Privacy Policy

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what we collect, why, how we use and protect it, and your choices.

Two different privacy frameworks apply, depending on the service:

• Aesthetic services, retail, marketing, bookings, and website use are governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
• Clinical foot and nail care involves Personal Health Information and is governed by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA). Section 6 of this Policy sets out how we handle clinical health information.

Privacy questions, access requests, and complaints can be directed to:

Depending on the service, we may collect:

• Contact and booking information: name, phone number, email, appointment details.
• Payment information: processed by our payment provider; we do not store full card numbers.
• Aesthetic service information: service history, preferences, and allergy or sensitivity information relevant to nail and lash services.
• Clinical health information (clinical services only): health history, medications, foot and nail assessments, care plans, clinical photos, and related records — see Section 6.
• Communication preferences: including your SMS opt-in status.
• Reviews and feedback: any review, rating, or testimonial you choose to submit.
• Website information: as described in Section 9 (cookies and analytics).

We use your information to book and provide services, take payment, keep records (including clinical records for the clinical service), communicate with you about appointments, send promotional texts where you have opted in, meet legal and professional obligations, and improve our services.

We may also create and use de-identified and aggregate information — information that does not identify you — to understand and improve care and to support research, education, and advocacy for better access to foot care. De-identified information cannot reasonably be used to identify you and is not Personal Health Information.

If you opt in, we use your mobile number to send appointment reminders and, where you have separately consented, promotional texts; our promotional texts are sent in accordance with Canada’s Anti-Spam Legislation (CASL), and you can opt out at any time by replying STOP. We use your email address only for communications related to your bookings and care (such as confirmations and reminders) — we do not send marketing newsletters.

We do not sell, rent, or share your mobile phone number or SMS opt-in information with third parties or affiliates for their marketing purposes; consent to receive texts is not shared with anyone. We also do not sell, rent, or share your email address with third parties for their own marketing.

This section applies to the clinical foot and nail care we provide — whether at a Clinical Wellness and Beauty clinic or at home through the Grey Bruce Mobile Foot Care home-care program — and to the Personal Health Information (PHI) we collect in providing that care.

• Health information custodian. For clinical services, the Phamily Enterprise entity that operates your clinic or the home-care program is the health information custodian, and our Foot Care Nurses and supervised technicians act as its agents under PHIPA. The specific entity for your location is available on request and is identified on your clinical consent form. This Privacy Policy is the custodian’s public statement under PHIPA and is available on our website and at each clinic on request.
• Collection. We collect PHI directly from you — including your health history, relevant medications, foot and nail assessments, care plans, and clinical before/after photos — for the purpose of providing and documenting your clinical care.
• Consent and circle of care. We collect, use, and disclose your PHI with your consent for the purpose of providing you care. Within your “circle of care,” members of the clinical team involved in your care — including our Foot Care Nurses and supervised technicians — may access the information they need to provide and oversee that care. Access is limited by role: technicians see a limited, safety-relevant view, while our Foot Care Nurses (including the Lead Foot Care Nurse) have full clinical access.
• Withdrawing consent. You may withdraw your consent to our collection, use, or disclosure of your information at any time, subject to legal and clinical limits. Withdrawing consent for information we need to provide clinical care safely may affect the care we can provide, and we will explain this to you if it applies.
• Clinical photos. Before-and-after foot photos are part of your clinical record. They are used only for your care and clinical documentation and are not used for marketing or any other purpose without your separate, explicit written consent.
• Kept separate from marketing. We keep clinical Personal Health Information separate from the information we use for bookings, retail, and marketing. Clinical records are held in our clinical system under role-based access and are never combined with, or used for, marketing or promotional purposes.
• Disclosure. We do not disclose your PHI outside your circle of care except with your consent or as permitted or required by law (for example, to another health care provider you are referred to, or where the law requires disclosure).
• De-identified data. We may use de-identified or aggregate information for research, education, and advocacy, as described in Section 4. De-identified information does not identify you and is not Personal Health Information.
• Clinical records. Your clinical records are kept securely, with access limited to your clinical team as described above and protected by the safeguards described in Section 11.
• Your PHIPA rights. You have the right to access your health records and to request a correction if you believe they are inaccurate or incomplete, subject to the limited exceptions in PHIPA. To exercise these rights, contact our Privacy Contact (Section 2).
• Oversight. If you have a concern about how we handle your PHI, you may contact us, and you have the right to complain to the Information and Privacy Commissioner of Ontario (IPC).

Payments are processed by our payment provider. We receive confirmation of payment and limited transaction details, but we do not collect or store your full card number.

We share limited information with service providers only as needed to run our business — for example, our third-party booking and scheduling provider, our payment processor, and our text-messaging provider. These providers are permitted to use your information only to provide services to us, not for their own marketing. As stated in Section 5, we do not sell, rent, or share your mobile number or SMS opt-in information for marketing purposes.

Where your information is stored. Some of our service providers — for example, our scheduling, payment, and text-messaging providers — may store or process information on servers located outside Canada, including in the United States. Where that happens, your information is subject to the laws of the country where it is stored and may be accessible to authorities there under those laws. We take reasonable steps to ensure our providers protect your information. For questions about our service providers or how your information is handled, contact our Privacy Contact (Section 2).

Our websites use cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used (analytics). Where we use analytics or marketing/advertising cookies, we use them only as described in this Policy. You can control or refuse cookies through your browser settings or, where offered, our cookie banner; disabling some cookies may affect how the site works.

We keep personal information only as long as needed for the purposes described here or as required by law and professional standards. Clinical health records are retained for at least ten years after your last visit (or, in the case of a minor, for at least ten years after the day the minor reached or would have reached the age of majority), consistent with College of Nurses of Ontario requirements, and we update this period if the law changes.

We use reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access, use, or disclosure. Clinical health information is subject to additional safeguards appropriate to its sensitivity, including role-based access controls.

If a privacy breach occurs, we act promptly to contain it and assess the risk. Where the law requires, we will notify affected individuals and the appropriate regulator. For breaches involving Personal Health Information, we will notify affected individuals and the Information and Privacy Commissioner of Ontario (IPC) as required under PHIPA. For breaches involving other personal information that create a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA, and we keep records of breaches as required by law. Where we notify you, the notice will describe the breach, the steps we have taken in response, and how to contact us.

You may request access to the personal information we hold about you, ask us to correct it, or withdraw your consent to certain uses (such as promotional texts) — subject to legal and professional limits. Access to and correction of clinical health information is handled under PHIPA as described in Section 6. To make a request, contact our Privacy Contact (Section 2).

Where we provide services to a minor, we handle their information with the consent of a parent or guardian, and, for clinical services, in accordance with PHIPA.

We may update this Privacy Policy from time to time. The current version, with its effective date, will be posted on our website.

If you have a question or concern about your privacy or how we handle your information, please contact us first using the details in Section 2 — we want the chance to understand and make it right.

You also have the right to raise a concern with the relevant regulator: the Information and Privacy Commissioner of Ontario (IPC) for Personal Health Information (clinical services), or the Office of the Privacy Commissioner of Canada (OPC) for other personal information under PIPEDA.