1. Scope and responsibility
This policy explains how Best Ayurveda Clinic collects, uses, discloses, retains, and protects personal information in connection with its public website, intake and check-in forms, clinic services, bookings, payments, communications, and interactions through Facebook, Instagram, Messenger, or WhatsApp. It applies to information received directly from you and, where a service is connected, through an authorized platform. Clinic contact details above are maintained in our About Clinic record. This policy does not replace a clinical consent form or the independent privacy policies of third-party platforms.
2. Information we collect
Depending on your interaction, information may include your name, telephone number, email address, mailing address, date of birth, referral source, appointment requests, and preferences. When you seek care, we may collect health concerns, symptoms, health history, assessments, treatment and prescription records, allergies, medications, and information you choose to submit. Clinical images, recordings, and other sensitive material are subject to the relevant clinical consent process. We also maintain consent records, including the consent text, acceptance time, and available browser, device, session, or network information. Billing records may include invoice items, amounts, payment status, delivery information, and payment-provider transaction identifiers. Payment details submitted directly to a payment processor are handled by that processor.
3. Meta platform information
If you submit a Meta lead form or contact our clinic through Facebook, Instagram, Messenger, or WhatsApp, we may receive information you provide, such as your name, contact details, inquiry, message content, attachments, and appointment preferences. Where authorized functionality is connected, associated platform identifiers, business/page account identifiers, timestamps, conversation details, and campaign or referral information may also be received. Information made available depends on your action, platform permissions, and the connected service; this policy does not mean every integration is active. We do not request your Meta account password or access unrelated private account content.
4. Purposes and consent
We use information to respond to inquiries, assess and provide clinic services, coordinate practitioners and appointments, maintain care and consent records, process invoices and payments, arrange medicine pickup or shipping, communicate about requested services, and administer and secure the clinic system. We use lead source or campaign information to understand how inquiries reach us. Collection and use must be limited to appropriate purposes and supported by consent or another lawful authority. Optional promotional communications require the consent applicable to the channel and law; you may opt out without losing access to clinical services. Submitting a form does not authorize unrelated uses of sensitive health information.
5. Limits on Meta data use
Information received through Meta is used only for the purposes disclosed here and permitted by the applicable Meta terms and permissions. It is not sold, licensed, transferred to data brokers, or used to build unrelated profiles. We do not use Meta platform information for discriminatory decisions or unrelated advertising, and do not send clinical records or sensitive health information to Meta advertising tools for targeting. Disclosures to providers must be limited to delivering the requested services or a legally required purpose, with appropriate confidentiality and processing restrictions.
6. Who may receive information
Relevant clinic practitioners and authorized staff may access information needed for their responsibilities. Providers supporting hosting and record management (including Base44), appointment scheduling, payment processing (including Stripe), email, telephone or messaging, shipping, and requested AI-assisted features may process the information necessary for those services. Meta processes communications made through its products under its own terms and privacy policy. Provider involvement depends on the feature used. Information may also be disclosed with your authorization or where required or permitted by law, such as a valid legal request or a necessary safety response. We do not sell personal information.
7. Sensitive information and AI-assisted features
Health information requires particular care. Please use the clinic's intended intake and clinical channels rather than public comments or social messages to provide sensitive records. If a requested clinical feature uses an external AI service, the relevant submitted information may be processed to generate its output, subject to the applicable consent and provider arrangements. AI output supports practitioner review and is not a substitute for professional judgment. Permission to receive marketing does not constitute permission to use health information for advertising or unrelated AI training.
8. Cookies, logs, and third-party content
The website may use session storage, cookies, and similar technologies needed for authentication, form operation, security, or preferences. Available technical logs or analytics may include pages visited, actions taken, browser/device details, timestamps, and network information. Embedded booking tools and other third-party content may apply their own technologies and policies. Optional tracking must follow applicable notice and consent requirements; we do not represent that a Meta Pixel or any specific optional tracker is active. Browser controls can restrict cookies, though some functions may stop working.
9. Retention and deletion
We retain information only as needed for the disclosed purpose and applicable legal, professional, accounting, consent, security, and recordkeeping obligations. Retention depends on the type of record; clinical records may need to be kept even after an inquiry or account is closed. Meta-derived information that is no longer necessary, permission has been withdrawn, or deletion is validly requested must be deleted or de-identified as required by applicable law and Meta terms. Providers processing that information on our behalf must be instructed accordingly. Backup copies may remain until scheduled replacement and must not be restored for unrelated use. When a retention obligation prevents full deletion, we will explain the limitation and restrict further use where appropriate.
10. Your choices and privacy rights
Subject to applicable law, you may request access to your personal information, correction of inaccurate information, an explanation of its use or disclosure, withdrawal of consent, and deletion of information no longer lawfully needed. You may decline optional information or communications, although some information is necessary to provide requested care. You can also manage platform permissions through Meta account settings. Removing a platform permission alone does not delete records already held by the clinic; contact us to request deletion. We will verify identity proportionately, respond within applicable legal timelines, and explain any lawful exception.
11. Data deletion instructions for Meta users
To request deletion of information obtained through Facebook, Instagram, Messenger, WhatsApp, or a Meta lead form, contact the clinic using the email or telephone shown above and ask for a 'Meta data deletion request'. Include your name, the platform or channel used, an approximate interaction date, and a contact detail that helps locate the record. Never send a password or access token. We will confirm the request, verify identity where necessary, and delete applicable information or explain a legal retention exception. You may use the same process for general personal-data deletion, consent withdrawal, or access requests.
12. Security and international processing
Personal information must be protected using safeguards appropriate to its sensitivity, including access restrictions, confidentiality measures, and secure handling. No internet transmission or storage method can be guaranteed completely secure. Please report suspected unauthorized access using the contact details above. Service providers may process information outside Ontario or Canada, where it may be subject to local laws and lawful government access. Applicable Canadian and Ontario privacy requirements, including PIPEDA and PHIPA where they apply to the clinic or a practitioner, govern our obligations; this policy does not claim a certification or regulatory approval.
13. Children, third parties, and complaints
When services involve a child or a person represented by an authorized decision-maker, we handle information and consent according to applicable capacity, guardianship, and privacy rules. Parents or representatives can contact the clinic about consent and rights, subject to the individual's legal rights. Links, embedded services, and communications on third-party platforms are also governed by those providers' policies. Raise a privacy concern with the clinic first; you may also contact the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario, as applicable.
14. Policy updates
We may update this policy when services, providers, legal obligations, or information practices change. The effective and last-updated date is displayed above. Material changes that require new notice or consent will be handled before the affected use. The public policy remains accessible without signing in.
15. Privacy contact and deletion requests
Contact the privacy contact at Best Ayurveda Clinic using the clinic details at the top of this page. Use the subject “Privacy request” or “Meta data deletion request” and provide only the information necessary to identify your request.
Meta's independent privacy policy: https://www.facebook.com/privacy/policy/