Privacy Policy

The Cloud Pavilion Wellness Centre ("we," "us," "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, and the rights you have under Canadian privacy law — including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Personal Health Information Protection Act (PHIPA).

Information We Collect

We collect only the personal information necessary to provide our services and operate our clinic. This may include:

• Contact information: name, phone number, email address, mailing address.
• Booking information: the service you have requested, appointment date and time, practitioner preference.
• Health information (where applicable): relevant medical history, treatment notes, and progress records — collected and stored under PHIPA standards, only by registered practitioners, only when needed to deliver care safely.
• Payment information: processed by our payment provider; we do not store full credit card numbers on our own systems.
• Insurance information: insurer name, policy/member number, and related details required for direct billing.

How We Use Your Information

Your personal information is used only for the purposes for which it was collected, including:

• Scheduling, confirming, and managing your appointments.
• Providing therapeutic services and maintaining accurate treatment records.
• Processing payments and submitting insurance claims on your behalf (direct billing).
• Communicating with you about your bookings, follow-up care, or important clinic notices.
• Meeting our legal, regulatory, and professional obligations.

We do not sell, rent, or trade your personal information. We do not send you marketing emails unless you have given us express consent (in accordance with Canada's Anti-Spam Legislation, CASL).

Online Booking

We use Setmore (setmore.com) as our online appointment booking platform. When you book an appointment through our website, the information you provide — including your name, phone number, email address, and appointment details — is transmitted to and stored by Setmore in order to manage your booking, send you confirmations and reminders, and provide our practitioners with the information needed to deliver your care.

Setmore is contractually required to protect your information and to use it only for the purpose of providing the booking service. You may review their privacy practices at setmore.com/privacy-policy.

Setmore stores data on servers located in the United States. This means your booking information may be subject to U.S. law, including potential lawful access by government authorities under applicable U.S. legislation. By submitting a booking through our website, you consent to your information being shared with Setmore on this basis.

For Acupuncture appointments and insurance direct billing (Massage Therapy RMT and Acupuncture), bookings are scheduled by phone only at (416) 292-4035 and are not processed through Setmore.

Consent

By providing your personal information to us — in person, by phone, or through our website — you consent to its collection, use, and disclosure as described in this Privacy Policy. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.

For sensitive health information, we obtain your express, informed consent before collection or use, as required under PHIPA.

Disclosure of Information

We disclose personal information only in limited circumstances:

• To our registered practitioners and authorized staff, strictly on a need-to-know basis to provide care.
• To insurance companies, with your authorization, for the purpose of direct billing.
• To our service providers (booking platform, payment processor, IT support) under confidentiality obligations.
• When required or permitted by law, court order, or to protect health and safety.

How We Protect Your Information

We maintain physical, technical, and administrative safeguards appropriate to the sensitivity of the information, including:

• Encrypted transmission (HTTPS/TLS) of all data submitted through our website.
• Encrypted storage of records held by our service providers.
• Access controls limiting employee access to authorized personnel only.
• Locked physical storage for paper records and secure disposal of records no longer needed.
• Two-factor authentication on administrative accounts where available.

While we take all reasonable precautions, no method of transmission or storage is 100% secure. In the unlikely event of a privacy breach involving a real risk of significant harm, we will notify affected individuals and the appropriate regulatory authorities, as required by law.

Retention of Records

We retain personal and health information only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws and professional regulations. In Ontario, registered health practitioners are generally required to retain treatment records for at least 10 years after the last interaction (or, for minors, 10 years after they reach the age of majority).

Your Rights

Under PIPEDA and PHIPA, you have the right to:

• Access the personal information we hold about you.
• Request corrections to information that is inaccurate or incomplete.
• Withdraw consent to ongoing collection or use, subject to legal/contractual limitations.
• Request deletion of personal information that is no longer needed for the purposes for which it was collected (with exceptions for records we are legally required to retain).
• File a complaint if you believe we have not handled your information appropriately.

To exercise any of these rights, please contact us using the information below. We will respond within 30 days, as required by PIPEDA.

Cookies & Website Analytics

Our website is a static information site. It does not currently use cookies, tracking pixels, or third-party analytics tools. We do not track visitors or collect identifying information through the website itself.

If we add analytics or other tracking in the future, this Privacy Policy will be updated accordingly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or the law. Material changes will be communicated by updating the "Last updated" date at the top of this page. We encourage you to review this page periodically.