privacy policy

1. Who we are

Bonita Medical Aesthetics & Wellness, operated by Jessica Caceres Nursing Professional Corporation ("Bonita", "we", "us"), is a nurse practitioner-led medical aesthetics and wellness clinic at 1369 King St N, St. Jacobs, Ontario N0B 2N0. This policy explains how we collect, use, share and protect personal information when you visit our clinic, book or receive care, shop online, use our website, or hear from us by email, text or social media.

Because we provide health care, we are a health information custodian under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). Personal information collected through our online shop and marketing is also protected under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

2. Our Privacy Officer

Jessica Caceres, NP, is our Privacy Officer and is accountable for how Bonita handles personal information. You can reach them at info@bonitamed.com or 519-404-3444.

3. What we collect

Personal health information, when you are a client or patient: your name, date of birth, contact details and emergency contact; health history, medications and allergies; consultation notes, treatment plans and treatment records; clinical photographs; consent forms; prescriptions; and information from other health care providers involved in your care.

Booking and payment information: appointment history, package and membership balances, and payment details. Card payments, including gift card purchases, are processed by Stripe and other secure payment processors. We do not store your card details.

Online shop information: your name, shipping and billing address, email, phone number and order history.

Communications: emails, texts, Instagram or Facebook messages and website form submissions you send us, including photos you send for a tattoo removal estimate.

Website information: your IP address, device and browser type, pages viewed and how you arrived at our site, collected through cookies and similar tools (see section 9).

4. How we use it

We use personal health information to assess you, provide and document your care, follow up after treatment, communicate with other providers in your circle of care, and meet our legal and professional obligations, including the record-keeping standards of the College of Nurses of Ontario.

We use other personal information to book and confirm appointments, send reminders and post-care instructions, process payments and orders, answer your questions, improve our website and services, and, with your consent, send you news and offers.

5. Consent

When you share health information with us to receive care, we rely on your implied consent to use it and share it with other health care providers involved in your care, unless you tell us otherwise. You can ask us not to share specific information with a particular provider, and we will explain any effect this may have on your care.

We ask for your express consent before we share your health information with anyone outside your circle of care, such as an insurer, employer or family member, except where the law permits or requires it.

You may withdraw your consent at any time by contacting our Privacy Officer. Withdrawal is not retroactive.

6. Clinical photographs

We take photographs before and after many treatments to plan your care and track your results. These photos are part of your health record, are stored in our secure electronic medical record, and are never taken or kept on personal devices.

We will only use a photo in our marketing, website or social media with your separate written consent, and you choose whether it can include identifying features. You can withdraw that consent at any time, and we will remove the photo from our own channels going forward, though we cannot recall content that was already shared or printed.

7. Email and text messages

We send appointment confirmations, reminders and care instructions by email and text as part of your care. These are not marketing messages.

We only send marketing emails and texts, such as promotions, events and newsletters, when you have opted in, as required by CASL. Every marketing message includes a way to unsubscribe, and we process requests within 10 business days. You can reply STOP to any text to opt out or HELP for assistance.

Mobile numbers and text-messaging opt-in information are never shared with third parties or affiliates for their marketing or promotional purposes. We share them only with the service providers who help us deliver our own messages.

Email and text are not completely secure. We keep detailed health information out of these messages, and we ask that you do the same when contacting us.

8. Who we share information with

We do not sell or rent your personal information.

We share information only as needed with:

• Other health care providers involved in your care, as described in section 5

• Service providers who support our clinic, under agreements that require them to protect your information and use it only for the services they provide to us. These include our electronic medical record and booking system, email and text messaging platforms, website and online store host, gift card and rewards platform, payment processors, shipping carriers, and IT and accounting providers

• Our professional regulator, insurers or lawyers where needed to meet our obligations or respond to a claim

• Others where the law permits or requires it, such as a court order or a duty to report

Some of our service providers store or process information outside Canada, including in the United States. When that happens, your information may be accessible to authorities in that country under its laws. Your clinical health record is kept in our electronic medical record, which stores data in Canada, in Montreal.

9. Cookies, analytics and advertising

Our website uses cookies and similar technologies to work properly and to understand how visitors use it.

• Google Analytics tells us which pages are visited and how people find us. Google may process this information in the United States. You can opt out with the Google Analytics opt-out browser add-on.

• Meta Pixel helps us measure our Facebook and Instagram advertising and show ads to people who have visited our site. You can manage this through your Facebook or Instagram ad preferences.

These tools are not connected to our electronic medical record and never receive your health record. Like most website tools, they can record which pages of our site you visit.

You can block or delete cookies in your browser settings. Some parts of the site may not work as intended if you do.

10. Virtual care and AI note-taking

When we offer care by secure video, we use the telehealth feature of our electronic medical record. We ask you to join from a private location and we do not record virtual appointments.

With your permission, we may use an AI scribe through Jane or Heidi Health, both of which store data in Canada, to help draft clinical notes. Your provider reviews every note before it is saved, and you can say no at any time.

11. How we protect information

We protect personal information with administrative, technical and physical safeguards, including password-protected and encrypted systems, access limited to staff who need it for their role, confidentiality agreements and privacy training for every team member, and secure storage and destruction of paper records.

If your personal health information is stolen, lost, or used or disclosed without authority, we will notify you at the first reasonable opportunity and report to the Information and Privacy Commissioner of Ontario where PHIPA requires it.

12. How long we keep it

We keep health records for as long as required by the College of Nurses of Ontario and applicable law, and then destroy them securely. We keep shop, billing and marketing records only as long as needed for the purpose they were collected or as required for tax and accounting.

13. Young people

Some of our services are available to teens. Under PHIPA, a person who is capable of consenting to their own care can also make decisions about their own health information, whatever their age. Where a young person is not capable, a parent or substitute decision-maker acts for them. Our website and shop are not directed at children under 13.

14. Your rights

You have the right to:

• Request access to your health record and other personal information we hold about you

• Ask us to correct information you believe is inaccurate or incomplete

• Withdraw consent, subject to legal and professional limits

• Opt out of marketing messages at any time

• Know who we have shared your information with

Please send requests in writing to our Privacy Officer. We respond to access requests within 30 days, as required by PHIPA, and will tell you if we need an extension. We may charge a reasonable cost-recovery fee for copies, and we will tell you the fee before we proceed. In limited cases the law allows us to refuse access, and if so we will explain why.

15. Questions and complaints

Please contact our Privacy Officer first so we can try to resolve your concern.

If you are not satisfied, you have the right to complain to the Information and Privacy Commissioner of Ontario at www.ipc.on.ca or 1-800-387-0073. For concerns about our online shop or marketing, you may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

16. Changes to this policy

We may update this policy as our services, tools or the law change. The date at the top shows when it was last updated, and we will post any changes on this page.

Contact Bonita Medical Aesthetics & Wellness 1369 King St N, St. Jacobs, ON N0B 2N0 info@bonitamed.com · 519-404-3444