

  • Express consent: where required (e.g., sensitive health information, marketing messages)

  • Implied consent: where the purpose is obvious from the service (e.g., intake questionnaire for referral)

  • Legal basis without consent: in limited cases permitted by law (e.g., safety risk, court order)

You may withdraw your consent at any time by contacting us at admin@lunatherapy.ca. Withdrawing consent may limit our ability to provide some Luna Services.

8. Your Rights

You have a right to:

  • Request access to the personal information we hold about you

  • Request corrections to inaccurate or incomplete information

  • Withdraw consent, to the extent permitted by law

  • Ask questions or complain about our handling of your data

You may make a request via admin@lunatherapy.ca. We may require identification to verify your identity. If any fee applies for access, we will notify you in advance.

9. How we Protect Your Information

We employ layered administrative, technical and physical safeguards appropriate to the sensitivity of your information, including:

  • Encryption of data in transit and at rest (where supported)

  • Multi-factor authentication and role-based access controls

  • Secure servers, audit logs, least-privilege access

  • Contractual confidentiality obligations with all vendors

  • Staff training in privacy and security best practices

Although we aim for high security, no system is completely secure. If a privacy or security incident occurs, we will:

  1. Contain the issue

  2. Investigate the incident

  3. Notify affected individuals and relevant authorities (if required)

  4. Take steps to prevent recurrence

10. Retention and Destruction

We keep your personal information only as long as necessary for the purposes outlined in this policy or as required by law (e.g., audit, limitation periods).

When information is no longer required, we securely destroy or de-identify it.

Clinical records may be retained by your Clinician for longer periods in line with legal and professional requirements.

11. Cross-border Transfers

We aim to keep your information stored in Canada. Some trusted third-party vendors may process information in other countries. When your information is transferred outside Canada, it may be subject to the laws of the destination jurisdiction (including lawful access by authorities).

We perform due diligence on vendors, include contractual protections, and ensure security measures are in place irrespective of location. You may request a list of our current international-processing vendors via admin@lunatherapy.ca.

12. Marketing Communications

With your consent, we may send you educational or promotional communications about Luna’s services or new resources. You may unsubscribe at any time via the link in the message or by emailing admin@lunatherapy.ca.

Unsubscribing from marketing will not prevent you from getting essential service-related communications (e.g., scheduling messages).

13. Cookies, Analytics & Interest-based Ads

To help our website function and improve, we use cookies and similar technologies to:

  • Enable website features and remember your settings

  • Analyse how visitors use our website (pages visited, devices used, session length)

  • Support optional interest-based advertising, where permitted

Collected data may include IP address, browser/device type, operating system, approximate location and usage timestamps.
You can disable or block cookies via your browser, but some features may not work properly if you do.

Third-party analytics or advertising services may process some data outside Canada; their privacy policies apply as well.

14. Third-party Websites and Services

Our website may link to external websites or allow access to third-party products or services. This Privacy Policy does not apply to those third parties. We do not control or endorse their privacy practices. We encourage you to review their privacy notices before disclosing personal information.

15. Updates to This Privacy Policy

We may revise this Privacy Policy from time to time. When we do:

  • The “Last updated” date at the top will reflect the change.

  • Significant changes may be communicated via email or announcements in our services or website.

16. How to Contact Us

Privacy Officer
Luna Health Corp.
Email: admin@lunatherapy.ca

If you feel your concern has not been resolved, you may contact the Information and Privacy Commissioner of Ontario (IPC) via www.ipc.on.ca.