Privacy Policy
Elixir One Inc., operating as Elixir1 Skincare Clinic (“Elixir1”, “we”, “our”, or “the Clinic”), located at 2445 Yonge Street, Toronto, Ontario M4P 2E7, is committed to protecting the privacy of the personal information entrusted to us. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard personal information in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable Canadian and Ontario privacy laws.
By using our website (elixir1.ca), booking an appointment, or receiving services at Elixir1, you consent to the collection, use, and disclosure of your personal information as described in this Policy.
1. Accountability
Elixir1 is responsible for personal information under its control. We have designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy legislation. Questions, requests, or concerns regarding privacy may be directed to our Privacy Officer at info@elixir1.ca or by mail to Elixir1 Skincare Clinic, Attn: Privacy Officer, 2445 Yonge Street, Toronto, ON M4P 2E7.
2. Personal Information We Collect
Depending on how you interact with Elixir1, we may collect the following categories of personal information:
- Contact and identity information: your name, email address, phone number, and mailing address, collected when you book an appointment online, by phone, or in clinic;
- Booking information: the services you select, appointment dates and times, provider assignments, and appointment history;
- Payment information: payment amounts, transaction records, and membership or prepaid package status. Credit and debit card details are collected and processed directly by our payment processor, Stripe. Elixir1 does not receive, store, or have access to your full card number;
- Health information: medical history, skin conditions, medications, treatment records, consent forms, and clinical photographs, collected in clinic through intake forms and consultations where required to deliver treatments safely;
- Technical information: limited technical data such as IP address and browser type, used for website security, fraud prevention, and service delivery.
Health information collected in connection with services provided by regulated health professionals, including our Nurse Practitioner, is also handled in accordance with Ontario’s Personal Health Information Protection Act (“PHIPA”) and applicable professional college requirements.
3. Purposes for Collection, Use, and Disclosure
We collect, use, and disclose personal information only for the following purposes:
- Scheduling, confirming, modifying, and managing appointments;
- Creating and maintaining your client profile and treatment records;
- Verifying membership status and unused prepaid services so the correct pricing is applied and you are not charged for services you have already purchased;
- Processing payments, deposits, and refunds;
- Delivering safe and appropriate treatments, including reviewing health history and contraindications;
- Communicating with you regarding appointments, aftercare instructions, and clinic policies;
- Preventing, detecting, and investigating fraud, payment disputes, and unauthorized activity;
- Complying with legal, regulatory, tax, insurance, and professional college obligations.
We do not sell, rent, or trade your personal information to any third party. We do not use your personal information for third-party advertising.
4. Consent
We collect, use, and disclose personal information with your knowledge and consent, except where otherwise permitted or required by law. Consent may be express (for example, agreeing to this Policy when booking online, or signing a treatment consent form) or implied (for example, providing your email address so we can send your booking confirmation).
You may withdraw your consent at any time, subject to legal, regulatory, or contractual restrictions and reasonable notice, by contacting our Privacy Officer. Withdrawing consent may limit our ability to provide certain services to you.
5. Limiting Collection, Use, and Retention
We limit the collection of personal information to what is necessary for the purposes identified in this Policy. Personal information is used or disclosed only for the purposes for which it was collected, unless you consent otherwise or as permitted or required by law.
We retain personal information only as long as necessary to fulfill the identified purposes and to meet legal and regulatory requirements. Clinical records are retained in accordance with the retention periods required of regulated health professionals in Ontario. When personal information is no longer required, it is securely destroyed, erased, or anonymized.
6. Service Providers and Disclosure
Elixir1 uses a small number of trusted third-party service providers to operate the clinic and this website. These providers process personal information on our behalf only for the purposes described in this Policy:
- Mindbody, Inc.: our clinic management and scheduling platform, which stores client profiles, appointment records, memberships, and prepaid service balances;
- Stripe, Inc.: our payment processor, which handles card payments in a PCI DSS compliant environment;
- Vercel, Inc.: our website hosting provider.
Some service providers may store or process information on servers located outside of Canada, including in the United States. While your information is outside of Canada, it is subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, and government authorities under those laws. We take reasonable contractual and technical measures to ensure your information receives a comparable level of protection.
We may also disclose personal information where required or permitted by law, including to comply with a subpoena, warrant, or court order, to our professional advisors, to regulatory bodies or professional colleges, or in connection with fraud prevention, chargebacks, or legal proceedings.
7. Safeguards
We protect personal information with safeguards appropriate to its sensitivity. These include:
- Encryption of information transmitted through our website (TLS/HTTPS);
- Payment processing handled exclusively by Stripe, so card details never touch our servers;
- Access to client records restricted to authorized clinic personnel on a need-to-know basis;
- Server-side verification and rate limiting on our online booking system to prevent unauthorized access to account information;
- Physical, organizational, and technological measures protecting records held in clinic.
No method of transmission or storage is completely secure. In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.
8. Cookies and Website Data
Our website uses only the cookies and similar technologies necessary to operate the site and process bookings, including those set by our payment processor during checkout. We do not use third-party advertising or cross-site tracking cookies. Our web fonts are delivered by Google Fonts, which may receive your IP address when fonts are loaded.
9. Accuracy, Access, and Correction
We make reasonable efforts to keep personal information accurate, complete, and up to date. You have the right to request access to the personal information we hold about you, to be informed of how it has been used and to whom it has been disclosed, and to request correction of any inaccuracies.
To make an access or correction request, contact our Privacy Officer at info@elixir1.ca. We will respond within thirty (30) days as required by PIPEDA. Access may be limited or refused in specific circumstances permitted by law, in which case we will provide the reasons for the refusal.
10. Challenging Compliance
If you have a concern about our handling of your personal information, please contact our Privacy Officer first so we can address it directly. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or through priv.gc.ca. For concerns relating to personal health information, you may also contact the Information and Privacy Commissioner of Ontario at 1-800-387-0073 or through ipc.on.ca.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be posted on this page with its effective date. Material changes will be communicated through our website or by other reasonable means.
12. Contact Us
Privacy Officer
Elixir1 Skincare Clinic (Elixir One Inc.)
2445 Yonge Street, Toronto, ON M4P 2E7
Email: info@elixir1.ca
Phone: (437) 383-8881