Clinique Le Refuge is committed to protecting the personal information you entrust to us. This policy explains what information we collect, why, how we protect it, and your rights.
1Identification of the organization
2Privacy Officer
In accordance with Section 3.1 of Quebec's Act respecting the protection of personal information in the private sector, we have designated a Privacy Officer. This person is your single point of contact for any question, request, or complaint related to the protection of your personal information.
3What information we collect
We collect only personal information that is necessary to deliver our services. We never collect more than what is required.
Identity and contact information
- First name, last name, date of birth
- Postal address (if required)
- Mobile phone number
- Email address
Health information (if applicable to the booked service)
- Relevant medical history for the treatment
- Reason for the visit and tension areas
- Contraindications, recent injuries
- Current medication, pregnancy
This information is considered sensitive and benefits from enhanced protection. Only therapists assigned to your file have access to it.
Transactional information
- Appointment history (dates, services, therapist, status)
- Payment data (amount, method, taxes, gratuity)
- Stripe transaction ID (without the full card number)
Technical information (automatically collected)
- IP address at the time of booking
- Device and browser type
- Connection timestamp
4Why we use your information
- Manage your appointments (confirmation, reminder, cancellation, rescheduling)
- Provide a safe massage therapy service tailored to your condition
- Process your payments and issue your receipts
- Comply with our legal and tax obligations (GST, QST, document retention)
- Send you, with your consent, operational messages (reminders, changes) and, if you have separately consented, reactivation communications
We never use your information for:
- Targeted advertising
- Resale to third parties
- Automated profiling with legal effect on you
- Training artificial intelligence models
5How we collect your information
- Directly from you, through our online booking form
- Directly from you, through the health intake form completed before your first session
- Automatically, through our payment processor (Stripe), at the time of the transaction
- Automatically, through our website (technical information)
6Who we share your information with
We never sell your information. We only share it with the following technology providers, who act as subcontractors and are bound by data protection agreements.
GoHighLevel
Make.com
Telnyx
Stripe
Framer
Pipedream
FleuriA S.E.N.C.
7Transfer of your information outside Quebec
Several of our providers are located in the United States. This means your information may be processed or stored outside Quebec, in jurisdictions with different personal information protection frameworks.
Before entrusting your information to these providers, we conducted a Privacy Impact Assessment (PIA), in accordance with Section 17 of the Act respecting the protection of personal information in the private sector. This assessment concludes that your information benefits from adequate protection in these jurisdictions, through:
- Contractual agreements (DPA) imposing on each provider protection obligations equivalent to those applicable in Quebec
- Encryption of your information in transit and at rest
- Isolation of your information in dedicated accounts
- Each provider's compliance with recognized standards (SOC 2, PCI-DSS, GDPR)
You may obtain a summary copy of this assessment by contacting our Privacy Officer.
8Retention period
Upon expiry of the retention period, your information is securely destroyed or anonymized.
9Security measures
We implement reasonable technical and organizational measures to protect your information against loss, unauthorized access, disclosure, alteration, or destruction:
- Encryption in transit (TLS) and at rest (AES-256)
- Two-factor authentication on all administrator accounts
- Access limited to those who strictly need it
- Continuous staff training
- Annual security audit of our information system
- 72-hour breach notification procedure
10Your rights
Quebec's Law 25 grants you several rights regarding your personal information. You may exercise them at any time, free of charge, by contacting our Privacy Officer.
Right of access
You may request to consult the information we hold about you. We will respond within a maximum of 30 days.
Right of rectification
You may request the correction of inaccurate, incomplete, or ambiguous information.
Right to erasure (right to be forgotten)
You may request the deletion of your information, subject to legal obligations requiring us to retain certain documents (examples: tax records, clinical files per professional requirements).
Right to withdraw consent
You may withdraw your consent to the collection or use of your information at any time, without affecting services already delivered. To withdraw consent to SMS, simply reply STOP or ARRÊT to any of our messages.
Right to portability
You may request that your computerized information be communicated to you in a structured and commonly used technological format.
11Cookies and similar technologies
Our website uses essential cookies for the proper functioning of online booking (session maintenance) and, with your consent, anonymous audience measurement cookies. No targeted advertising cookies are set.
You may configure your browser to refuse cookies. This may affect some online booking features.
12Policy updates
We may update this policy to reflect legal, technical, or operational changes. The effective date at the top of the document indicates the current version. In case of significant changes, we will notify you by email.
13Complaint to the Commission d'accès à l'information du Québec
If you believe Clinique le Refuge does not comply with its obligations regarding personal information protection, you may first contact our Privacy Officer. If the response does not satisfy you, you have the right to file a complaint with the Commission d'accès à l'information du Québec: