The Practice Inc. Privacy Policy
Personal Information Protection and Electronic Documents Act (PIPEDA)
Privileged & Confidential | Effective Date: 15th June 2026 | Version 1.0
1. About this policy
This Privacy Policy describes how The Practice Inc. collects, uses, discloses, retains, and safeguards personal information. It applies to information collected through our studio at 360 Davenport Road, Toronto, our website at https://thepracticetoronto.com, our booking and payment platform, our mobile applications, and any other interactions with us in connection with our services.
This policy is intended to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Canadian Anti-Spam Legislation (CASL), and other applicable Canadian privacy laws. Where personal health information is collected by an affiliated regulated health entity in the future, a separate notice will apply under the Personal Health Information Protection Act, 2004 (PHIPA).
2. Personal information we collect
We collect the following categories of personal information, only as needed for the purposes set out in Section 3:
- Contact and account information: name, email address, mailing address, phone number, account credentials, profile preferences, photograph (where you choose to provide one).
- Booking and transaction information: services booked, attendance history, class allocations used, payment information processed through our payment processor, receipts, and refund or credit history.
- Wellness screening information: information you provide on waivers, intake forms, and contraindication screening (for example, pregnancy, cardiac, respiratory, or neurological conditions you disclose for safety purposes before participating in a class or using a device).
- Communications: email and other written communications with our staff, feedback and complaints, responses to surveys.
- Website and device information: IP address, device type, browser, language, pages visited, referring source, cookies, and similar technical data collected through our website and applications.
- Marketing preferences: your CASL consent status and any preferences you have indicated for promotional communications.
We do not knowingly collect personal information from individuals under the age of 14 without parental or guardian consent. Studio bookings for individuals under 18 require a parent or guardian signature on the applicable waiver.
3. Purposes for which we use personal information
We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including:
- Providing, scheduling, and delivering the services you have booked.
- Processing payments, refunds, and account credits, and administering memberships and class packs.
- Verifying eligibility and identity, managing accounts, and supporting log-in security.
- Assessing safety and contraindications before participation in classes or device-assisted sessions.
- Responding to inquiries, complaints, and incident reports, and providing customer support.
- Communicating service-related information (booking confirmations, schedule changes, policy updates, and similar transactional messages).
- Sending commercial electronic messages where you have given express or implied consent under CASL.
- Operating, maintaining, and improving our website, applications, and booking platform, including analytics.
- Complying with legal obligations, exercising legal rights, and protecting the safety of our clients, staff, and property.
We will not use personal information for materially different purposes without first obtaining your consent.
4. Consent
By providing personal information to us and using our services, you consent to the collection, use, and disclosure of your personal information as described in this Policy. In some cases, your consent will be express (for example, when you check a box authorizing us to send you marketing emails, or sign a waiver containing health information). In other cases, your consent may be implied (for example, when you book a class through our platform and we use the booking information to provide the service).
You may withdraw your consent at any time, subject to legal or contractual restrictions and on reasonable notice, by contacting our Privacy Officer at the address in Section 12. Withdrawing your consent for some uses may mean we cannot continue to provide certain services to you.
5. Cookies and website analytics
Our website and applications may use cookies and similar technologies to operate essential functions, remember your preferences, and analyze aggregate usage. You can control cookies through your browser settings. Disabling cookies may limit the functionality of our website.
We may use third-party analytics services (such as those provided by our website host or booking platform vendor) to understand how our website is used. These services may collect IP addresses and similar identifiers; the data is processed under contract on our behalf and used solely for our analytics purposes.
6. Disclosure of personal information to third parties
We disclose personal information only as required to provide our services, comply with legal obligations, or with your consent. Categories of third-party recipients include:
- Service providers acting on our behalf, including our booking and scheduling platform vendor, payment processor, email and communications platform, website host, and IT and analytics providers, under written agreements that require them to protect personal information consistent with this Policy.
- Insurers and professional advisors (legal, accounting) where reasonably necessary for the management of our business.
- Public authorities, regulators, and law enforcement where required by law, by court order, or to investigate suspected unlawful activity.
- A purchaser or successor in a corporate transaction (asset sale, merger, reorganization), subject to confidentiality protections.
We do not sell, rent, or trade personal information to third parties for their own marketing purposes.
7. Cross-border processing
Some of our service providers (including cloud hosting, payment, and analytics providers) may store or process personal information outside Canada, including in the United States and other jurisdictions. When personal information is transferred to a service provider outside Canada, it remains subject to the laws of that jurisdiction, including any lawful access requests by foreign authorities. We use contractual safeguards to require our service providers to protect personal information consistent with this Policy and applicable Canadian privacy law.
8. Safeguards
We maintain physical, organizational, and technological safeguards appropriate to the sensitivity of the information, including access controls, encryption of data in transit, role-based access for staff, written confidentiality undertakings, and secure disposal of paper records. We periodically review our safeguards.
No security measure is perfect. If we become aware of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada in accordance with PIPEDA.
9. Retention
We retain personal information only for as long as needed for the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Retention periods include:
- Account, booking, transaction, and waiver records: minimum two years, and longer where required for tax, insurance, or limitations-period purposes.
- Marketing consent and unsubscribe records: at least three years following the most recent communication, in line with CASL.
- Incident reports and complaint records: minimum seven years.
Personal information no longer required for these purposes is securely destroyed, anonymized, or returned to the individual.
10. Your rights
Subject to limited exceptions in applicable law, you have the right to:
- Access the personal information we hold about you and obtain a copy.
- Request correction of personal information that is inaccurate, incomplete, or outdated.
- Withdraw your consent to certain uses or disclosures of your personal information.
- Make a complaint to our Privacy Officer or to the Office of the Privacy Commissioner of Canada.
Requests will be acknowledged within 30 days. We may need to verify your identity before responding to a request. Where we are unable to grant a request, we will explain why and identify any avenues for appeal.
11. Marketing communications and CASL
We send commercial electronic messages only with your express consent or in circumstances where implied consent is permitted under CASL. Every commercial message we send identifies us, includes valid contact information, and offers a working, one-step unsubscribe option that we honour within 10 business days. You can also update your communication preferences in your account or by contacting our Privacy Officer.
12. Contact our Privacy Officer
Questions, requests, and complaints about this Policy or our handling of personal information should be directed to our Privacy Officer:
[PRIVACY OFFICER NAME]
The Practice Inc.
360 Davenport Road, Toronto
[EMAIL] | [PHONE]
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or www.priv.gc.ca.
13. Changes to this Policy
We may update this Policy from time to time. The current version is identified by the Effective Date above. Material changes will be posted on our website at least 30 days before they take effect, and where practicable we will notify active account holders by email.