Privacy Policy

Aara Holistic Wellness Clinic

#B10, 2761 Markham Road, Scarborough, Ontario M1X 0A4, Canada
Phone/text: 647-622-4114 · Email: info@aarawellnessclinic.com

Last updated: October 18, 2026

1. Who we are and what this policy covers

Aara Holistic Wellness Clinic ("Aara", "we", "us") operates the website aarawellnessclinic.com and a clinic in Scarborough, Ontario that offers Registered Massage Therapy, acupuncture, chiropractic care and Ayurveda. This policy explains how we handle personal information collected through our website and when you contact or book with us.

We are based in Canada, so Canadian privacy law is our primary framework: the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for health information, Ontario's Personal Health Information Protection Act, 2004 (PHIPA). We also write this policy to meet the standards of the EU and UK General Data Protection Regulation (GDPR), Quebec's Law 25 (the Act respecting the protection of personal information in the private sector), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and Brazil's Lei Geral de Proteção de Dados (LGPD). Some of these laws apply only in certain circumstances. We choose to give every visitor the same core rights, wherever you live.

Clinical records are separate. Health information collected when you are treated by one of our practitioners is governed by PHIPA and by the professional standards of their regulatory college. It is handled under a separate clinic notice of information practices, which we will give you at your first visit. This policy is mainly about our website and general enquiries.

2. Accountability and Privacy Officer

We are accountable for the personal information in our care. Our Privacy Officer oversees compliance with this policy and answers questions and complaints.

• Privacy Officer, Aara Holistic Wellness Clinic
• Email: info@aarawellnessclinic.com (subject line: "Privacy")
• Phone/text: 647-622-4114
• Mail: #B10, 2761 Markham Road, Scarborough, ON M1X 0A4, Canada

Under Quebec's Law 25, the person in charge of the protection of personal information is the Privacy Officer named above. For EU/UK or Brazilian users, the same contact acts as our point of contact for privacy matters. If we are required to appoint a representative in the EU, UK or Brazil, we will list their details here.

3. Data we collect

Information you give us

• Contact details and messages: name, phone number, email address and what you write to us when you call, text, email or use a form.
• Booking details: preferred service, date and time, and insurance or billing questions you ask us.
• Please do not send sensitive health details by text or email. Share them in person or by phone with your practitioner.

Information collected automatically

• Technical data in our hosting provider's server logs: IP address, browser and device type, pages requested, date and time, and referring page. Our hosting provider uses this to deliver and secure the site.
• Your cookie choice, stored in your browser (local storage) so that we remember it. This is strictly necessary.

Optional analytics and marketing cookies

• None of these load unless you opt in. They are off by default. If we use them in future, the categories are:
• Analytics (for example, Google Analytics): pages visited, approximate location, device type and how you found us.
• Marketing (for example, Meta Pixel): measures and personalizes advertising.
• You can change your choice at any time with the Privacy Choices button at the bottom-left of every page.

What we do not collect. We do not knowingly collect information from children under 13 through the website, and we do not collect payment card numbers on the website.

4. How and why we use it, and our legal bases

We only use personal information for the purposes above or for purposes you would reasonably expect, and we ask for consent again if we want to use it for something new.

5. Who we share it with

We do not sell personal information. We do not share it for cross-context behavioural advertising. We share it only with:

• Service providers who process it for us under written terms: our website hosting and delivery provider (Netlify), the application platform behind parts of our website (Base44), and our email, phone and booking tools.
• Professional advisers, insurers and authorities where the law requires or permits it.
• A successor if our business is sold or reorganized, subject to this policy.

We load our website fonts from our own server, so your browser does not contact Google Fonts when you visit.

California (CCPA/CPRA). In the past 12 months we have not sold or shared personal information as those terms are defined. We provide a "Do Not Sell or Share My Personal Information" link in the cookie banner, the preferences panel and the page footer. Selecting it records your opt-out. We also honour the Global Privacy Control (GPC) browser signal as a valid opt-out request. We do not use sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16.

6. International data transfers

We are in Canada, and our service providers may process data in Canada, the United States or other countries whose privacy laws can differ from yours. Where personal information from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards, primarily the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where applicable). For Quebec, we carry out a privacy impact assessment before transferring information outside Quebec. For Brazil, transfers rely on the mechanisms in Article 33 of the LGPD, including standard contractual clauses. You can request a copy of the safeguards by contacting our Privacy Officer.

7. Retention

• Website enquiries and booking messages: kept only as long as needed to answer you and manage the relationship, then deleted or anonymized, normally within 24 months of our last contact.
• Server logs: kept by our hosting provider for a short period for security.
• Cookie consent record: kept in your browser for up to 12 months, then we ask again.
• Clinical records: kept for the period required by Ontario law and professional regulation, which is generally at least 10 years.

8. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not profile visitors. If we enable optional analytics or marketing cookies in future, they would run only with your opt-in consent, and you can turn them off at any time. Under Quebec Law 25, you would be told if a decision were made exclusively by automated processing and could ask for human review.

9. Your rights

Depending on where you live, you may have the rights below. We will extend them to you where we reasonably can, regardless of location.

• Access. Ask whether we hold personal information about you and receive a copy.
• Rectification. Ask us to correct information that is inaccurate or incomplete.
• Deletion (right to be forgotten / erasure). Ask us to delete your personal information, subject to legal record-keeping duties.
• Data portability. Receive information you gave us in a structured, commonly used, machine-readable format, or ask us to transmit it to another organization where feasible.
• Restriction and objection. Ask us to restrict processing or object to processing based on legitimate interests.
• Withdraw consent. Withdraw consent at any time without affecting past processing. Use the Privacy Choices button, or contact us.
• Opt out of sale, sharing and targeted advertising. Use the "Do Not Sell or Share My Personal Information" link, turn Marketing off in your preferences, or send a GPC signal.
• Limit use of sensitive personal information (California). We do not use it beyond what is necessary to provide services.
• No retaliation. We will not discriminate against you or deny service for exercising your rights.
• Complaints. You may complain to us, or to a regulator (see section 11).

How to make a request. Email info@aarawellnessclinic.com with the subject "Privacy request", or call or text 647-622-4114, or write to the address above. We may need to verify your identity before acting. We respond within 30 days (or sooner where the law requires, for example 15 days under the LGPD) and tell you if we need more time. You may use an authorized agent in California; we will ask for proof of authority.

10. Security

We use reasonable physical, organizational and technical safeguards, including encrypted connections (HTTPS) and limited access to information. No method of transmission over the Internet is completely secure. We keep a register of privacy incidents and will notify you and the regulator where the law requires, including a "real risk of significant harm" under PIPEDA and "serious injury" under Quebec Law 25.

11. Contact a regulator

• Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
• Ontario: Information and Privacy Commissioner of Ontario (ipc.on.ca), for health information under PHIPA
• Quebec: Commission d'accès à l'information (cai.gouv.qc.ca)
• EU / UK: your local data protection authority, or the UK Information Commissioner's Office
• California: the California Privacy Protection Agency and the California Attorney General
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)

12. Cookies and similar technologies

We use strictly necessary storage that the site needs to work and to remember your choice. Analytics and Marketing cookies are off by default and load only if you opt in. Closing the banner, pressing Escape, scrolling or clicking elsewhere on the page is treated as a decision to decline. Use Privacy Choices at any time to review or withdraw consent. When you withdraw consent, we remove the related cookies and stop any related scripts.

13. Changes to this policy

We will update this policy when our practices or the law change and will change the "Last updated" date. For material changes we will give you prominent notice and, where required, ask for your consent again.

14. Contact us

Questions, requests or complaints: Privacy Officer, Aara Holistic Wellness Clinic, #B10, 2761 Markham Road, Scarborough, ON M1X 0A4 · info@aarawellnessclinic.com · 647-622-4114.