Privacy Policy & AI Data Governance

Effective Date: August 12, 2026

Practice Entity: Michele Arseneault (Sole Proprietorship)

Location: New Brunswick, Canada

This Privacy Policy outlines how personal information and Personal Health Information (PHI) are collected, used, disclosed, and safeguarded in my practice as a Naturopath, Registered Massage Therapist (RMT), Craniosacral Therapist (CST), Holistic Consultant, and Energy Alchemist. It specifically details the strict governance and compliance frameworks surrounding the use of Artificial Intelligence (AI) tools within my business.

1. Compliance Framework

As a sole proprietor operating in New Brunswick, Canada, I am committed to protecting client privacy and maintaining absolute confidentiality. This policy is designed to comply with the highest standards of data protection, including:

• PHIPAA (Personal Health Information Privacy and Access Act, New Brunswick) – As a custodian of health information.

• PIPEDA (Personal Information Protection and Electronic Documents Act, Canada) – Governing commercial personal data.

• HIPAA (Health Insurance Portability and Accountability Act, USA) – Adhering to strict administrative, physical, and technical safeguards regarding electronic protected health information (ePHI).

2. Collection and Use of Personal Health Information (PHI)

I collect PHI necessary to provide safe, effective, and personalized holistic care. This includes:

• Contact details, medical history, physical assessment notes, and treatment plans.

• Insurance information for the purposes of direct billing under RMT or Naturopath coverage.

Purpose of Use: PHI is used strictly for administering treatments, managing client files, processing insurance claims, and communication regarding your care.

3. Artificial Intelligence (AI) Data Governance

To optimize business operations, clinical charting efficiency, and educational content creation, I may utilize secure AI applications. My commitment to data integrity and compliance dictates the following strict rules:

A. Non-Identifiable Clinical Charting & Summarization

• De-identification: When using AI tools to assist in organizing clinical notes, summarizing intake forms, or drafting treatment suggestions, no directly identifying information (such as your full name, date of birth, address, phone number, or specific employer) is ever entered into an AI system.

• Anonymized Prompts: Data processed through AI is strictly aggregated or structured using pseudonyms or codes (e.g., "Client A, 45-year-old female") to prevent any possibility of re-identification.

B. No AI Data Training (Zero-Data Retention)

• I strictly utilize enterprise-grade or privacy-compliant AI platforms that explicitly state in their terms of service that user inputs will not be used to train public AI models.

• Your health narratives remain entirely proprietary and confidential to this practice.

C. Technical and Vendor Safeguards (HIPAA & PHIPAA Alignment)

• Any digital tool or AI-integrated platform handling scheduling, billing, or encrypted clinical records is vetted to ensure it utilizes AES 256-bit encryption both at rest and in transit.

• Where applicable, I seek vendors willing to sign Business Associate Agreements (BAAs) or Canadian data addendums establishing compliance with PHIPAA/HIPAA security rules.

4. Disclosure of Information

Your information is never sold, leased, or shared with third parties for marketing purposes. Disclosure only occurs under the following parameters:

• Direct Billing / Insurance Providers: Submitting claims directly to your insurance company at your explicit request for RMT or Naturopath reimbursement.

• Legal/Safety Requirements: In rare circumstances where disclosure is permitted or required by law (e.g., public health mandates, clinical duty to protect/warn).

5. Client Rights and Access

Under PIPEDA and PHIPAA, you hold absolute rights over your data. You may:

• Request access to your clinical records at any time.

• Request corrections to inaccurate or incomplete personal health information.

• Withdraw your consent for direct billing or the digital processing of your data (subject to legal or contractual restrictions).

6. Accountability and Inquiries

As a sole proprietor, I act as my own designated Privacy Officer. I am personally accountable for the protection of your data and ensuring my digital practices remain compliant with Canadian and international standards.

For any questions, concerns, or requests regarding your privacy and the digital tools used in my practice, please contact me directly at:

Michele Arseneault,

Naturopath, RMT, CST, Holistic Consultant & Energy Alchemist

michele.holistic@gmail.com
New Brunswick, Canada