Privacy Policy

Ray Aesthetics

Last Updated: July 13, 2026

Ray Aesthetics ("we," "us," "our," or the "Clinic") is committed to protecting the privacy and confidentiality of personal information, including personal health information, entrusted to us by our clients, website visitors, and prospective clients. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have regarding your information.

This Policy applies to information collected through our website (rayaesthetics.ca), our online booking platform, our social media pages (including Instagram and Facebook/Meta), advertisements and lead forms run through Meta platforms (Facebook and Instagram), WhatsApp communications, and in-person during consultations and treatments at our clinic located at 1639 Eglinton Avenue West, Toronto, ON.

By using our website, submitting a form, booking an appointment, or receiving treatment from us, you consent to the collection, use, and disclosure of your information as described in this Policy.

1. Our Commitment to Privacy

We comply with Canada's federal private sector privacy law, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), and, where applicable to the personal health information we collect and use in the course of providing medical aesthetic treatments, Ontario's Personal Health Information Protection Act ("PHIPA"). We also comply with Canada's Anti-Spam Legislation ("CASL") regarding electronic marketing communications.

2. Information We Collect

Depending on how you interact with us, we may collect:

A. Identity and Contact Information

• Full name, date of birth, gender

• Mobile phone number, email address

• Home/mailing address

B. Health and Treatment Information

• Medical history relevant to treatment (e.g., allergies, medications, pregnancy status, skin type, prior aesthetic treatments)

• Treatment records, including products used, treatment areas, technique, practitioner notes, and outcomes

• Before-and-after photographs taken for clinical documentation (with separate consent required for any marketing use)

• Signed consent forms

C. Booking and Payment Information

• Appointment history and preferences

• Payment method details (processed securely by our payment processor; we do not store full credit card numbers)

D. Information from Online Forms and Advertisements

• Information you submit through our website contact form, Instant Forms/Lead Ads on Facebook or Instagram, or WhatsApp inquiries — typically your name, phone number, and email address, and any details you choose to share about your interests or questions

E. Technical and Website Usage Information

• IP address, browser type, device type, and general location (city/region level)

• Pages visited, time spent on site, and referral source

• Cookies and similar tracking technologies (see Section 6)

3. How We Collect Information

We collect information:

• Directly from you, when you book an appointment, complete an intake or consent form, contact us by phone, email, WhatsApp, or Instagram, or submit a lead form through a Meta (Facebook/Instagram) advertisement

• Automatically through your use of our website, via cookies and similar technologies

• From our service providers, such as our online booking platform (Vagaro) and website host (Hostinger)

• From Meta Platforms, Inc., when you submit an Instant Form/Lead Ad or interact with our ads (see Section 7 for details specific to Meta advertising)

4. How We Use Your Information

We use the information we collect to:

• Schedule, confirm, and manage appointments

• Provide safe and appropriate treatment, including reviewing medical history and contraindications

• Maintain accurate clinical and treatment records as required by professional and regulatory standards

• Process payments

• Respond to inquiries and provide customer service

• Send appointment reminders and follow-up care instructions

• With your separate, explicit consent, send promotional or marketing communications (see Section 8, CASL compliance)

• Improve our website, services, and client experience

• Comply with legal, regulatory, and professional obligations

• Measure and improve the performance of our advertising, including ads run through Meta platforms

We do not use your health information for advertising or marketing purposes without your explicit, separate consent, and we do not sell your personal information to third parties.

5. Meta (Facebook/Instagram) Advertising and Lead Forms

We advertise our services using Meta's advertising platform, which may include Instant Forms (Lead Ads) on Facebook and Instagram. When you submit an Instant Form:

• The information you provide (typically name, phone number, and email) is shared by Meta with us so we can follow up regarding your inquiry

• Your submission is also subject to Meta's own Data Policy and Privacy Policy, which governs how Meta collects, uses, and stores your information as the platform operator

• We may use a Meta Pixel and/or Meta Conversions API on our website to measure ad performance and build audiences for future advertising. This may involve sharing limited, hashed (encrypted, non-identifiable) information — such as a hashed email address — with Meta for the purpose of ad measurement and audience matching

• We do not share your health or treatment information with Meta for advertising purposes, and we do not use sensitive information (such as details about specific medical conditions or treatments received) to build advertising audiences

You can control the information Meta itself collects about you through your Facebook or Instagram account privacy settings, and you can review Meta's own privacy practices at facebook.com/privacy/policy or instagram.com/legal/privacy.

If you submitted a lead form and no longer wish to be contacted, please reach out using the contact details in Section 12 and we will remove your information from our follow-up lists.

6. Cookies and Tracking Technologies

Our website may use cookies, pixels, and similar technologies to:

• Remember your preferences

• Understand how visitors use our site

• Measure the effectiveness of our advertising, including Meta ads

• Support features such as embedded maps, booking widgets, and review displays

You can disable cookies through your browser settings; however, some features of our website may not function properly if cookies are disabled.

7. Who We Share Your Information With

We may share your information with:

• Service providers who help us operate our business, including our booking platform (Vagaro), website hosting provider (Hostinger), payment processors, and email/communication tools — all of whom are contractually required to protect your information and use it only for the purposes we specify

• Meta Platforms, Inc., in connection with advertising and lead forms, as described in Section 5

• Regulatory colleges and professional bodies, where required for licensing, quality assurance, or professional oversight of the practitioners providing your treatment

• Legal and regulatory authorities, where required by law, court order, or to protect the safety of any person

• A successor entity, in the event of a sale, merger, or transfer of our business, subject to the same privacy protections described in this Policy

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

8. Marketing Communications and CASL Compliance

If you provide your email address or phone number and consent to receive marketing communications from us (such as promotions, treatment updates, or newsletters), we will only send such communications in compliance with Canada's Anti-Spam Legislation (CASL), which requires:

• Your express consent before we send commercial electronic messages, obtained separately from other consents (e.g., consent to treatment)

• Clear identification of our clinic as the sender, including our contact information, in every message

• A functional and easy way to unsubscribe or withdraw consent at any time, which we will process promptly

Submitting a lead form or booking an appointment does not automatically enroll you in marketing communications — separate, explicit opt-in consent is required and will be requested where applicable.

9. Data Storage and Security

We take reasonable administrative, technical, and physical measures to protect your personal and health information against unauthorized access, disclosure, alteration, or destruction, including:

• Secure, access-controlled storage of clinical records

• Encrypted transmission of data where applicable

• Restricting access to personal and health information to staff who require it to perform their duties

• Using reputable third-party providers (e.g., Vagaro, Hostinger) who maintain their own security standards

No method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach involving your personal information that poses a real risk of significant harm, we will notify you and the applicable regulatory authority as required by law.

10. Data Retention

We retain personal and health information only as long as necessary to fulfill the purposes described in this Policy, including:

• Clinical and treatment records, which are generally retained for a minimum of ten (10) years from the date of the last entry, or longer where required for minors or by applicable regulatory college requirements

• Booking, contact, and marketing information, which is retained only as long as necessary for the purposes collected, or until you withdraw consent

When information is no longer required, we securely delete or destroy it.

11. Your Rights

Under PIPEDA and, where applicable, PHIPA, you have the right to:

• Access the personal information we hold about you

• Request correction of inaccurate or incomplete information

• Withdraw consent for the collection, use, or disclosure of your information, subject to legal or contractual restrictions (for example, we may be required to retain certain clinical records regardless of a withdrawal request)

• Ask questions about how your information is collected, used, or disclosed

• File a complaint with us, or with the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario, if you believe your privacy rights have been violated

To exercise any of these rights, please contact us using the information in Section 12.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Ray Aesthetics 1639 Eglinton Avenue West, Toronto, ON Phone/WhatsApp: +1 (647) 629-5185 Instagram: @rayaesthetics.ca Email: info@rayaesthetics.ca

13. Children's Privacy

Our services are intended for adults. We do not knowingly collect personal information from individuals under the age of majority without the consent of a parent or legal guardian. If a minor's information is collected in connection with treatment, applicable parental/guardian consent will be obtained as required.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The "Last Updated" date at the top of this Policy will reflect the most recent revision. We encourage you to review this Policy periodically.

This Privacy Policy is intended to reflect industry-standard privacy practices for a Canadian aesthetic medical clinic and compliance with PIPEDA, PHIPA, CASL, and Meta Platforms' advertising disclosure requirements. This document should be reviewed by qualified legal counsel prior to publication to confirm it accurately reflects your clinic's specific data practices, service providers, and applicable regulatory obligations.