Privacy Policy

The Aesthetics Boutique Binbrook Ltd.
Operating as The Aesthetics Boutique

Last Updated: October 31, 2026

The Aesthetics Boutique Binbrook Ltd., operating as The Aesthetics Boutique ("The Aesthetics Boutique," the "Clinic," "we," "us," or "our"), is committed to protecting the privacy, confidentiality and security of the personal information and personal health information entrusted to us.

We operate a medical aesthetics, skin and beauty clinic in Ontario and provide services primarily from our Binbrook location. From time to time, certain services may also be provided at temporary, satellite, event or pop-up locations.

This Privacy Policy explains what information we collect, how we use and disclose it, how we protect it, how long we retain it, and the privacy rights available to our clients.

Our privacy practices are designed to comply with applicable Canadian and Ontario privacy requirements, including the Personal Health Information Protection Act, 2004 ("PHIPA"), the Personal Information Protection and Electronic Documents Act ("PIPEDA"), where applicable, Canada's Anti-Spam Legislation ("CASL"), and applicable professional standards governing regulated health professionals.

1. ACCOUNTABILITY AND HEALTH RECORDS

Depending on the service being provided and the circumstances, The Aesthetics Boutique and/or a regulated health professional practising through the Clinic may act as a Health Information Custodian under PHIPA.

The Clinic maintains and controls client records associated with services provided through the Clinic.

Authorized members of our team may access client information where reasonably necessary to perform their duties, provide treatment, review relevant treatment history, document care, manage appointments, process transactions, or otherwise support Clinic operations.

Authorized individuals may include:

the Clinic owner and registered nurse;

other nurses and regulated health professionals;

medical aestheticians;

laser technicians;

administrative and reception staff;

the Clinic's medical director and/or authorized prescribers, where appropriate;

bookkeeping and accounting personnel where access is legitimately required; and

authorized service providers acting on the Clinic's behalf.

Access to a client's clinical information without a legitimate work-related purpose is prohibited.

2. PRIVACY OFFICER

The Clinic has designated a Privacy Officer responsible for overseeing our privacy practices and responding to privacy questions, access requests, correction requests and complaints.

Privacy Officer
The Aesthetics Boutique Binbrook Ltd.
2668 Binbrook Road, Suite 104
Binbrook, Ontario L0R 1C0

Email: contact@theaestheticsboutique.ca
Telephone: 289-921-8240

3. INFORMATION WE MAY COLLECT

The information we collect depends on your relationship with the Clinic and the services you receive.

Personal and Contact Information

We may collect:

your name;

address;

telephone number;

email address;

date of birth;

emergency contact information;

account information;

appointment history;

purchase and transaction history;

membership, package, loyalty or VIP information;

communication and marketing preferences; and

other information you voluntarily provide.

Personal Health Information

When appropriate for the services being provided, we may also collect:

medical history;

health conditions;

medications and supplements;

allergies or sensitivities;

pregnancy or breastfeeding information where relevant;

previous aesthetic or medical treatments;

contraindications or risk factors;

consultation and assessment information;

treatment goals and treatment plans;

treatments provided;

clinical observations;

treatment results;

product, medication and lot information;

adverse reactions or complications;

follow-up information;

informed-consent documentation;

clinical chart notes;

communications concerning your care;

prescriptions, orders and information received from or provided to other health professionals;

before-and-after photographs;

facial or treatment photographs;

OBSERV skin-analysis images and results; and

other information reasonably required to provide appropriate care.

We seek to limit the collection, use and disclosure of personal health information to what is reasonably necessary for legitimate purposes.

4. HOW WE COLLECT INFORMATION

Information may be collected:

directly from you;

during consultations or treatments;

through intake and consent forms;

through Jane;

through our website and online store;

when you contact us by telephone, email, SMS or another communication channel;

through OBSERV 520x and Sylton systems;

through payment systems;

through memberships, packages or loyalty programs;

through our medical director or another authorized health professional;

through referral or treatment coordination;

through our financing provider where appropriate;

through cookies and similar website technologies; and

through social-media platforms when you choose to interact with us through those services.

5. HOW WE USE INFORMATION

We may use information to:

provide consultations, assessments and treatments;

determine whether a treatment is appropriate;

establish and maintain clinical records;

create and update treatment plans;

document care;

monitor treatment progress;

compare treatment results;

arrange follow-up care;

coordinate care with authorized health professionals;

obtain prescriptions, client-specific orders or other required authorizations;

manage appointments and waitlists;

send appointment confirmations and reminders;

respond to inquiries;

process purchases and payments;

process deposits, cancellations or refunds;

administer memberships, packages, loyalty programs and VIP benefits;

fulfil online purchases;

manage customer accounts;

maintain accounting, tax and financial records;

manage Clinic operations;

investigate security, fraud or misuse;

comply with regulatory and professional requirements;

respond to legal or insurance matters;

improve our services; and

carry out other purposes to which you consent or which are permitted or required by law.

6. CONSENT

Where consent is required, we obtain consent appropriate to the nature and sensitivity of the information and the purpose for which it will be collected, used or disclosed.

Consent may be express or implied where permitted by law.

Express consent may be provided verbally, electronically or in writing.

You may withdraw or limit consent to certain uses or disclosures, subject to applicable legal, professional, clinical and record-retention requirements.

Withdrawing consent does not require the Clinic to destroy a clinical record that we are required or permitted to maintain.

In some circumstances, applicable law permits or requires personal information or personal health information to be collected, used or disclosed without consent.

7. CLINICAL PHOTOGRAPHS

Photographs and videos may form part of a client's clinical record.

Clinical images may be used to:

document a client's condition before treatment;

assist with assessment and treatment planning;

document treatments;

monitor progress;

compare treatment results;

support follow-up care; and

maintain an accurate clinical record.

Consent to clinical photography does not automatically authorize the Clinic to use an image for advertising, social media or promotional purposes.

8. MARKETING, SOCIAL MEDIA AND BEFORE-AND-AFTER PHOTOGRAPHS

Where we wish to use client photographs, videos, testimonials, treatment results or other potentially identifiable information for:

Instagram;

Facebook;

TikTok;

our website;

advertisements;

promotional materials;

newsletters; or

other public marketing,

we obtain separate express authorization where required.

Marketing authorization may be documented electronically, in writing or through another legally permitted form of express consent.

You may refuse or withdraw permission for future marketing use without affecting your ability to receive treatment, subject to any limitations relating to material that has already lawfully been published or distributed.

Cropping, concealing the eyes, limiting an image to a treatment area, blurring identifying features or otherwise modifying an image can reduce identifiability but does not necessarily make an image anonymous.

The Clinic therefore treats potentially identifiable treatment imagery with appropriate privacy protections even where identifying features have been reduced.

9. OBSERV 520X AND SYLTON CONNECT

The Clinic uses the OBSERV 520x Advanced Skin Analysis System and associated Sylton software.

This technology may collect or create:

facial photographs;

skin-analysis images;

client identifiers;

consultation information;

notes;

treatment or skincare recommendations; and

before-and-after comparisons.

Information may be stored locally on a Clinic-controlled iPad and may also be synchronized or backed up using Sylton Connect cloud services.

Access is restricted to authorized personnel who require the information for legitimate Clinic purposes.

The Clinic takes reasonable steps to protect devices and accounts containing client information, including the use of appropriate access controls and device-security measures.

10. JANE

The Clinic uses Jane as an electronic practice-management and clinical-record platform.

Jane may be used for:

client profiles;

online booking;

scheduling;

intake forms;

medical-history forms;

consent forms;

clinical charting;

treatment history;

photographs;

payment-related functions;

appointment reminders;

email and SMS communications; and

other practice-management functions.

Clinical information entered into Jane forms part of the Clinic's record system and is accessible only to authorized users based on their roles and permissions.

Certain Jane features use third-party providers for services such as email and SMS delivery. As a result, limited information needed to send those communications may be processed outside Canada.

11. EMAIL, SMS AND MAILCHIMP

The Clinic may use Jane, Mailchimp and other authorized communication services to send messages to clients.

Messages may include:

appointment confirmations;

appointment reminders;

treatment-related communications;

follow-up information;

newsletters;

promotions;

new-treatment announcements;

event invitations;

membership or VIP information;

birthday promotions;

special offers; and

other Clinic communications.

We seek to limit information shared with marketing platforms to information reasonably necessary for the intended purpose.

Marketing emails and texts are sent in accordance with applicable consent and anti-spam requirements.

Where required by CASL, commercial electronic communications will include appropriate identification information and a method of unsubscribing.

You may unsubscribe from marketing communications without preventing the Clinic from sending necessary non-promotional communications relating to appointments, transactions, treatment, safety or your ongoing care.

12. MEDICAL DIRECTOR, ORDERS AND OTHER HEALTH PROFESSIONALS

Certain services offered by the Clinic may require prescribing, assessment, consultation, authorization, a client-specific order or other involvement by an authorized health professional.

Where appropriate and permitted by law, information may be shared with:

the Clinic's medical director;

physicians;

nurse practitioners;

authorized prescribers;

registered nurses;

pharmacists or pharmacies; and

other health professionals involved in your care.

Only information reasonably necessary for the applicable purpose will be disclosed.

The Clinic's medical director or another authorized provider may practise through a separate professional practice and may have independent record-keeping and privacy obligations.

13. PAYMENTS AND E-COMMERCE

The Clinic offers in-person and online payment options.

Our website may use ecommerce software such as WooCommerce, while payments may be handled through payment services or processors including Jane Payments, Stripe, Square, financial institutions or other authorized payment providers.

Depending on the payment method chosen, payment providers may collect:

cardholder name;

billing information;

payment-card details;

transaction amount;

transaction identifiers; and

authentication or fraud-prevention information.

Full payment-card information may be collected and processed directly by the applicable payment provider rather than by the Clinic.

The Clinic may retain transaction records, invoices, payment status and limited payment information where necessary for accounting, refunds, business administration, fraud prevention and legal purposes.

Third-party payment providers maintain their own privacy and security practices.

14. BEAUTIFI FINANCING

The Clinic may offer access to treatment financing through Beautifi Solutions Inc.

Beautifi is an independent third-party financing provider.

If you choose to apply for financing, Beautifi may collect information including:

identity information;

contact information;

employment or income information;

banking or payment information;

credit information;

financing information;

identification documents; and

other information necessary to assess and administer your financing application.

Beautifi processes financing applications according to its own privacy policy and legal obligations.

The Clinic does not control Beautifi's independent credit-assessment or financing processes.

The Clinic may receive limited information needed to coordinate financing, such as application or funding status, transaction amounts, service information, cancellations or refunds.

15. WEBSITE, COOKIES, PIXELS AND ANALYTICS

When you use our website, certain technical information may automatically be collected, including:

IP address;

device type;

browser type;

operating system;

pages viewed;

referring pages;

website interactions;

approximate location derived from technical information; and

cookie or similar identifiers.

We may use cookies, pixels and similar technologies to operate the website, understand how visitors use it, measure marketing effectiveness and improve our services.

Our website and marketing activities may involve services associated with platforms including:

Meta/Facebook;

Instagram;

TikTok;

Mailchimp; and

other website, analytics, advertising or technology providers enabled by the Clinic from time to time.

Some providers may process information outside Ontario or Canada.

Your browser or device may permit you to restrict certain cookies or tracking technologies, although doing so may affect website functionality.

16. SOCIAL MEDIA AND DIRECT MESSAGES

The Clinic maintains accounts on social-media platforms including Instagram, Facebook and TikTok.

Information submitted to those platforms is also governed by the applicable platform's terms and privacy practices.

Social-media direct messages are not intended to be a secure method for transmitting sensitive health information.

Clients should avoid sending detailed medical histories, sensitive clinical information or sensitive photographs through social-media direct messages where a more appropriate Clinic communication channel is available.

17. CLINIC DEVICES, IPADS AND IPHONES

The Clinic may use Clinic-controlled iPads, iPhones or other devices to:

capture clinical photographs;

access Jane;

perform skin analysis;

communicate with clients; or

support treatment and Clinic operations.

Where a photograph is taken for inclusion in a client's health record, the Clinic's intention is to transfer the image to the appropriate clinical record system and protect or remove unnecessary duplicate copies in accordance with Clinic procedures.

Devices containing or providing access to client information should be protected using appropriate security measures such as passwords, biometric authentication, account controls and device-security features.

18. PERSONAL DEVICES AND STAFF COMMUNICATION

Where staff use a personal device for authorized Clinic communication, they remain responsible for complying with Clinic privacy and confidentiality requirements.

Client personal health information should not be unnecessarily stored on personal devices.

Where reasonably possible, staff should use Clinic-approved communication systems, applications and accounts for client communications.

19. MEMBERSHIPS, PACKAGES, LOYALTY AND VIP PROGRAMS

If you participate in a Clinic membership, package, loyalty, rewards or VIP program, we may collect and use information such as:

contact information;

membership status;

purchases;

services received;

benefits or rewards earned;

redemption history;

payment information; and

communication preferences.

This information may be used to administer your membership or program and, where legally permitted, communicate relevant offers or benefits.

20. MINORS

The Clinic may provide certain services to individuals under the age of 18, including certain skincare, facial, laser, beauty or other services.

The Clinic may require a parent or legal guardian to be involved in or consent to treatment for a minor in accordance with Clinic policy, the nature of the service and applicable professional requirements.

Privacy consent under PHIPA is determined in accordance with applicable law, including principles relating to the individual's capacity to understand the relevant information and appreciate the consequences of the decision.

Where appropriate, a parent, guardian or other authorized substitute decision-maker may consent on behalf of a minor.

21. POP-UP AND TEMPORARY LOCATIONS

The Clinic may occasionally provide services at a salon, business, event or other temporary or pop-up location.

Providing a service at another location does not automatically authorize the host business or its employees to access a client's Clinic health record.

The Clinic takes reasonable measures to maintain privacy and confidentiality when providing services outside its primary Binbrook location.

22. ACCOUNTING AND PROFESSIONAL ADVISERS

The Clinic may disclose limited personal information to authorized accountants, bookkeepers, lawyers, insurers or other professional advisers where reasonably necessary for legitimate business, tax, insurance or legal purposes.

Personal health information is not provided where non-health information is sufficient for the purpose.

23. OTHER SERVICE PROVIDERS

We may use third-party service providers for functions including:

electronic medical or clinical records;

booking;

payment processing;

ecommerce;

cloud storage;

email and SMS communications;

website hosting;

cybersecurity and IT services;

skin-analysis technology;

financing;

accounting;

marketing;

analytics;

shipping and fulfilment; and

professional services.

Where appropriate, we limit the information provided to what is reasonably necessary for the provider's function.

24. PROCESSING OUTSIDE ONTARIO OR CANADA

Some service providers used by the Clinic may process or store information outside Ontario or Canada.

For example, certain communication, marketing, technology, cloud, social-media, payment or other service providers may operate infrastructure in other jurisdictions.

Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may lawfully be accessible to courts, governments or regulatory authorities there.

Where personal health information is involved, we take reasonable steps to use services and safeguards appropriate to the sensitivity of the information and our applicable obligations.

25. SAFEGUARDS

We use physical, administrative and technical safeguards appropriate to the sensitivity of the information we maintain.

Safeguards may include:

locked storage for paper records;

secured Clinic premises;

password-protected systems;

role-based access;

individual user accounts;

electronic access controls;

encrypted services;

secured Clinic devices;

confidentiality expectations;

staff education;

appropriate backup systems;

secure disposal procedures;

multi-factor or two-step authentication where available; and

privacy-breach procedures.

No electronic system can be guaranteed to be completely secure. We nevertheless take reasonable steps to protect information against theft, loss and unauthorized access, use, disclosure, copying, modification or disposal.

26. PAPER RECORDS

The Clinic maintains certain client records in physical form.

Paper health records are stored in secured areas, including locked storage, with access limited to authorized individuals.

Physical records that are lawfully destroyed are disposed of using a method appropriate for confidential health information.

27. RETENTION

The Clinic retains personal health information for the periods required or recommended by applicable law, professional standards, clinical requirements and legitimate legal purposes.

As an independent nursing practice, nursing records may be retained for at least the minimum period recommended by the College of Nurses of Ontario and may be retained longer where reasonably necessary or appropriate.

For minors, longer retention periods may apply.

The Clinic currently maintains historical clinical records and may retain those records beyond minimum regulatory retention periods where there is a legitimate clinical, professional or legal reason to do so.

Different retention periods may apply to:

clinical records;

consent records;

photographs;

financial and tax information;

transaction records;

marketing-consent records; and

other business information.

When information is no longer reasonably required and may lawfully be disposed of, we use appropriate measures to securely destroy, delete or anonymize it.

28. ACCESS TO YOUR HEALTH RECORD

Subject to applicable legal exceptions, you may request access to personal health information about you that is within the Clinic's custody or control.

Requests may be directed to our Privacy Officer.

We may require information sufficient to verify your identity before providing access.

A reasonable fee may apply where permitted by law.

29. CORRECTING YOUR HEALTH RECORD

If you believe information contained in your health record is inaccurate or incomplete, you may request a correction.

We will consider correction requests in accordance with PHIPA and applicable professional requirements.

There are circumstances in which the Clinic may be permitted or required not to make a requested correction.

30. WITHDRAWING OR LIMITING CONSENT

Where permitted by law, you may withdraw or limit consent to certain uses or disclosures of your information.

A restriction may affect the Clinic's ability to provide or coordinate certain services.

Withdrawal of consent does not invalidate lawful collection, use or disclosure that occurred before the withdrawal and does not override legal or professional record-retention obligations.

31. PRIVACY BREACHES

A privacy breach may occur when personal information or personal health information is lost, stolen, improperly accessed, used or disclosed.

If a privacy breach occurs, the Clinic will take appropriate steps that may include:

containing the incident;

investigating what occurred;

protecting against further unauthorized access;

assessing the risks arising from the incident;

taking corrective action;

documenting the incident; and

notifying affected individuals or regulatory authorities where legally required.

Where required by PHIPA, a privacy incident may be reported to the Information and Privacy Commissioner of Ontario and/or an applicable professional regulator.

32. PRIVACY QUESTIONS AND COMPLAINTS

Questions, concerns, complaints, access requests or correction requests may be directed to:

Privacy Officer
The Aesthetics Boutique Binbrook Ltd.
Operating as The Aesthetics Boutique

2668 Binbrook Road, Suite 104
Binbrook, Ontario L0R 1C0

Email: contact@theaestheticsboutique.ca
Telephone: 289-921-8240

We will review privacy concerns and respond as appropriate.

You may also have the right to make a complaint to the:

Information and Privacy Commissioner of Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8

33. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in our services, technologies, service providers, regulatory requirements or privacy practices.

The current version will be published on our website with the date it was last updated.

Where a new collection, use or disclosure requires consent, updating this Privacy Policy alone does not replace any consent required by law.

The Aesthetics Boutique is committed to maintaining the confidentiality of the information entrusted to us and treating privacy as an essential part of safe, professional and respectful client care.