This policy explains how Activate Beauty handles personal information and personal health information at our clinic at 2312A Bloor St W, 2nd Floor, Toronto, ON M6S 1P2.
Activate Beauty (“we”, “us”, “our”) is committed to protecting your privacy and your personal health information.
We operate from 2312A Bloor Street West, 2nd Floor, Toronto, Ontario M6S 1P2. This Privacy Policy explains how we collect, use, disclose, and protect personal information and personal health information (“PHI”) in compliance with the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”), Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”), Canada’s Anti-Spam Legislation (“CASL”), and, where applicable, the EU General Data Protection Regulation (“GDPR”) and Quebec’s Law 25.
Our clinic is the Health Information Custodian under PHIPA s. 3(1). As required by PHIPA s. 15(3), we have designated a Contact Person who is responsible for facilitating compliance with the Act, responding to access and correction requests, and receiving privacy inquiries and complaints. You may reach our Contact Person at:
We collect, use, and disclose information, as permitted under PHIPA s. 29, for the following purposes:
We collect PHI only with your express written consent, except in circumstances permitted by PHIPA (for example, emergency care or court orders). You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting our Contact Person.
We do not sell your personal information. We disclose PHI only:
All agents are contractually required to comply with PHIPA.
We use industry-standard administrative, physical, and technical safeguards: TLS 1.2+ encryption in transit, AES-256 encryption at rest, role-based access, multi-factor authentication on systems holding PHI, locked physical files, staff confidentiality training, and incident response procedures.
JaneApp data is hosted on AWS Canada (ca-central-1). Stripe processing may involve transfer to the United States; Stripe is bound by Standard Contractual Clauses. Cloudflare may route traffic through global edge nodes; no PHI is stored at the edge.
Clinical records are retained for ten years from the date of last entry, in accordance with professional guidance. Marketing data is retained while consent is valid and is deleted within 30 days of consent withdrawal. Photographs used for marketing are removed from active distribution within 30 days of withdrawal.
Under PHIPA and PIPEDA you have the right to:
We respond to access and correction requests within 30 days (extendable to 60 days in defined circumstances under PHIPA), generally at no charge. Visitors in the EU and UK additionally have rights to portability, erasure, and restriction of processing under GDPR Articles 15–22.
We use essential cookies (required for the site to function) and, with your consent, analytics cookies (Google Analytics 4) and advertising cookies (Meta Pixel, TikTok Pixel). When you first visit, a cookie consent banner lets you accept all or reject all non-essential cookies. You can change your choice at any time using the “Cookie settings” link in our footer. For more detail, see our Cookie Policy.
Our services are intended for adults aged 18 and over. We do not knowingly collect information from minors.
We will post material changes to this policy on this page and notify existing clients by email at least 30 days before the changes take effect.
Bracketed items marked [to confirm] are placeholders to be finalized before publication. For privacy inquiries, contact our Contact Person at privacy@activatebeauty.ca.