ShiftGrit Privacy Policy

Last updated: 1 November 2026

Your privacy is very important to ShiftGrit Psychology & Counselling. We developed this Policy in order for you to understand how we collect, use, communicate and disclose and make use of personal information. The following outlines our privacy policy.

• Before or at the time of collecting personal information, we will identify the purposes for which information is being collected.
• We will collect and use of personal information solely with the objective of fulfilling those purposes specified by us and for other compatible purposes, unless we obtain the consent of the individual concerned or as required by law.
• We will only retain personal information as long as necessary for the fulfillment of those purposes.
• We will collect personal information by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned.
• Personal data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up-to-date.
• We will protect personal information by reasonable security safeguards against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.
• We will make readily available to customers information about our policies and practices relating to the management of personal information.
• We are committed to conducting our business in accordance with these principles in order to ensure that the confidentiality of personal information is protected and maintained.

What is Personal Information?

Your personal information includes:

1. your name, mailing address, e-mail address, and phone number;
2. your year of birth, gender, and language;
3. your payment history;
4. information you communicate through e-mail, faxes, letters, and phone calls; and
5. other personal information collected to provide a specific service or to research our client base.

Personal Financial Information

We do not store full credit card numbers in our electronic databases. Once an online financial transaction is complete, we retain just the last 4 digits to facilitate payment auditing.

Online Browser Data

We automatically collect technical data from visitors to our websites. This data is not connected to your personal information. It includes:

1. server logs, which record your computer IP address, browser type, operating system, and timestamp for each web page you visit, and which we keep for up to 90 days; and
2. session cookies, which temporarily stores on your computer your login information, the page you are viewing, and your language preference.

How we handle your information online

This section explains what ShiftGrit Psychology & Counselling collects through our website, our matching tool, our “Talk to our team” form and our online booking. It covers why we collect it, how long we keep it, and who to contact.

Who to contact

Send questions, requests or concerns about your personal information to our privacy contact: Privacy Officer, ShiftGrit Psychology & Counselling, privacy@shiftgrit.com.

The matching tool

Our matching tool asks where you are, how you want to meet, which days and times suit you, any preference about who you see, how you plan to pay and what you would like help with. It uses your answers to suggest clinicians and show times you can book.

• What we keep: your answers, the clinicians and times we showed you, any times you selected, and how you reached the page, such as the web page or ad you came from.
• What the tool does not ask for: your name, email or phone number, unless you are a current client asking us to move or cancel an appointment.
• How long we keep it: we delete these records 180 days after you use the tool.
• Moving or cancelling an appointment: if you are a current client, the tool can pass a request to move or cancel an appointment to our team. It asks for your first name and last initial, your therapist and the appointment’s day and time. We email these to your clinic’s inbox, with whether you want to move or cancel and when you asked, so our team can find your appointment, check it with you and help with the change.
• The tool does not keep your name or your therapist’s name. With your other answers, and for the same 180 days, it keeps that you asked, how far away the appointment was, and whether your request reached our team. We keep the email as long as we need it to handle your request, and after that only as our record-keeping obligations require. Our clinic inboxes are listed under Google Workspace and Missive below.
• Why: to suggest clinicians and times, to manage bookings across our team, and to improve how the tool matches people.
• If you book: the link to our booking system carries a random reference, not your name. When you complete a booking, we connect it to your answers by matching the clinician you booked with and when you booked (within three hours of leaving the tool), and share those answers with our team so they can prepare for your intake.
• Our ads: if you clicked one of our Google ads before booking, we let Google Ads know the ad led to a booking. We use the ad’s click identifier for this, not your name or contact details.
• Under 18: if you tell the tool the sessions are for someone under 18, it keeps no record of that request and asks you to talk to our team instead.
• The tool does not send your answers to Google Analytics.

“Talk to our team”

The “Talk to our team” form asks for your name, date of birth, email address and phone number. It also asks whether we may contact you by text message or voicemail, and whether you would like our newsletter. Any answers you already gave the matching tool are sent with the form, so our team can see them.

Your form goes to our client team, who use it to contact you, arrange a call and help you book. We keep it for as long as we need it to arrange your care, and after that only as our record-keeping obligations require. We only contact you in the ways you agreed to. You can stop our text messages at any time by replying STOP, unsubscribe from our emails using the link in them, or write to our privacy contact.

Booking online through Jane

Our online booking runs on Jane, a practice management system. When you book, Jane collects the details needed for your appointment and your client file on our behalf.

We measure visits to our Jane booking pages with our own Google Analytics account, for example to see whether a booking was completed. That measurement follows the cookie choices you make on the Jane booking page. ShiftGrit is responsible for this measurement.

Analytics and cookies on shiftgrit.com

We use Google Tag Manager, Google Analytics and Google Ads to understand how people use our website and whether our advertising is working. Analytics and advertising cookies stay off until you accept them in our cookie banner, and you can change your choice at any time. If you decline, these tools do not set cookies, but Google may still receive basic information without cookies, such as that a page was viewed.

If your information is handled outside Canada

Some of our service providers collect, use, disclose or store personal information for us outside Canada, mostly in the United States. The service providers in the list just below do this in the countries shown for each. Other service providers we use may also handle information outside Canada; our Privacy Officer can tell you which ones and where, including the companies that support each provider.

While your information is in another country, such as the United States, it may be accessed by the courts, law enforcement and national security authorities of that country.

You can read this information here, or ask us for a written copy. Our Privacy Officer can answer your questions about how our service providers outside Canada collect, use, disclose or store your information: Privacy Officer, ShiftGrit Psychology & Counselling, privacy@shiftgrit.com.

Service providers

We rely on service providers to run our services. They handle information for us under their terms. Here is what each one does for us and where it stores or processes your information.

Booking and your client file

• Jane (Jane Software Inc.): our practice management system. It runs online booking, your client file and clinical notes, intake forms, appointment reminders and messages, and video sessions. Where: Canada (Montreal, Quebec, and Calgary, Alberta) for your client file; the United States for appointment reminders and messages, which Jane processes there and may store there for a short time. For video sessions, Jane says its video provider uses a central data centre, so limited information, such as your IP address, may be stored outside Canada for a short time; Jane does not name the country. Jane says the video and chat from a session are not stored.

Email, calls, texts and forms

• Google Workspace: our email, including privacy@shiftgrit.com, our main inbox and our clinic inboxes, and the files, spreadsheets and calendars our team uses to arrange your care. Where: the United States and other countries where Google has data centres. As of October 2026, those other countries are Belgium, Chile, Denmark, Finland, Germany, Ireland, Japan, Mexico, the Netherlands, Singapore, Taiwan, the United Kingdom and Uruguay. People who work for Google, and companies that support Google, in other countries may also have limited access to it to fix technical problems or answer our support requests. Google keeps its current lists at datacenters.google/locations and workspace.google.com/terms/subprocessors.
• Missive (Heliom Inc., Quebec City): the shared inbox our team uses to read and answer email sent to our main inbox (which also receives mail sent to privacy@shiftgrit.com), to our clinic inboxes, to our HR inbox and to our concierge inbox. Missive stores copies of those emails and their attachments, such as your messages to us and the appointment notices our booking system sends us, with our team’s notes on them. Where: the United States. A small number of Missive’s engineers can reach the stored email to run and support the service. They work from Canada, Poland and Portugal, and may work from other countries when travelling. Missive tells us they look at our email only with our permission, for example to investigate a problem we report.
• Freshdesk and Freshcaller (Freshworks Inc.): our client team’s ticket system for enquiries, booked calls and follow-up (it keeps copies of emails, text threads and call logs), and the phone system for our clinic lines. Where: the United States, where Freshworks hosts our account, including tickets, emails, text threads, call logs, call recordings and voicemail. Calls through Freshcaller run on Twilio, in the United States. Freshworks also lists its own companies in India, Australia, the United Kingdom, Germany, France, Singapore, the Netherlands and Ireland among those that may access or process our account’s information.
• Typeform (Typeform SL): our “Talk to our team” form and the forms on our ad pages. Where: the United States. Typeform, which is based in Spain, also lists its own companies in Germany and the United Kingdom among those that support the service.
• Calendly (Calendly LLC): booking a phone call with our client team. Where: the United States. Calendly says some of its own service providers also process data in Israel, the Netherlands and the United Kingdom.

Ruby, our AI assistant

• Retell AI, Inc.: runs Ruby, the AI assistant we are introducing as a chat on our Get matched page, called Ask Ruby. Retell processes what you and Ruby write, including details you give Ruby, such as your name and a phone number or email address so our team can get back to you, or an appointment you want to cancel or change. Retell holds what is written only while a chat is open; for Ask Ruby, it then keeps only basic details of each chat, such as when it happened and how long it lasted, and not what was written. Retell’s AI model providers, such as OpenAI and Microsoft (Azure OpenAI), process the conversations for Retell. Where: the United States.

Connecting our systems

• Zapier (Zapier, Inc.): passes form submissions and call bookings between our systems, and tells Google Ads when an enquiry becomes a booking. Where: the United States. Zapier also lists its own companies in Australia (with a branch in New Zealand), Ireland (with a branch in Spain), India and the United Kingdom among those that help provide its services and support.

Our website, the matching tool and measurement

• Vercel (Vercel Inc.): runs the server behind our matching tool and, once it launches, passes Ruby’s chat messages between our Get matched page and Retell. Where: Canada (Montreal) for running our matching tool’s server code; the United States for the part of Vercel’s network that first receives and decrypts visitors’ requests (for visitors in Alberta this has been in the United States), for Vercel’s main processing facilities, and for most of the companies Vercel uses. Vercel also lists companies in Spain and the United Kingdom among those that may process our account’s information.
• Supabase: the database behind our matching tool and our client team’s internal tools. Where: Canada (Montreal) for our database and its backups; the European Union for Supabase’s system logs (Supabase does not say which country); and other countries when Supabase’s support team, which works around the clock from around the world, looks into a problem for us or a security issue. Supabase also lists its own companies in Singapore and the United States among those that may access or process our account’s information.
• Google Analytics, Google Tag Manager and Google Ads: measuring how people use our website and our Jane booking pages, and whether our ads work. Where: the United States and other countries where Google has data centres. As of October 2026, those other countries are Belgium, Chile, Denmark, Finland, Germany, Ireland, Japan, the Netherlands, Singapore, Taiwan, the United Kingdom and Uruguay. People who work for Google, and companies that support Google, in other countries may also access this information to keep these services running or answer our support requests. Google keeps its current lists at datacenters.google/locations and business.safety.google/adssubprocessors. For Google Ads, Google also uses some of this information for its own purposes under its own privacy policy.

Your choices

You can ask to see the personal information we hold about you, ask us to correct it, or withdraw consent to how we use it, subject to our legal and professional record-keeping obligations. Contact our privacy contact above. If you are not satisfied with our response, you can contact the Office of the Information and Privacy Commissioner of Alberta.