Legal

Privacy Policy

How we collect, use, and protect personal information.

Information collected
How information is used
Your privacy rights
Server-side analytics
Third-party analytics
Terms of Use
Cookie Policy

This page covers

What personal information End The Wait Ontario collects.
How information is used, stored, and protected.

Legal and policy pages use stable public-site disclosures and plain-language summaries.

General informationThis page explains website policy and does not provide legal advice.

Direct answer

How we collect, use, and protect personal information.

Privacy policy at a glance

Information collected: What personal information End The Wait Ontario collects.
Use, storage, and protection: How information is used, stored, and protected.

Your privacy is important to us. This policy explains how End The Wait Ontario collects, uses, and protects your personal information.

Last updated: September 16, 2026

Overview

End The Wait Ontario (“we,” “us,” or “our”) operates the website https://www.endthewaitontario.com (the “Site”). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our Site or interact with our services. Learn more about our mission to advocate for Ontario families.

We are committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy laws.

Information We Collect

Information You Provide

When you use our Site, you may voluntarily provide:

•Contact Information: Name, email address, postal code (for constituency identification)
•Story Submissions: Personal experiences you choose to share about autism services via our story submission form page
•Petition Signatures: Name, email, and postal code for advocacy petitions
•Media Inquiries: Contact information for journalists and media professionals through our press page
•Newsletter Subscriptions: Email address and consent preferences when you sign up for our advocacy updates and monthly waitlist newsletters
•Communications: Messages sent through our contact forms

Sensitive Information and Minors

Stories may contain sensitive personal information, including health-related details (autism diagnosis, therapy history, service wait times) and information about children. We treat all such information as sensitive personal information under PIPEDA with enhanced access controls.

Please avoid including full names of third parties, exact addresses, school names, or other identifying details beyond what is necessary. If your story concerns a child, you confirm you are the parent or legal guardian, or have authority to share the information. We may redact details to reduce identification risk before any publication.

Information Collected Automatically

When you visit our Site, our analytics collect as much as Canadian privacy law allows for measurement that is disclosed and can be switched off. As of 16 September 2026 that is:

•Device and browser: browser and operating system, screen and window size, pixel density, touch support, processor and memory class, language, time zone, connection speed and type, whether you prefer dark mode, reduced motion or high contrast, and whether you opened the site as an installed app.
•How you use the site: the pages you open and in what order, the site or search engine that sent you, how long each page was actually on screen and in use, how far you scrolled, what you click or tap, text you select or copy on our public pages, links you follow to other sites, whether you printed a page, errors the page hit, and how fast it loaded.
•Session recordings: a replay of how the page was used, with every form and input field blanked out before it leaves your device (see Third-Party Analytics below).
•Return visits: a random first-party identifier so we can tell a returning browser from a new one, how many times it has visited, when it first came, and the first page and referring site of that first visit.
•IP address: recorded by our analytics provider when your browser connects to it, used for approximate location and to separate people from automated traffic. We never look it up with an outside service.
•What we never collect: anything you type into a form, private roadmap or wait-clock links, intake answers, your name, or your contact details — unless you send them to us yourself.

How We Use Your Information

We use the information we collect for the following purposes:

•Advocacy: To support our advocacy efforts and communicate with government officials on behalf of Ontario families
•Communication: To respond to your inquiries and send updates you've requested
•Story Sharing: To share parent stories (with explicit consent) to raise awareness

How We Use Stories (Your Choice)

At submission, you can choose whether we may:

(a)Use your story internally for advocacy analysis only
(b)Publish it anonymously on the site
(c)Contact you for clarification or follow-up
(d)Share anonymised excerpts with journalists or policymakers

You can change your choices later or request deletion by contacting us. Attributed (non-anonymous) use of your story always requires separate, explicit consent.

•Site Improvement: To analyze usage patterns and improve our Site
•Legal Compliance: To comply with legal obligations and protect our rights

Cookie Policy

We use cookies and similar technologies to enhance your experience on our Site.

Essential Cookies

Required for the Site to function properly. These cannot be disabled.

Analytics Cookies

Help us understand how visitors interact with our Site. We use Google Analytics (operated by Google LLC, United States) with anonymized IP addresses. Google processes this data under its standard data processing terms, which ensure comparable privacy protections. You can opt out of analytics cookies.

Preference Cookies

Remember your preferences (e.g., cookie consent choice) for future visits.

Layout Tests (A/B Tests)

We sometimes show two versions of the same page layout to learn which one helps families find help faster. Your browser is placed in a test group using a random code, never a cookie. Until you accept analytics, the code is kept only for your current visit and is deleted when you close your browser. If you accept analytics, the code is saved in your browser so your group stays the same on later visits. The code is never linked to your name or contact details, and every version of a page shows the same facts and numbers. If you decline analytics, you are left out of all tests and always see the standard page.

We never use cookies for commercial advertising or sell your data to third parties.

Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this policy:

•Contact form submissions: 2 years
•Petition signatures: Duration of advocacy campaign plus 2 years
•Story submissions: Until you request removal, or 7 years if published. Story submissions may include health-related information (autism diagnosis, service wait times), which is treated as sensitive personal information under PIPEDA with enhanced access controls
•Analytics data: 26 months (Google Analytics retention)
•PostHog analytics: session recordings are kept for 30 days; events and the anonymous browser profile they belong to are kept for as long as PostHog's plan retention allows, or until you ask us to delete them.
•First-party records: daily totals only, kept indefinitely. We copy day-level counts from our hosting provider's reporting (requests per organisation or network, per country, per page, per bot class) so the record outlives Vercel's 30-day window. Those counts contain no IP address and no visitor identifier. We retired our own per-request logging database in August 2026 and have not rebuilt it. See Server-Side Analytics below.
•We comply with Canada's Anti-Spam Legislation (CASL) and obtain your consent before sending commercial electronic messages. You may withdraw consent at any time.
•Consent records: 7 years (as required for legal compliance)

Your Rights

Under PIPEDA and applicable privacy laws, you have the right to:

•Access: Request a copy of the personal information we hold about you
•Correction: Request correction of inaccurate information
•Deletion: Request deletion of your personal information (subject to legal retention requirements)
•Withdrawal: Withdraw consent for communications at any time
•Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

How to Exercise Your Rights

To make a data subject access request (DSAR), correction, or deletion request, contact us using either method below. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days.

•Contact form: Privacy request form
•Direct URL: endthewaitontario.com/contact (select “Privacy Request” as inquiry type)

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

•HTTPS encryption for all data transmission
•Secure hosting with industry-standard protections
•Access controls limiting who can view personal information
•Regular security reviews and updates

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Children's Privacy

Our Site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

For stories involving children, we require consent from a parent or legal guardian, and we encourage careful consideration of how much identifying information to include about minors.

Data Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner of Canada as required under PIPEDA. We will also take reasonable steps to mitigate the effects of the breach.

Server-Side Analytics

Our own servers do not log individual page requests. We previously logged each request — IP address, a visitor identifier, page path, referring page and browser details — to our own database. That database was retired in August 2026 and those records no longer exist. What we keep on our own side since 16 September 2026 is a daily aggregate copy of our hosting provider's reporting: for each day, how many requests came from each organisation or internet provider, each country, each page, and each class of automated crawler. That copy has no IP addresses and no visitor identifiers in it, and cannot be tied to a person.

One thing that a shorter notice would gloss over: this does not mean no IP address of yours is recorded anywhere. When the analytics code in your browser sends an event to PostHog, PostHog records the IP address that connection came from. Our own server does not send it — the connection does — but the result is that IP addresses associated with visits are held in our PostHog account, and an IP address can be personal information. This is described in full under Third-Party Analytics below. If you select “Essential Only” on the cookie banner, that analytics code does not run and no such event, and therefore no IP address, is created.

How we understand our audience now

Our hosting provider, Vercel, necessarily processes every request in order to deliver this site to you, and produces aggregate reporting from it. We read that reporting. It tells us things like “450 requests came from a university network” or “this page was requested 900 times yesterday”.

•What we can see: the organisation or internet provider a request came from, the page requested, the approximate country and region, the referring site, and whether the request came from an automated crawler.
•What we cannot see: who you are. This reporting is aggregated and we do not receive individual IP addresses through it, cannot single out one visitor, and cannot follow you from one visit to the next.
•Why we look at it: to understand whether our published advocacy material is reaching the public institutions it concerns, to see which pages families actually use, and to distinguish real readers from the automated crawlers that make up most of our traffic.
•Retention: Vercel holds the underlying reporting for a limited window (currently 30 days) under their privacy policy. We keep the day-level totals described above indefinitely, because the question “did the institutions this material concerns read it, and when” matters for longer than 30 days.

Your choices

•Do Not Track and Global Privacy Control: we do not act on theDNT: 1 header or the Global Privacy Control (Sec-GPC: 1) signal. Between 9 and 16 September 2026 we did; that stopped on 16 September 2026. Neither signal carries legal force for a non-commercial Ontario site, and honouring them silently made a small share of visits invisible to the measurement this policy describes. The way to opt out is the cookie banner, below, and it works for every visitor from every country.
•Cookie choice: selecting “Essential Only” on our cookie banner stops the browser-side analytics described in the next section from capturing anything. It cannot switch off our hosting provider's own request handling, because that is how the page reaches you at all.
•Deletion: our own servers hold no record of your individual visit, only day-level totals that cannot be tied to you. The analytics record in our PostHog account can be deleted on request: tell us the dates you visited and, if you can, the identifier your browser holds (in your browser's local storage under a key beginning ph_). If you have contacted us, subscribed to the newsletter, or submitted a form, that information is separate and you can request its deletion through our contact form by selecting “Privacy Request”. We answer within 30 days.

Third-Party Analytics and Performance Monitoring

In addition to any analytics mentioned above, we use Vercel Analytics and Vercel Speed Insights (operated by Vercel Inc., United States) to collect anonymized page view data and Core Web Vitals performance metrics. This data helps us monitor site performance and does not include personally identifiable information.

We also use Microsoft Clarity (operated by Microsoft Corporation, United States) to collect anonymized behavioral data including heatmaps and aggregated session recordings. Clarity helps us understand how visitors interact with the site to improve usability. Clarity does not collect personally identifiable information. You can opt out of Clarity by selecting “Essential Only” on our cookie consent banner, or by visiting Microsoft's privacy statement.

We use PostHog (operated by PostHog, Inc., United States) for product analytics, and since 16 September 2026 we run it at its full capability rather than a minimised one. In your browser PostHog records: every page you open and how you got there; what you click or tap, including the visible text of the element; text you copy or select on our public pages; rapid repeated clicks and clicks that do nothing (signs a page is broken); where on the page people click and scroll (heatmaps); JavaScript errors; how fast the page and its resources loaded; the device and browser details listed under “Information Collected Automatically”; and a session recording of the visit. In that recording every form and input field is blanked out on your device before anything is sent, so what you type is never recorded, and pages that hold a family's private roadmap, wait clock or meeting request are excluded from click and copy capture entirely. If you select “Essential Only”, PostHog does not capture at all.

PostHog keeps an anonymous profile for your browser so that a return visit is recognised as the same browser. It is a random identifier stored in a first-party cookie and in your browser's local storage for up to one year. It is written by default for most visitors, which Canadian privacy law permits for measurement that is disclosed and can be refused; the one way to refuse is to select “Essential Only” on the cookie banner, after which PostHog does not run at all. This is the same for every visitor, wherever you are; we do not apply a different default for the UK, EU or EEA. We never attach your name, email or any other contact detail to that profile, and we do not attach an organisation label to it. PostHog may also show you a short optional survey; answering is voluntary.

To be accurate about one point that a shorter notice would gloss over: when your browser sends an event to PostHog, PostHog records the IP address that connection came from, along with approximate location derived from it. An IP address can be personal information, so we do not claim this processing is anonymous. We use it to tell real visitors from automated traffic and to report in aggregate which kinds of organisation our published material reaches — for example “a provincial government network” — never to identify you. We do not look up your IP address with any outside service. If you select “Essential Only”, the analytics code does not run and no event, and therefore no IP address, is created. Session recordings are kept for 30 days. You can learn more at PostHog's privacy policy.

Takedown and Corrections

If you believe content on this site is inaccurate, violates your privacy, or is defamatory, contact us with the URL and details of your concern. We will acknowledge your request within 5 business days and may remove or redact content while we assess.

For story withdrawal requests: you may request removal of your submitted story at any time by using our contact form. We will remove or anonymise the content within 10 business days. Note that content already shared with government officials or published in reports prior to your withdrawal request cannot be retroactively recalled.

See also our Corrections and Accuracy Policy for our data verification methodology and correction process.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date.

We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

End The Wait Ontario

Privacy inquiries: Contact form (select “Privacy Request”)

General contact: Contact Form

We aim to respond to privacy inquiries within 5 business days.

Privacy Resources

For more information about your privacy rights in Canada: