External Affairs Medical Spa Privacy Policy

Last updated on July 9, 2026. This Privacy Policy is effective immediately upon posting.

Introduction

At External Affairs Medical Spa (“External Affairs,” “the Company,” “we,” “us,” or “our”), we respect your privacy and are committed to protecting it through our compliance with this Privacy Policy.

External Affairs operates medical aesthetics clinics in Edmonton and St. Albert, Alberta, and in Kelowna, British Columbia. Depending on the location of the clinic you interact with, your personal information may be subject to Alberta’s Personal Information Protection Act (“Alberta PIPA”), British Columbia’s Personal Information Protection Act (“BC PIPA”), and, where applicable, Alberta’s Health Information Act (“HIA”) with respect to health information collected in connection with clinical treatment. Where this Policy refers to “PIPA,” it means the applicable provincial statute governing the clinic location with which you interact.

Purpose

The purpose of this Privacy Policy is to inform users of our website (“Site”), our Zenoti-based booking and client platform (“App”), our paid advertising (“Ads”), and our clinics generally, of the following:

•        The personal data, including health and medical information, we collect;

•        How we use the data we collect;

•        Who has access to the data we collect, including our third-party service providers;

•        Where that data may be stored, including outside of Canada;

•        The Site’s and third parties’ cookie practices;

•        Your rights as an individual, including your right to access, correct, and withdraw consent regarding your personal information; and

•        How to contact our Privacy Officer with questions or concerns.

Children Under the Age of 13

Our Site and App are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on our Site, App, or Ads, and do not make any purchases or bookings through the Site or App, or provide any information about yourself to us, including your name, address, telephone number, or e-mail address. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact our Privacy Officer using the information at the end of this Policy.

Consent

By using our Site, App, and Ads, or by receiving services at one of our clinics, you agree that you consent to:

•        The conditions set out in this Privacy Policy; and

•        The collection, use, and retention of the data described in this Privacy Policy.

Where we collect sensitive information, such as health and medical information described below, we will seek your express consent at the time of collection, typically through an intake or consultation form.

Personal Data We Collect

We only collect data that helps us achieve the purposes set out in this Privacy Policy. We collect several types of information from and about users of our Site, App, Ads, and clinic services, including:

•        First and last name, date of birth, e-mail address, phone number, address, and payment information;

•        Health and medical information relevant to the aesthetic and medical services you receive, described further below; and

•        Information about your internet connection, the equipment you use to access our Site and App, and usage details.

We collect this information:

•        Directly from you, when you provide it through our Site, App, Ads, intake forms, or in-clinic consultations;

•        Automatically, as you navigate through the Site, App, and Ads; and

•        From third parties, such as our business partners or analytics and advertising providers.

Health and Medical Information

As a medical aesthetics provider, we collect health and medical information necessary to safely assess, treat, and follow up with you, including:

•        Medical history and intake form responses;

•        Consultation notes and treatment records completed by our clinical staff or practitioners;

•        Before-and-after photographs taken in connection with your treatment, where you have separately consented; and

•        Records of the services and treatments you have received, including product lots and dosages where relevant.

This information is collected with your express consent, is used only to provide safe and appropriate care and for the clinical and business purposes described in this Policy, and is treated with a heightened degree of confidentiality. Access to this information within our organization is limited to clinical and administrative staff who require it to provide your care or manage your file. Depending on your clinic location, this information may also be subject to the Health Information Act (Alberta) or applicable British Columbia health-privacy obligations, in addition to PIPA.

Data Collected Automatically

As you interact with our Site, App, and Ads, we may use automatic data collection technologies to collect certain information about your equipment or browsing behaviour, including:

•        Details of your visits to our Site, App, and Ads, including site behaviour, location data, and the resources you access and use;

•        Information about your computer and internet connection, including your IP address, operating system, and browser type.

We also may use these technologies to collect information about your online activities over time and across third-party websites or online services (behavioural tracking). This helps us to:

•        Estimate our Site and App audience and usage patterns;

•        Store your preferences, allowing us to customize our Site and communications; and

•        Recognize you when you return to our Site or Ads.

The technologies we use for automatic data collection include:

•        Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse browser cookies by adjusting your browser settings; doing so may limit your ability to access certain parts of our Site.

•        Web Beacons. Small electronic files (also called clear gifs, pixel tags, or single-pixel gifs) that allow us to count users who have visited a page or opened an e-mail, and to compile related statistics.

•        Advertising and Analytics Pixels. We use the Meta Pixel and Google Analytics 4 (“GA4”) to measure the effectiveness of our advertising and to understand how visitors use our Site, as described further under “Third-Party Service Providers and Data Processors” below.

Data Collected in a Non-Automatic Way

This includes information you provide to us by using our Site or App, filling out an Ads form, or completing an in-clinic form. We may also ask you for information when you report a problem with our Site or App.

•        Records and copies of your correspondence (including e-mail addresses), if you contact us;

•        Your responses to surveys we might ask you to complete;

•        Details of transactions and bookings completed through our Site, App, or in-clinic, and of the fulfillment of your orders or appointments; and

•        Your search queries on the Site.

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications on the Site, including advertisements, are served by third parties, including advertisers, ad networks and servers, and content providers. These third parties may use cookies, web beacons, or other tracking technologies to collect information about you when you use our Site or App, and may use this information to provide interest-based advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. If you have questions about a specific advertisement, please contact the responsible provider directly.

How We Use Your Information

We use information we collect about you, or that you provide to us, including any personal information:

•        To present our Site and its contents to you;

•        To provide you with the products, services, or appointments you request;

•        To assess, deliver, and follow up on your medical aesthetic treatment;

•        To provide you with notices about your account, appointments, or subscriptions;

•        To carry out our obligations and enforce our rights arising from any contracts between you and us, including billing and collection;

•        To notify you about changes to our Site, App, or the services we offer;

•        For any other purpose disclosed to you at the time of collection, or for which you provide the information; and

•        For any other purpose with your consent.

We may use aggregated or de-identified information to help display advertisements to relevant audiences. We do not disclose your personal information to advertisers for these purposes without your consent.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or you provide as described in this Privacy Policy:

•        To our subsidiaries and affiliates;

•        To contractors, service providers, and other third parties we use to support our business, who are bound by contractual obligations to keep personal information confidential and to use it only for the purposes for which we disclose it;

•        To third parties to market their products or services to you, only if you have consented to such disclosure;

•        To fulfill the purpose for which you provided the information, or for any other purpose disclosed by us at that time; and

•        With your consent.

We may also disclose your personal information:

•        To comply with a court order, law, or legal process, including responding to a government or regulatory request;

•        To enforce or apply our terms of use and other agreements, including for billing and collection; and

•        Where we believe disclosure is necessary to protect the rights, property, or safety of the Company, our clients, or others.

Third-Party Service Providers and Data Processors

We use third-party service providers to help us operate our business and deliver services to you. These providers may access your personal information only to the extent necessary to perform their functions, and are contractually obligated to keep it confidential and to use it solely for the purposes for which it was disclosed.

Our current third-party service providers include:

•        Zenoti – Practice management platform used to manage appointments, client records, treatment and consultation notes, and transactions.

•        Flodesk – Email marketing platform used to send promotional and informational communications to subscribers.

•        Google Workspace – Business productivity and communication tools used for internal operations and email.

•        Meta (Meta Pixel) – Advertising and analytics technology used to measure the performance of our advertising and to deliver relevant ads to Site visitors.

•        Google Analytics 4 (GA4) – Web analytics platform used to understand how visitors use our Site.

•        Zapier – Workflow automation platform used to connect and synchronize data between our other service providers, such as processing email subscription and unsubscribe requests between Zenoti and Flodesk.

•        Simplified – Client-facing chatbot widget on our Site used to answer general questions (such as booking, rescheduling, or cancellation inquiries) and to notify our team of the outcome of a client's conversation, described further under “Automated Processing and Chatbots” below.

We may update our service providers from time to time. Any new providers will be held to the same confidentiality and data protection standards described in this Privacy Policy.

Automated Processing and Chatbots

Our Site includes a client-facing chatbot, provided by Simplified, to help answer general questions such as booking, rescheduling, cancellation, hours, and service inquiries. This chatbot is intended for general and administrative questions only and is not used to provide medical advice, clinical assessment, or treatment recommendations. If you have a question involving your health, a reaction to a treatment, or your medical history, please contact your clinic directly rather than relying on the chatbot.

Depending on the outcome of your conversation with the chatbot (for example, if you decide to book, reschedule, or cancel an appointment), our team receives a notification so that a staff member can follow up or take the appropriate action on your file. Information you provide to the chatbot may be processed by Simplified’s systems, which are based in the United States, in order to generate a response and relay the relevant outcome to our team.

We also use an internal, staff-facing chatbot through Zenoti to help our team troubleshoot use of our practice management platform. This internal tool does not interact with clients and does not process client personal information; accordingly, it is not addressed further in this Policy.

Cross-Border Storage and Transfer of Personal Information

Zenoti, Flodesk, Google Workspace, Meta, Google Analytics 4, Zapier, and Simplified are based outside of Canada, principally in the United States. In the course of providing services to us, these providers may collect, store, process, or transfer your personal information on servers located in the United States or other jurisdictions outside Canada.

Personal information stored outside Canada is subject to the laws of the jurisdiction in which it is held, and may be accessible to courts, law enforcement, or national security authorities of that jurisdiction under their applicable laws.

Alberta PIPA section 13.1 specifically requires organizations to provide this notice where a service provider outside Canada is used to collect, use, or store personal information. BC PIPA does not contain an identical statutory provision, but we provide the same disclosure to clients of our Kelowna clinic as a consistent practice across all of our locations. In accordance with Alberta PIPA section 13.1, and as a matter of consistent practice for all clients regardless of location, we advise you that:

•        We use service providers located outside Canada to collect, use, store, or process your personal information, as described above;

•        Our Privacy Officer, Carla Cadger, is able to answer your questions about our use of these service providers on behalf of the Company; and

•        You may request access to our written policies and practices regarding the use of service providers outside Canada by contacting our Privacy Officer using the information at the end of this Policy.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to give you the following control over your information:

•        Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent.

We do not control third parties’ collection or use of your information for interest-based advertising; however, these third parties may provide their own opt-out mechanisms. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website.

Withdrawing Consent

You may withdraw or vary your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions, by giving us reasonable notice in writing to our Privacy Officer using the contact information at the end of this Policy.

Before acting on your withdrawal, we will inform you of the likely consequences, which may include:

•        Our ability to offer, book, or continue certain services to you may be limited or become unavailable if we can no longer collect, use, or process the personal information reasonably required to safely provide that service;

•        If you withdraw consent to marketing communications, you will no longer receive promotional or informational messages from us, but this will not affect service-related or transactional communications necessary to fulfill an existing booking or obligation; and

•        Withdrawal of consent does not require us to destroy, and will not result in the deletion of, personal information we are otherwise required to retain by law, including clinical, medical, or treatment records that we are obligated to retain as the custodian of your medical record under applicable health information legislation and professional regulatory requirements.

Withdrawing or varying consent will not affect the lawfulness of any collection, use, or disclosure that occurred before you provided notice of withdrawal, and will not affect our ability to meet a legal obligation.

How Long We Store Your Personal Data

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, clinical, or reporting requirements.

As a general practice, we retain client and personal information, including clinical and treatment records, for a period of 10 years from the date of last contact or the date of your last appointment, whichever is later, unless a longer retention period is required by law or professional regulatory obligation, or a shorter period is required by applicable law. After this period, personal information is securely destroyed or rendered non-identifying.

Accessing and Correcting Your Information

You may contact our Privacy Officer to request access to, correction of, or deletion of personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement, cause the information to be incorrect, or conflict with our obligations as custodian of your clinical records.

If you delete your user contributions from the Site, copies of your contributions may remain viewable in cached and archived pages, or may have been copied or stored by other Site users. Proper access to and use of information provided on the Site, including user contributions, is governed by our Terms of Use.

Data Security

We have implemented administrative, technical, and physical measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. Where we have given you (or you have chosen) a password for access to certain parts of our App, you are responsible for keeping that password confidential and should not share it with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information transmitted to our Site or App. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures on the Site.

Applicable Privacy Laws

This Privacy Policy is designed to comply with Alberta’s Personal Information Protection Act and British Columbia’s Personal Information Protection Act, depending on the location of the External Affairs clinic with which you interact, and, where applicable to health information collected for clinical purposes, Alberta’s Health Information Act and equivalent British Columbia health-privacy requirements. If any provision of this Policy conflicts with a mandatory requirement of applicable law, the applicable law will govern.

Changes to Our Privacy Policy

It is our policy to post any changes we make to this Privacy Policy on this page. If we make material changes to how we treat our users’ personal information, we will notify you by e-mail to the address specified in your account, and/or through a notice on the Site’s Privacy Policy page. When we amend this Privacy Policy, we will update the “Last Updated” date at the top of this page. We recommend that you periodically review this Privacy Policy to stay informed of any updates.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, our privacy practices, or how to access our written policies and procedures regarding service providers outside Canada, please contact:

Carla Cadger, Privacy Officer

External Affairs Medical Spa

Email: info@externalaffairs.ca

Thank you.