Last updated: October 16, 2026

1. Who we are

DermaZone Medical Spa (“DermaZone”, “we”, “us”) is a medical aesthetics clinic at 481 Morden Rd, Unit 3, Oakville, Ontario L6K 3W6, Canada. This policy explains how we collect, use, share and protect personal information when you visit dermazone.ca, contact us, book an appointment or receive treatment.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles. [IF TREATMENTS ARE PROVIDED BY REGULATED HEALTH PROFESSIONALS: When we collect personal health information to provide care, we also follow Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).]

2. Accountability and our Privacy Officer

We have named a Privacy Officer who is responsible for our compliance with this policy and with privacy law:

  • Privacy Officer: Dominika
  • Email: dermazonemedspa@gmail.com
  • Phone: 289-255-1199
  • Mail: 481 Morden Rd, Unit 3, Oakville, ON L6K 3W6

Everyone who works with us, and every service provider who handles personal information for us, is required to protect it.

3. Information we collect

We only collect what we need for the purposes listed in section 4.

  • Contact and identity information: name, phone number, email address and mailing address.
  • Appointment and payment information: services booked, appointment dates, booking history, deposits, payments and refunds. Card payments are processed by Square; we do not store full card numbers.
  • Health and consultation information (sensitive): medical history, medications, allergies, skin type, contraindications, pregnancy status, consultation notes, treatment records and consent forms.
  • Photographs (sensitive): before/after and progress photos of the treated area, taken only with your express consent (see section 6).
  • Communications: messages you send us by email, phone, text, contact forms or social media.
  • Website and device information: IP address, browser type, device type, pages visited, referring website and similar data collected by cookies and similar technologies (see our Cookie Policy).

We collect most information directly from you. We may receive limited information from Square (for bookings), from social media platforms when you message us, or from another health provider with your permission.

4. Why we use your information

We use personal information to:

  1. Book, confirm, reschedule and remind you of appointments.
  2. Assess whether a treatment is safe and suitable for you, provide the treatment and keep accurate treatment records.
  3. Process payments, deposits, packages and refunds.
  4. Answer your questions and provide customer service.
  5. Send you marketing emails or texts, only if you have given consent (see section 9).
  6. Operate, secure and improve our website, and measure how it is used.
  7. Meet our legal, regulatory, insurance and professional record-keeping obligations.

We will not use your information for a new purpose without telling you and, where required, asking for your consent.

We never use health information, consultation answers or treatment photos for advertising, ad targeting or audience building.

5. Consent

We rely on your consent to collect, use and share personal information, except where the law allows otherwise.

  • Express consent is required for sensitive information: health and consultation information, before/after photos, and any use of your image in marketing. We ask for it in writing (paper or electronic).
  • Implied consent may apply to less sensitive uses that you would reasonably expect, such as using your phone number to confirm an appointment you booked.
  • Website cookies: see our Cookie Policy. Advertising and tracking cookies can be refused at any time.

You may withdraw consent at any time, subject to legal or contractual limits, by contacting our Privacy Officer. We will explain the likely consequences. For example, we may not be able to treat you safely without your medical history, and we must keep records the law requires.

6. Health information and photos

Health information and photos are treated as highly sensitive. Access is limited to the staff who need it to care for you. Before/after photos:

  • are taken only with your separate written consent;
  • are kept in paper files at our clinic;
  • are never published on our website or social media unless you sign a separate publication consent. You may withdraw that consent at any time. We will stop new uses and remove the photo from channels we control, but we cannot recall copies others have already shared or saved.

7. Who we share information with

We do not sell personal information. We share it only as needed with:

Recipient What they do Where data may be stored
Square (Block, Inc.) Online booking, client records, payments Canada and/or United States
Website hosting provider and Convex Studio (web developer) Hosting and maintaining the website Canada
Email provider – Google (Gmail / Google Workspace) Email communication United States and other countries
Google (Analytics, Maps, Fonts) Website statistics, map display United States and other countries
Meta (Instagram) Instagram feed shown on our website United States and other countries
Iriscale Social media scheduling and marketing management United States and other countries

We may also disclose information: to another health professional with your consent; if required or permitted by law (for example, a court order or regulatory body); to protect someone’s safety in an emergency; or as part of a sale or transfer of our business, subject to confidentiality obligations.

Our service providers may only use your information to provide services to us, and must protect it with safeguards comparable to ours.

8. Processing outside Canada

Some of our service providers store or process information outside Canada, mainly in the United States. While there, it is protected by contract but may be accessible to courts, law enforcement and national security authorities of that country under its laws.

9. Marketing communications

We send promotional emails or texts only with your consent, as required by Canada’s anti-spam legislation (CASL). Every message identifies DermaZone and includes an easy way to unsubscribe. We process unsubscribe requests within 10 business days. You will still receive messages about appointments you booked.

10. How long we keep information

We keep personal information only as long as needed for the purposes above or as required by law:

  • Client and treatment records, consent forms and photos: [10 YEARS AFTER THE LAST VISIT – CONFIRM, OR LONGER IF A PROFESSIONAL COLLEGE REQUIRES IT; FOR MINORS, UNTIL [X] YEARS AFTER THEY TURN 18].
  • Financial records: at least 6 years, as required by tax law.
  • Marketing consent records: as long as you are on our list, plus [3 YEARS] as proof of consent.
  • Website analytics data: [14 MONTHS – CONFIRM IN GOOGLE ANALYTICS SETTINGS].
  • Website contact messages: [24 MONTHS].

When information is no longer needed, we securely destroy, delete or anonymize it. If you have asked to see your information, we keep it long enough for you to exercise your rights.

11. How we protect information

We use safeguards appropriate to the sensitivity of the information, including:

  • Physical: paper records in locked cabinets; restricted access to treatment areas and devices.
  • Organizational: access only for staff who need it; confidentiality commitments; privacy training.
  • Technical: password-protected and two-factor accounts; encrypted connection (HTTPS) on our website; software updates; reputable providers for booking and payments.

No method of transmission or storage is completely secure. Please do not send health information through social media direct messages or unencrypted email.

12. Privacy breaches

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you as soon as feasible. We will also report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires. We keep a record of every breach for at least 24 months. [IF PHIPA APPLIES: If personal health information is stolen, lost or used or disclosed without authority, we will notify you at the first reasonable opportunity and, where required, the Information and Privacy Commissioner of Ontario.]

13. Your rights: access and correction

You may ask to:

  • see the personal information we hold about you and how it has been used and shared;
  • correct information that is inaccurate or incomplete;
  • withdraw consent to marketing or other optional uses.

Send your request in writing to our Privacy Officer. We may ask you to confirm your identity. We will respond within 30 days, or tell you if we need more time and why, as the law allows. Access is free or at minimal cost; we will tell you the cost first. If we refuse a request, we will explain why and how you can challenge it.

14. Children and minors

Our website is not directed to children. We do not knowingly collect information online from anyone under 13. Treatments for anyone under 18 require [CONSENT OF A PARENT OR GUARDIAN AND AN IN-PERSON CONSULTATION – CONFIRM CLINIC RULE]. Consent for health care is assessed based on the person’s capacity, as Ontario law requires.

15. Links and social media

Our website links to and embeds content from third parties (such as Square, Google Maps, Facebook and Instagram). Their own privacy policies apply when you use their services.

16. Questions and complaints

Please contact our Privacy Officer first; we will investigate and respond. If you are not satisfied, you may complain to:

  • Office of the Privacy Commissioner of Canada – www.priv.gc.ca – 1-800-282-1376
  • Information and Privacy Commissioner of Ontario – www.ipc.on.ca – 1-800-387-0073

17. Changes to this policy

We may update this policy. The “Last updated” date shows the latest version. If we make important changes to how we use personal information, we will tell you before they apply and ask for consent where required.