Privacy Policy

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what we collect, why, how we use and protect it, and your choices.

Two different privacy frameworks apply, depending on the service:

• Aesthetic services, retail, marketing, website use, and bookings for those services are governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
• Clinical foot and nail care involves Personal Health Information and is governed by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). Section 6 of this Policy sets out how we handle clinical health information.

Information used to arrange and administer clinical care—including clinical appointment details, related billing information and care-related messages—is handled through our clinical privacy processes. Clinical records are not used for marketing.

For clinical privacy questions, access or correction requests, or requests to share records with another clinic, contact our shared office at [email protected] or 226-840-0665. If known, tell us which clinic you attended or which clinic arranged your home visit so we can route your request appropriately.

Depending on the service, we may collect:

• Contact and booking information: name, phone number, email, appointment details.
• Payment information: processed by our payment provider; we do not store full card numbers.
• Aesthetic service information: service history, preferences, and allergy or sensitivity information relevant to nail and lash services.
• Clinical health information (clinical services only): health history, medications, foot and nail assessments, care plans, clinical photos, and related records — see Section 6.
• Communication preferences: including your SMS opt-in status.
• Reviews and feedback: any review, rating, or testimonial you choose to submit.
• Website information: as described in Section 9 (cookies and analytics).

We use your information to book and provide services, take payment, keep records (including clinical records for the clinical service), communicate with you about appointments, send promotional texts where you have opted in, meet legal and professional obligations, and improve our services.

We may also create and use de-identified and aggregate information — information that does not identify you — to understand and improve care and to support research, education, and advocacy for better access to foot care. De-identified information cannot reasonably be used to identify you and is not Personal Health Information.

If you opt in, we use your mobile number to send appointment reminders, booking confirmations, and clinic updates, and — where you have separately consented — promotional texts; our promotional texts are sent in accordance with Canada’s Anti-Spam Legislation (CASL), and you can opt out at any time by replying STOP. We use your email address only for communications related to your bookings and care (such as confirmations and reminders) — we do not send marketing newsletters.

We do not sell, rent, or share your mobile phone number or SMS opt-in information with third parties or affiliates for their marketing purposes; consent to receive texts is not shared with anyone. We also do not sell, rent, or share your email address with third parties for their own marketing.

This section applies to the clinical foot and nail care we provide — whether at a Clinical Wellness and Beauty clinic or at home through the Grey Bruce Mobile Foot Care home-care program — and to the Personal Health Information (PHI) we collect in providing that care.

• Health information custodian. For help identifying the person or organization responsible for your clinical record, contact our Privacy Contact. We will direct your request to the appropriate responsible party. This is an interim correction: the identification of the health information custodian for each location is being finalized, and the company that operates or bills for a location is not necessarily the health information custodian. This Privacy Policy is available on our website and at each clinic on request.
• Collection. We collect PHI directly from you — including your health history, relevant medications, foot and nail assessments, care plans, and clinical before/after photos — for the purpose of providing and documenting your clinical care.
• Consent and circle of care. We collect, use, and disclose your PHI with your consent for the purpose of providing you care. Within your “circle of care,” the members of the clinical team involved in your care — our Nurses and trained Clinical Foot Care Assistants, who work together to provide your foot and nail care — may access the information they need to provide and coordinate that care. Access is patient- and purpose-specific and limited to what is needed for the task at hand; being a member of the clinical team, booking your appointment, or processing a payment is not by itself permission to view your whole record.
• Withdrawing consent. You may withdraw your consent to our collection, use, or disclosure of your information at any time, subject to legal and clinical limits. Withdrawing consent for information we need to provide clinical care safely may affect the care we can provide, and we will explain this to you if it applies.
• Clinical photos. Before-and-after foot photos are part of your clinical record. They are used only for your care and clinical documentation and are not used for marketing or any other purpose without your separate, explicit written consent.
• Kept separate from marketing. We keep clinical Personal Health Information separate from the information we use for bookings, retail, and marketing. Clinical records are held in our clinical system under role-based access and are never combined with, or used for, marketing or promotional purposes.
• Disclosure. We do not disclose your PHI outside your circle of care except with your consent or as permitted or required by law (for example, to another health care provider you are referred to, or where the law requires disclosure).
• De-identified data. We may use de-identified or aggregate information for research, education, and advocacy, as described in Section 4. De-identified information does not identify you and is not Personal Health Information.
• Clinical records. Your clinical records are kept securely, with access limited to your clinical team as described above and protected by the safeguards described in Section 11.
• Your PHIPA rights. You have the right to access your health records and to request a correction if you believe they are inaccurate or incomplete, subject to the limited exceptions in PHIPA. To exercise these rights, contact our Privacy Contact (Section 2).
• Oversight. If you have a concern about how we handle your PHI, you may contact us, and you have the right to complain to the Information and Privacy Commissioner of Ontario (IPC).

Clinical consent. We obtain informed consent for proposed clinical care. Capacity is considered for the particular decision. When a client cannot make that decision, we follow the applicable substitute-decision-making process. Consent to treatment is distinct from consent concerning health information and from optional marketing consent.

Family involvement. We involve family members or caregivers with your permission, through an appropriately authorized substitute decision-maker where applicable, or as otherwise permitted or required by law. Booking or paying for a visit does not automatically entitle someone to receive your clinical information.

Planned transfer of clinic. If you move or prefer another clinic, we can help arrange a switch at your request. For a planned transfer between our clinic companies, our usual process is to obtain your signed authorization to securely share relevant records with the receiving clinic. A change of address does not automatically transfer your care or give another clinic access to your records. The originating provider retains records according to applicable retention obligations. Other disclosures permitted or required by law are handled accordingly.

If a photo would help us prepare Our team may ask whether you are comfortable sending a foot or nail photo to our business phone number to help us understand your enquiry and prepare for your visit. A photo does not replace an assessment or confirm a diagnosis. Please speak with our team first for sending instructions. We do not ask for your health-card number or full medical history in an initial enquiry.

A photograph of a foot or nail that is linked to you can itself be health information, and cropping out a face does not make an image anonymous. Ordinary text messages, picture messages and email are not guaranteed to be private or end-to-end encrypted. Please contact our team for instructions before sending sensitive information. Any image you send that becomes part of your care is added to your clinical record and handled under this Section 6.

Payments are processed by our payment provider. We receive confirmation of payment and limited transaction details, but we do not collect or store your full card number.

We share limited information with service providers only as needed to run our business — for example, our third-party booking and scheduling provider, our payment processor, and our text-messaging provider. These providers are permitted to use your information only to provide services to us, not for their own marketing. As stated in Section 5, we do not sell, rent, or share your mobile number or SMS opt-in information for marketing purposes.

Where your information is stored. Some of our service providers — for example, our scheduling, payment, and text-messaging providers — may store or process information outside Canada. Where that happens, your information is subject to the laws of the country where it is stored and may be accessible to authorities there under those laws. We take reasonable steps to ensure our providers protect your information. Details about where information is stored, and about our service providers, are available from our Privacy Contact (Section 2).

Our websites use cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used (analytics). Where we use analytics or marketing/advertising cookies, we use them only as described in this Policy. You can control or refuse cookies through your browser settings or, where offered, our cookie banner; disabling some cookies may affect how the site works.

We keep personal information only as long as needed for the purposes described here or as required by law and professional standards. As a matter of our adopted retention policy, we retain clinical health records for at least ten years after your last visit (or, in the case of a minor, for at least ten years after the day the minor reached or would have reached the age of majority). This ten-year period reflects our current adopted policy rather than a single fixed statutory period, and we review and update it as our obligations require.

We use reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access, use, or disclosure. Clinical health information is subject to additional safeguards appropriate to its sensitivity, including role-based access controls.

If a privacy breach occurs, we act promptly to contain it and assess the risk. Where the law requires, we will notify affected individuals and the appropriate regulator. For breaches involving Personal Health Information, we will notify affected individuals and the Information and Privacy Commissioner of Ontario (IPC) as required under PHIPA. For breaches involving other personal information that create a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA, and we keep records of breaches as required by law. Where we notify you, the notice will describe the breach, the steps we have taken in response, and how to contact us.

You may request access to the personal information we hold about you, ask us to correct it, or withdraw your consent to certain uses (such as promotional texts) — subject to legal and professional limits. Access to and correction of clinical health information is handled under PHIPA as described in Section 6. To make a request, contact our Privacy Contact (Section 2).

Where we provide services to a minor, we handle their information with the consent of a parent or guardian, and, for clinical services, in accordance with PHIPA.

We may update this Privacy Policy from time to time. The current version, with its effective date, will be posted on our website.

If you have a question or concern about your privacy or how we handle your information, please contact us first using the details in Section 2 — we want the chance to understand and make it right.

You also have the right to raise a concern with the relevant regulator: the Information and Privacy Commissioner of Ontario (IPC) for Personal Health Information (clinical services), or the Office of the Privacy Commissioner of Canada (OPC) for other personal information under PIPEDA.