Privacy Policy

1. Definitions

“Personal Information” means any information about an identifiable individual, including but not limited to name, contact details, payment information, health and skin information, and browsing behaviour.

“Sensitive Personal Information” means personal information that is particularly sensitive by its nature, including health information, medical history, skin condition information, and any information you share during consultations or treatment sessions.

“Processing” means any operation performed on personal information, including collection, storage, use, disclosure, and deletion.

“Client” means any individual who has booked or received a service at Balanced Beauty Med Spa.

“Visitor” means any individual who browses our website without necessarily booking a service.

2. Who We Are and How to Contact Us

Business name: Balanced Beauty Med Spa

Address: 700 Chrislea Rd, Woodbridge, ON L4L 8K9

Province: Ontario, Canada

Email: [email protected]

Phone: 647-239-0231

Website: balancedbeautymedspa.ca

For any privacy-related inquiries, complaints, or requests, please contact us at the email above. We designate the business owner as our Privacy Officer responsible for overseeing compliance with this Policy.

3. What Personal Information We Collect

3.1 Information You Provide Directly

• Full name and preferred name
• Email address and phone number
• Date of birth (where required for treatment eligibility, e.g., laser treatments)
• Mailing address (for product orders)
• Health and medical history relevant to your treatments, including medications, allergies, skin conditions, prior aesthetic treatments, pregnancy status, and contraindications
• Intake form responses, consultation notes, and treatment records
• Payment information (processed through our PCI-DSS-compliant payment gateway, we do not store raw card numbers on our systems)
• Communications you send us via email, phone, contact forms, or social media
• Photos taken before and after treatments (with your explicit consent)
• Reviews, testimonials, or feedback you provide
• Lead capture form responses (skin concerns, current skincare routine, email address)
• Product orders, preferences, and purchase history

3.2 Information Collected Automatically When You Visit Our Website

• IP address and approximate geographic location (city/region level)
• Browser type, version, and operating system
• Device type (mobile, tablet, desktop) and screen resolution
• Pages visited, time on each page, and navigation paths
• Referring URL (where you came from before landing on our site)
• Search terms used to find our site
• Cookies and similar tracking technologies (see Section 11)
• Session recordings (if analytics software captures anonymized scrolling/click behaviour)
• Form abandonment data (whether you started but did not complete a form)

3.3 Information from Third Parties

• Booking data from our online booking platform (Fresha or similar) when you schedule appointments
• Payment transaction data from our payment processor (WooCommerce / Stripe / Square)
• Social media profile information if you contact us through Instagram or Facebook
• Google Analytics and similar analytics services (aggregated, anonymized traffic data)
• Advertising platform data if you click on our ads (Google Ads, Meta Ads)
• Referral information if you were referred by another client

3.4 Special Categories, Health and Skin Information

In the course of providing aesthetic medical treatments, we collect sensitive health and skin-related information. This includes but is not limited to:

• Skin type, tone, and condition (Fitzpatrick scale classification)
• Active or historical skin conditions (acne, rosacea, eczema, melasma, hyperpigmentation)
• Medical history relevant to treatments (autoimmune conditions, diabetes, bleeding disorders)
• Current medications and supplements (especially those affecting skin sensitivity: retinoids, antibiotics, blood thinners, photosensitizing medications)
• Pregnancy status and trimester (required for treatment eligibility and product selection)
• History of keloids, abnormal scarring, or hypertrophic scarring
• Prior cosmetic procedures (Botox, fillers, laser treatments, chemical peels)
• Allergies to skincare ingredients, latex, numbing agents, or other treatment products
• Fitzpatrick skin type for laser parameter setting
• Treatment outcomes and skin responses documented after each session

This health information is collected and used solely to deliver safe, appropriate, and effective treatments. It is treated with the highest level of confidentiality and is not shared with third parties except as required by law or in medical emergencies.

4. Why We Collect and How We Use Your Information

4.1 Service Delivery

• To process appointment bookings and send confirmations and reminders
• To conduct pre-treatment consultations and skin assessments
• To perform treatments safely and effectively based on your individual health profile
• To document treatment records and track results over time
• To send post-treatment aftercare instructions
• To process product purchases and fulfill orders
• To communicate appointment changes, service updates, or safety recalls

4.2 Business Operations

• To manage client records and maintain accurate business records
• To process payments and maintain accounting records
• To analyze service trends and improve our treatment protocols
• To train staff (using anonymized or consented information only)
• To respond to inquiries and customer service requests

4.3 Marketing and Communications (With Consent)

• To send you promotional emails, offers, and newsletters if you have opted in
• To display targeted advertising on Google or Meta platforms (using anonymized audience data)
• To request reviews or testimonials after treatments
• To share before-and-after photos on our website or social media (only with your explicit written consent)
• To conduct client satisfaction surveys

4.4 Legal and Compliance

• To comply with Ontario health recordkeeping requirements
• To comply with PIPEDA and any applicable provincial privacy legislation
• To respond to legal requests, court orders, or regulatory inquiries
• To investigate and prevent fraud, abuse, or misuse of our services
• To enforce our Terms of Use and other agreements

5. Legal Bases for Processing

Under PIPEDA, we rely on the following legal bases to collect and process your personal information:

• Consent: You provide explicit consent when you complete intake forms, book appointments, opt into marketing, or consent to photography. You may withdraw consent at any time (see Section 9)
• Contract: Processing is necessary to fulfill our service agreement with you (delivering treatments, processing payments, managing bookings)
• Legal obligation: We must retain certain records under Ontario law (health records, tax records, etc.)
• Legitimate interests: We process certain data for fraud prevention, website security, analytics, and business improvement, where these interests do not override your privacy rights

6. How We Share Your Information

We do NOT sell, rent, or trade your personal information to third parties for their own commercial purposes. We share your information only in the following limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers who process data on our behalf, subject to contractual data protection obligations:

• Booking platforms (Fresha or equivalent), appointment scheduling and management
• Payment processors (Stripe, Square, or WooCommerce payment gateway), payment processing
• Email service providers, sending appointment confirmations and marketing emails
• Website hosting and security providers, hosting our WordPress/Elementor website
• Analytics providers (Google Analytics, etc.), understanding website usage
• Cloud storage providers, secure storage of business records

6.2 Legal Requirements

• If required by law, regulation, court order, or government authority
• To respond to a lawful request from law enforcement or regulatory bodies
• To protect the rights, property, or safety of our business, clients, or the public
• In connection with legal proceedings or anticipated legal proceedings

6.3 Business Transfers

In the event of a sale, merger, acquisition, or transfer of our business, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

6.4 Medical Emergencies

If you experience a medical emergency during a treatment, we may share relevant health information with emergency medical personnel as required to protect your health and safety.

6.5 With Your Consent

We will share your information with third parties in any other circumstances only with your explicit prior consent.

7. International Data Transfers

Our website, booking platform, and email services may involve the transfer of your data to servers located outside of Canada. Where we transfer data internationally, we take steps to ensure appropriate safeguards are in place, including standard contractual clauses or other mechanisms recognized under PIPEDA.

Service providers we use that may process data outside Canada include Google (United States), Meta (United States), and Stripe (United States). All are bound by privacy frameworks applicable to Canadian user data.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, plus any additional period required by law:

• Client treatment records and health intake forms: minimum 10 years from date of last treatment, as required under Ontario health recordkeeping guidelines for aesthetic practitioners
• Before-and-after photos: retained for the duration of your client relationship plus 5 years, unless you request earlier deletion
• Payment and transaction records: 7 years from the date of transaction, as required under the Income Tax Act (Canada)
• Appointment booking data: 3 years from your last appointment
• Marketing consent records: retained until consent is withdrawn, plus 1 year to demonstrate compliance
• Website analytics data: typically 26 months (Google Analytics default)
• Cookie consent records: 3 years
• Email correspondence: 3 years or as long as relevant to an active client relationship
• Unsigned draft client records or enquiry-only contacts: 12 months

Upon expiry of the applicable retention period, we securely delete or anonymize your personal information.

9. Your Rights

Subject to applicable law and reasonable limitations, you have the following rights regarding your personal information:

9.1 Right of Access

You have the right to request a copy of the personal information we hold about you. We will provide this within 30 days of receiving a valid written request. There is no fee for a reasonable access request; we may charge a nominal fee for extensive or repeated requests.

9.2 Right to Correction

If you believe that any personal information we hold about you is inaccurate, incomplete, or outdated, you have the right to request that we correct it.

9.3 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal. Note that withdrawing consent for certain processing (e.g., treatment records) may affect our ability to provide services to you.

9.4 Right to Deletion (“Right to Be Forgotten”)

You may request deletion of your personal information. We will comply where there is no legal or contractual reason to retain the information (e.g., mandatory health recordkeeping requirements may prevent full deletion of treatment records).

9.5 Right to Data Portability

You may request that we provide your personal information in a structured, machine-readable format so that it can be transferred to another service provider.

9.6 Right to Lodge a Complaint

If you have concerns about how we handle your personal information and are not satisfied with our response, you have the right to lodge a complaint with:

Office of the Privacy Commissioner of Canada (OPC):

Website: www.priv.gc.ca

Phone: 1-800-282-1376

Address: 30 Victoria Street, Gatineau, QC K1A 1H3

To exercise any of the above rights, submit your request in writing to [email protected]. We will respond within 30 days. We may require proof of identity before processing your request.

10. Security Measures

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction:

10.1 Technical Measures

• SSL/TLS encryption on all data transmitted between your browser and our website
• PCI-DSS-compliant payment processing, raw card data is never stored on our servers
• Secure, password-protected systems for accessing client records
• Regular software updates and security patches on our website and plugins
• Firewall and malware protection on our hosting environment

10.2 Organizational Measures

• Access to client health records is limited to Milena (the treating practitioner) and authorized personnel only
• Confidentiality obligations are in place for any staff or contractors who handle client data
• Physical records (if any) are stored in secured, locked facilities
• Secure disposal of records when retention periods expire

10.3 Data Breach Response

In the event of a data breach that creates a real risk of significant harm to individuals, we will:

• Notify the Office of the Privacy Commissioner of Canada as soon as feasible
• Notify affected individuals as soon as feasible
• Maintain records of all breaches for a minimum of 24 months
• Take immediate steps to contain and investigate the breach

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. For full details, please review our separate Cookie Policy. In summary:

• Strictly necessary cookies: essential for website function; cannot be disabled
• Analytics cookies: help us understand site usage (Google Analytics, you can opt out via tools.google.com/dlpage/gaoptout)
• Marketing cookies: used for retargeting if we run ad campaigns (Meta Pixel, Google Ads)
• Functional cookies: remember your preferences
• You can manage cookie preferences through our cookie consent banner or your browser settings

12. Children’s Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, a parent or legal guardian must be present for any consultation, intake, or treatment at Balanced Beauty Med Spa.

If we become aware that we have inadvertently collected personal information from a person under 18 without verified parental consent, we will promptly delete that information. If you believe we may have collected information from a minor, please contact us immediately.

13. Third-Party Links and Embedded Content

Our website may contain links to third-party websites (including our booking platform, social media pages, and product brand websites) and may embed third-party content (e.g., Google Maps, YouTube videos, Instagram feeds). These third parties have their own privacy policies, which we do not control. We encourage you to review the privacy policies of any third-party sites you visit.

14. Before-and-After Photography

We may photograph your skin before and after treatments to document treatment progress and results. You will be asked for explicit written consent before any photography is taken. Specifically:

• We will always ask your consent before taking any photos
• Consent to internal documentation (for your treatment record only) is separate from consent to use photos for marketing purposes
• You may consent to one without consenting to the other
• If you consent to marketing use, photos may appear on our website, social media, or promotional materials
• You may withdraw consent for marketing use of photos at any time, but we cannot remove photos already published to third-party platforms (e.g., Instagram)
• Photos used for marketing will never include identifying information without separate explicit consent

15. Marketing Communications

We will only send you marketing emails, SMS, or other promotional communications if you have explicitly opted in. Each marketing communication will include a clear, easy unsubscribe option.

We use your email address for marketing purposes only if you have provided consent through our website, lead capture form, or other opt-in mechanism. You may unsubscribe at any time by clicking “unsubscribe” in any marketing email or by contacting us directly.

We do not conduct cold calling or unsolicited outreach to prospective clients without prior consent.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the “Last Reviewed” date at the top of this Policy
• Post the updated Policy on our website
• Where required, notify affected individuals directly by email

Your continued use of our website or services after the effective date of an updated Policy constitutes your acceptance of the changes.

17. Contact Our Privacy Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Privacy Officer: Milena, Owner

Business: Balanced Beauty Med Spa

Address: 700 Chrislea Rd, Woodbridge, ON L4L 8K9

Email: [email protected]

Phone: 647-239-0231

Website: balancedbeautymedspa.ca

We are committed to resolving privacy complaints promptly. We will acknowledge receipt of your complaint within 5 business days and aim to resolve all complaints within 30 days.