Privacy Policy for Body Co Toronto

Effective date: October 2, 2026

Body Co Health & Wellness ("Body Co", "we" or "us") is a multidisciplinary health and wellness clinic at 3093 Dundas Street West in Toronto, operated by Melanie Sutherland Healthcare Inc. This policy explains what personal information we collect, why we collect it, how we protect it and the choices you have. It covers our clinic, our website at bodycotoronto.com, our classes and workshops, and the emails we send.

1. The two kinds of information we handle

Personal health information. When you come to us for care, our regulated health practitioners collect information about your health so they can assess and treat you. This information is protected under Ontario's Personal Health Information Protection Act, 2004 (PHIPA). Clinical records are kept in our secure practice management system, Jane, and not on our website.

Other personal information. When you visit our website, buy a class or workshop, join a waitlist or sign up for our emails, we collect contact and purchase details. This information is handled in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

2. What we collect

Contact details such as your name, email address, phone number and mailing address.
Booking and purchase details such as appointments, class and workshop registrations, orders and payment status. Card payments are handled by our payment processors, and we don't store full card numbers.
Health information such as your health history, assessments, treatment notes and anything you share with your practitioner. Some of our waitlist forms ask for your due date so we can place you in the right session.
Information you send us through contact forms, waitlists, webinar registrations, free downloads and our monthly massage draw.
Website usage information such as your IP address, browser and device type, the pages you visit and how you found us. Most of this is collected through cookies (see section 6).

3. How we use it

To provide your care, book and manage appointments, and contact you about them.
To process payments and give you receipts you can submit to your insurer.
To run our classes, workshops and webinars.
To send you newsletters and offers, when you've agreed to receive them.
To understand how our website is used so we can improve it.
To meet our legal, regulatory and professional obligations, including record keeping required by our practitioners' regulatory colleges.

We do not sell your personal information.

4. Your consent

We collect, use and share your information with your consent, or where the law allows or requires it. For your health care, PHIPA allows our practitioners to rely on your implied consent to share relevant health information with others who are part of your circle of care, such as another practitioner who is treating you, unless you tell us not to. We ask for your express consent before sharing your health information with anyone outside your circle of care, such as an insurer, lawyer or employer, unless the law permits or requires it.

You can withdraw your consent at any time, subject to legal limits. If withdrawing consent affects the care or service we can offer, we'll explain how.

5. Emails and marketing

We only send promotional emails, like newsletters, class launches and offers, to people who have opted in, for example by signing up for our newsletter, downloading a free resource or registering for a webinar. Every promotional email includes an unsubscribe link, and we act on unsubscribe requests within 10 business days. Even if you unsubscribe, we may still send messages directly related to your care or purchases, such as appointment reminders and receipts.

6. Cookies, analytics and advertising

Our website uses cookies and similar tools to keep the site working, remember your preferences, understand how visitors use the site and measure how well our advertising works. These include our website platform's built-in analytics, Google Analytics, and Meta's (Facebook and Instagram) advertising measurement tools, including the Meta Conversions API.

We do not share your health information, treatment details or clinical records with advertising or social media platforms. You can block or delete cookies in your browser settings, and you can manage how Meta and Google use your activity for ads through your account settings on those platforms. You can also stop Google Analytics from collecting your visits by installing the Google Analytics opt-out browser add-on. Some parts of the site may not work properly if cookies are turned off.

7. Who we share it with

Your circle of care. Other practitioners involved in your care, as described in section 4.
Service providers who help us run the clinic, such as our practice management and booking system (Jane), our website, forms, email and online store platform (Hiveality), our payment processors, and our email and file storage providers. They may only use your information to provide services to us and are required to protect it.
Insurers, when you ask us to bill them directly or submit information on your behalf.
Where the law requires or permits it, for example in response to a court order, a request from a practitioner's regulatory college, a mandatory report such as a child protection concern, or to prevent a significant risk of serious harm.

8. Where your information is stored

Some of our service providers, such as our website, email and payment providers, may store or process information outside Canada, including in the United States. When that happens, your information may be subject to the laws of that country and could be accessed by its courts or authorities. We choose providers with strong security practices and require them to protect your information.

9. How long we keep it

Health records are kept for as long as required by our practitioners' regulatory colleges and Ontario law. This is generally at least 10 years after your last visit or, for children, 10 years after their 18th birthday, whichever is later. After that, records are securely destroyed.
Financial records are kept as long as tax law requires.
Marketing information is kept until you unsubscribe or ask us to delete it, and we regularly remove contacts we no longer need.

10. How we protect it

We use administrative, technical and physical safeguards to protect your information. These include limiting access to the people who need it, password protected and encrypted systems, confidentiality agreements and privacy training for our team, and secure storage for any paper records. No system is completely secure, but we take protecting your information seriously.

If your personal health information is lost, stolen or accessed without authorization, we will tell you at the first reasonable opportunity and notify the Information and Privacy Commissioner of Ontario when required.

11. Children and young people

We care for babies, children and teens. For young children, a parent or guardian usually provides information and consent on their behalf. Under PHIPA, a young person who is capable of making their own decisions about their health information can do so. For a child under 16, a parent or guardian may also be able to give or withhold consent, except for information about treatment the child has decided on independently. Our marketing emails are not directed at children, and we do not knowingly sign up anyone under 18 for them.

12. Your rights

You can ask to see or get a copy of your health record. Please send your request in writing. We'll respond within 30 days, as PHIPA requires, and may charge a reasonable fee for copies.
You can ask us to correct information you believe is inaccurate or incomplete.
You can ask what personal information we hold about you and who we've shared it with.
You can withdraw your consent or unsubscribe from our emails at any time.
You can ask us to delete personal information we no longer need, such as marketing details. Health records must be kept for the periods described in section 9.

13. Other websites

Our website links to other sites, like our online booking page and social media. Those sites have their own privacy policies, and we're not responsible for how they handle your information.

14. Questions or concerns

If you have a question, want to make a request or have a concern about how we've handled your information, please contact our Privacy Officer:

Melanie Sutherland, Privacy Officer
Body Co Health & Wellness
3093 Dundas Street West, Toronto, ON M6P 1Z9
Email: info@bodycotoronto.com
Phone: 416-572-0479

If we can't resolve your concern, you can contact the Information and Privacy Commissioner of Ontario (for health information) at 1-800-387-0073, or the Office of the Privacy Commissioner of Canada (for other personal information) at 1-800-282-1376.

15. Changes to this policy

We'll update this policy when our practices or the law change. The effective date at the top shows when it was last updated. If we make significant changes, we'll let you know by email or with a notice on our website.