Policies
Our policies outline the standards and procedures governing the operation of our cosmetic clinic. These policies complement your consumer rights and ensure a professional experience.
Last updated: September 7, 2026
Find out more about our Privacy Policy here.
IVONNE, Inc. ("IVONNE") Privacy Policy
This Privacy Policy describes how your personal information is collected, used, and shared when you receive treatments, consultations, or make a purchase from our clinic, or from *.ivonne.ca (the “Site”).
IVONNE adheres to all applicable privacy regulations, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 Fair Information Principles.
IVONNE has made best efforts to ensure that clients and website visitors from outside of Canada are prevented from using our website, services, or products. However, due to increasingly complex technical constraints it is not always possible to ensure that we are compliant with extra-Canadian laws. If you are not subject to Canadian law, you should not use this website, treatments, or products.
This website does not contain any confidential images of clients. All images are published with express and written consent.
When you visit the Site, we automatically collect certain information about your device, including browser type, IP address, time zone, and cookies installed on your device. As you browse, we collect information about pages viewed, referral sources, and interactions with the Site (“Device Information”).
We collect Device Information using:
When you make a purchase, appointment, or attempt either, we collect your name, billing and shipping address, payment information (including credit card numbers), email address, and phone number (“Order Information” or “Appointment Information”).
“Personal Information” includes Device Information, Order Information, and Appointment Information.
Our clinic located at 0116-320 Queen Street, Ottawa ON K1R 5A3 uses video surveillance for the safety of clients, staff, and property. All footage is securely stored and accessed only by authorized IVONNE personnel.
We collect relevant health and medical information to safely provide treatments and determine eligibility for services or products.
Photos and videos may be taken for clinical records and treatment tracking. With consent, images may be used for marketing. Consent does not entitle clients to compensation.
We obtain your consent to collect, use, and disclose your Personal Information through intake forms, online appointment bookings, treatment waivers, consent forms, and other written or electronic interactions with us. In certain circumstances, consent may be implied where permitted by law and where the purpose for the collection, use, or disclosure would be considered obvious and reasonable.
You may withdraw your consent at any time, subject to legal, regulatory, contractual, and clinical limitations. Withdrawal of consent may affect our ability to provide certain treatments, services, or products. Requests to withdraw consent may be made by contacting us using the information provided in this Privacy Policy.
We use your Personal Information to:
We share your Personal Information with third parties only as necessary to operate our business and deliver services.
Scheduling & Website Services:
We use Acuity Scheduling (a Squarespace company) to power our online scheduling system and Squarespace to power our website and eCommerce services. Learn more: www.squarespace.com/privacy.
Online Payment Processing:
We use Stripe, Inc. (“Stripe”) to process online payments and manage billing. Stripe may collect and process personal and payment information directly from you. Learn more: www.stripe.com/privacy.
In-Clinic Point-of-Sale (POS) Payments:
We use Square, Inc. (“Square” or “Squareup”) to process in-clinic payments, including debit and credit card transactions. Square may collect and process payment and device information in accordance with its privacy practices: www.squareup.com/privacy.
Analytics:
We use Google Analytics to understand how visitors use our Site. Learn more: www.google.com/intl/en/policies/privacy. Opt out here: tools.google.com/dlpage/gaoptout.
Client Records & Marketing Systems:
We use HubSpot, Inc. to manage website content, forms, and client records. Learn more: legal.hubspot.com/privacy-policy.
We may also share information with regulated suppliers and manufacturers (e.g., AlumierMD, Hydrafacial, Candela) to support treatment planning, product fulfillment, and client care.
Infrastructure & Communications:
We use cloud-based infrastructure and communication services (including email, hosting, and data storage) provided by third parties who are contractually bound to protect your personal information in accordance with applicable privacy laws. These providers process information only as necessary to deliver services to us and are prohibited from using your information for their own purposes.
We may disclose Personal Information to comply with applicable laws, regulations, or lawful requests.
If you provide your mobile number, you may consent to receive text messages from IVONNE. We collect consent separately for two distinct message types, and you may agree to one, both, or neither:
You also provide your phone number when you book or attend an appointment as a client of IVONNE. By booking or attending an appointment you agree to receive appointment-related text messages, such as confirmations, reminders, one-time verification codes, and replies to your inquiries. These messages are non-marketing. Message frequency varies and message and data rates may apply. Reply HELP for help and STOP to cancel at any time.
Consent to receive text messages is optional and is never a condition of contacting us or of any purchase. Message frequency varies and message and data rates may apply. Reply HELP for help and STOP to cancel at any time.
Your mobile opt-in information and phone number are never sold, rented, or shared with third parties or affiliates for their own marketing purposes. Phone numbers are shared only with the service providers that deliver our messages (for example, our SMS carrier) and solely to send the texts you requested. SMS consent is never shared with any third party for marketing.
For a complete description of how we use AI, which providers process your data, and your controls, please see our AI Data Processing Policy.
We use a combination of algorithmic logic and artificial intelligence ("AI") to support our operations and improve your experience.
The majority of our data processing — including scheduling, reminders, status updates, and notifications — is handled by deterministic systems that do not involve AI. These systems follow fixed rules and do not learn from or analyze the content of your communications.
In limited cases, we use third-party AI services to assist with:
When AI processing is used, only the minimum data necessary for the specific task is shared with the AI provider (e.g., message content, appointment type and time). We do not send passwords, payment information, or unnecessary personal details to AI providers. AI providers process data under their respective API terms and do not use your data to train their models.
Your control: AI-assisted processing of your written communications (email and SMS) requires your consent and can be managed on a per-channel basis through your profile settings. You may also exclude specific AI providers from processing your data. To adjust your AI processing preferences, visit your profile at clinic.ivonne.ca/client-settings or contact us directly.
Telephone calls: All telephone calls to and from our clinic are recorded for quality assurance and training purposes, and are transcribed using AI. If you prefer to communicate without call recording, you may send us a private message through the client portal instead.
Email infrastructure: Our email is hosted on Google Workspace, which may use automated processing — including AI-powered features — to deliver, filter, and organize incoming messages. This processing is inherent to the email platform and occurs under Google's privacy policy. If you prefer to communicate without third-party email processing, you may use the client portal instead.
We may use your activity, purchase history, and preferences to personalize the marketing you receive, including emails, on-site banners, and advertisements on third-party platforms. We do not use your SMS opt-in or mobile number for third-party or interest-based advertising.
Your control: You may opt out of interest-based marketing at any time through your account settings. When opted out, you may still receive general promotions, but they will not be personalized to your activity.
Safety filtering: Regardless of your marketing preferences, we always filter treatments, products, and services based on your health profile and contraindications. This is a safety measure and cannot be disabled.
Learn more about online advertising at networkadvertising.org.
We do not alter data collection practices in response to Do Not Track browser signals.
Our clinic operates within a leased commercial space. Our lease agreement explicitly excludes all records containing personal information — as defined under the Personal Information Protection and Electronic Documents Act (PIPEDA) — from any rights, entitlements, or security interests held by the property owner or landlord. At no time does our landlord have any right to your personal information.
Email providers decide how addresses at their own domain are interpreted, and a small number treat variations of an address as one mailbox. Google is the clearest example: Gmail and Googlemail ignore dots before the @ and deliver +tagged addresses to the same inbox. Where a provider documents this behaviour, we follow it and treat those forms as one person, so that your appointments, communications and account history stay on a single record rather than being split across several. The current list appears in our Communication Policy.
We do not assume this for other providers. Microsoft and Yahoo treat dots as significant, and at a workplace or custom domain similar-looking addresses may belong to different individuals, so we treat those as separate records. Where a provider does not publish its policy, we make no assumption and keep the addresses distinct.
We store the address you gave us exactly as you entered it. The comparison used for matching is derived from it; it is not displayed to you and is not used as your login. We do not combine records on an email match alone where other details, such as name or phone number, indicate a different person.
Because records are matched this way, we ask that each person use their own email address. A single address shared between two people cannot be reliably separated, and may result in one person’s information being associated with another’s record.
The email address and mobile number you give us are not only how we reach you. They identify you in our records and are used to verify your identity when you sign in to your client portal, and when you access any account you hold with us or with a third party we work with on your behalf, including product accounts such as AlumierMD. A one-time code sent to your email address or mobile number is sufficient to obtain access.
You must therefore give us contact details that you alone control. By providing an email address or mobile number, you confirm that you are the only person with access to it, and that it is not shared with a spouse, partner, family member, employer or anyone else. This applies when you communicate with us, when you book or attend an appointment, when you sign in to your portal or a linked third-party account, and when you receive results, records, invoices or product information.
We rely on this confirmation. Where you supply contact details that others can access, personal health information may be disclosed to those persons, and they may be able to obtain access to your account. Disclosure arising in these circumstances occurs with your knowledge and consent. Under Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) we take reasonable steps to protect your information against unauthorized access; we cannot control who else can open a mailbox or read messages on a device that is not exclusively yours.
If your contact details stop being exclusively yours, or you lose access to them, please tell us promptly so we can update your record and re-secure your account. You may update your details at any time through your client portal or by contacting 30482650126a9fe0af65075. If you are unable to provide contact details that only you can access, tell us and we will discuss alternatives, including communicating with you by mail or in person.
If you would like us to send appointment notices or other information to another person, such as a caregiver, family member or assistant, we will record that person separately as a notification contact with your express consent. That consent is limited to the information you specify, may be withdrawn at any time, and does not give that person access to your portal, your record or your account.
Nothing in this section limits your rights under PHIPA or the Personal Information Protection and Electronic Documents Act (PIPEDA), or our obligations under them.
Canadian residents may request access to or correction of their Personal Information. European residents have additional rights under GDPR. Contact us to exercise your rights.
We use industry-standard measures to protect your personal information. All connections are secured with TLS encryption, and stored data is protected at rest.
Your password is stored using a one-way cryptographic hash and is never stored in plain text. We cannot see or retrieve your password — only you know it.
Your client record is retained for as long as we are required to keep it. Where your record includes health information, we retain it for the period required by applicable professional and privacy legislation, and we do not delete or deactivate it for inactivity alone. If you have not visited in some time, your record and history remain intact.
Records are encrypted and securely stored throughout the retention period, and are securely destroyed once that period has elapsed. You may ask us at any time what information we hold about you, and request corrections.
We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes.
For any questions or complaints in relation to this agreement or any product or treatment you purchase, you may contact IVONNE at the following:
By Regular Mail:
IVONNE, Inc.
0116-320 Queen Street, Ottawa ON K1R 5A3
By Email:
17085726816a9fe0af66484
By Phone:
(613) 695-6662
By Social Media:
@ivonneclinic
Notice an error, inconsistency, or legal concern with this policy? Active clients can report it via their client portal.
Back to Policies