Last updated: October 16, 2026
DermaZone Medical Spa (“DermaZone”, “we”, “us”) is a medical aesthetics clinic at 481 Morden Rd, Unit 3, Oakville, Ontario L6K 3W6, Canada. This policy explains how we collect, use, share and protect personal information when you visit dermazone.ca, contact us, book an appointment or receive treatment.
We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles. [IF TREATMENTS ARE PROVIDED BY REGULATED HEALTH PROFESSIONALS: When we collect personal health information to provide care, we also follow Ontario’s Personal Health Information Protection Act, 2004 (PHIPA).]
We have named a Privacy Officer who is responsible for our compliance with this policy and with privacy law:
Everyone who works with us, and every service provider who handles personal information for us, is required to protect it.
We only collect what we need for the purposes listed in section 4.
We collect most information directly from you. We may receive limited information from Square (for bookings), from social media platforms when you message us, or from another health provider with your permission.
We use personal information to:
We will not use your information for a new purpose without telling you and, where required, asking for your consent.
We never use health information, consultation answers or treatment photos for advertising, ad targeting or audience building.
We rely on your consent to collect, use and share personal information, except where the law allows otherwise.
You may withdraw consent at any time, subject to legal or contractual limits, by contacting our Privacy Officer. We will explain the likely consequences. For example, we may not be able to treat you safely without your medical history, and we must keep records the law requires.
Health information and photos are treated as highly sensitive. Access is limited to the staff who need it to care for you. Before/after photos:
We do not sell personal information. We share it only as needed with:
| Recipient | What they do | Where data may be stored |
|---|---|---|
| Square (Block, Inc.) | Online booking, client records, payments | Canada and/or United States |
| Website hosting provider and Convex Studio (web developer) | Hosting and maintaining the website | Canada |
| Email provider – Google (Gmail / Google Workspace) | Email communication | United States and other countries |
| Google (Analytics, Maps, Fonts) | Website statistics, map display | United States and other countries |
| Meta (Instagram) | Instagram feed shown on our website | United States and other countries |
| Iriscale | Social media scheduling and marketing management | United States and other countries |
We may also disclose information: to another health professional with your consent; if required or permitted by law (for example, a court order or regulatory body); to protect someone’s safety in an emergency; or as part of a sale or transfer of our business, subject to confidentiality obligations.
Our service providers may only use your information to provide services to us, and must protect it with safeguards comparable to ours.
Some of our service providers store or process information outside Canada, mainly in the United States. While there, it is protected by contract but may be accessible to courts, law enforcement and national security authorities of that country under its laws.
We send promotional emails or texts only with your consent, as required by Canada’s anti-spam legislation (CASL). Every message identifies DermaZone and includes an easy way to unsubscribe. We process unsubscribe requests within 10 business days. You will still receive messages about appointments you booked.
We keep personal information only as long as needed for the purposes above or as required by law:
When information is no longer needed, we securely destroy, delete or anonymize it. If you have asked to see your information, we keep it long enough for you to exercise your rights.
We use safeguards appropriate to the sensitivity of the information, including:
No method of transmission or storage is completely secure. Please do not send health information through social media direct messages or unencrypted email.
If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you as soon as feasible. We will also report it to the Office of the Privacy Commissioner of Canada, as PIPEDA requires. We keep a record of every breach for at least 24 months. [IF PHIPA APPLIES: If personal health information is stolen, lost or used or disclosed without authority, we will notify you at the first reasonable opportunity and, where required, the Information and Privacy Commissioner of Ontario.]
You may ask to:
Send your request in writing to our Privacy Officer. We may ask you to confirm your identity. We will respond within 30 days, or tell you if we need more time and why, as the law allows. Access is free or at minimal cost; we will tell you the cost first. If we refuse a request, we will explain why and how you can challenge it.
Our website is not directed to children. We do not knowingly collect information online from anyone under 13. Treatments for anyone under 18 require [CONSENT OF A PARENT OR GUARDIAN AND AN IN-PERSON CONSULTATION – CONFIRM CLINIC RULE]. Consent for health care is assessed based on the person’s capacity, as Ontario law requires.
Our website links to and embeds content from third parties (such as Square, Google Maps, Facebook and Instagram). Their own privacy policies apply when you use their services.
Please contact our Privacy Officer first; we will investigate and respond. If you are not satisfied, you may complain to:
We may update this policy. The “Last updated” date shows the latest version. If we make important changes to how we use personal information, we will tell you before they apply and ask for consent where required.