Privacy Policy

1. About this policy

Feldman Hair Institute (“FHI,” “we,” “us” or “our”), respects the privacy of people who visit feldmanhairinstitute.com, contact FHI, use our booking pathway or receive our services. This Privacy Policy explains what personal information we collect through the public website, how we use and disclose it, the choices available to you and how to contact us.

This policy applies to the public FHI website and related communications under FHI’s control. Clinical intake, appointment booking, photographs, laboratory results, medical records, questionnaires and secure patient messaging are handled through Jane, a third-party practice-management platform, or through another secure method expressly approved by FHI. When you enter Jane, its privacy information and the consents or service terms presented there also apply.

FHI handles personal information in accordance with applicable Canadian and Ontario privacy laws, including the Personal Information Protection and Electronic Documents Act and the Personal Health Information Protection Act where those laws apply. Rights for visitors in the United States or elsewhere depend on the law that applies to the particular interaction.

2. Information we collect

The information FHI collects depends on how you interact with us.

Information collected through the public website

• Technical and usage information, such as Internet Protocol address, approximate location derived from that address, browser and device type, operating system, referring page, pages viewed, dates and times, and security or error events.
• Cookie and similar-technology information needed to operate, secure and improve the website.
• Information you choose to provide when using a public contact pathway, such as your name, telephone number, preferred contact method and a brief non-clinical reason for contacting FHI.
• Communications relating to privacy, accessibility, professional collaboration, research, media or other general inquiries.

Information collected through Jane or an approved secure channel

If you proceed to booking or clinical intake, FHI may collect identity and contact details, demographic information, health history, medications and supplements, treatment history and response, photographs, imaging, laboratory and pathology information, practitioner records, payment or insurance information, appointment records, consent choices and communications. The precise information depends on the service requested and what is reasonably necessary to assess, plan, coordinate or monitor your case.

Information from other people or organizations

With appropriate authority or consent, FHI may receive information from a referring or treating practitioner, laboratory, imaging provider, pharmacy, caregiver, parent or guardian, or another person involved in your care. We may also receive business contact information from professional collaborators and publicly available professional sources.

3. Please use the secure clinical pathway

Do not send photographs, laboratory results, medical records, detailed health histories or urgent clinical information to the privacy email address or through a general website contact pathway. Use the Jane link or another secure method specifically provided by FHI. Email and ordinary website forms may not offer the safeguards appropriate for clinical records.

4. How we use personal information

FHI may use personal information to:

• operate, maintain, secure and troubleshoot the website;
• respond to inquiries and route prospective patients or practitioners to the appropriate next step;
• schedule and administer appointments, intake, assessment, interpretation, planning, monitoring and follow-up services;
• review submitted information, prepare case documentation and communicate findings, priorities and monitoring markers;
• coordinate with treating practitioners or other authorized people when you have requested or consented to that coordination;
• process payments, maintain business and clinical records, and meet accounting, insurance and audit requirements;
• improve website clarity, accessibility, performance and service design using aggregated or appropriately de-identified information where practical;
• protect patients, practitioners, FHI and others from fraud, misuse, cybersecurity threats or unlawful activity; and
• comply with legal, professional, regulatory, contractual and risk-management obligations.

Where consent is the appropriate legal basis, FHI will seek meaningful consent for the relevant collection, use or disclosure. In limited circumstances, applicable law may permit or require processing without consent.

5. Cookies, security logs and analytics

The website uses technologies necessary to deliver pages, remember basic settings, manage traffic and help protect against malicious or automated activity. Cloudflare provides hosting, content-delivery, domain and security functions and may process technical information such as Internet Protocol addresses, device information and security events.

FHI may use limited analytics to understand aggregate website traffic and performance. FHI does not currently use personal health information for advertising, sell personal information or use third-party advertising pixels for cross-site behavioral advertising on the public website. If optional analytics or advertising technologies are introduced, FHI will update its notices and provide consent choices where required before those technologies are activated.

You can adjust browser settings to block or delete cookies. Blocking essential technologies may affect website availability or function. Browser “do not track” signals are not interpreted uniformly; FHI responds to legally recognized opt-out signals where applicable.

6. How we disclose personal information

FHI limits disclosure to what is reasonably necessary for the purpose. Personal information may be disclosed to:

• service providers that support website hosting and security, scheduling, practice management, secure communications, payment processing, records management, information technology, accounting, legal services or other operational functions;
• treating or referring practitioners, laboratories, imaging providers or other care participants when you direct or consent to the disclosure, or where law otherwise authorizes it;
• regulators, professional advisers, insurers, law-enforcement authorities, courts or other bodies where disclosure is required or authorized by law; and
• a successor organization in connection with a proposed or completed financing, reorganization, sale, merger or transfer of all or part of the business, subject to appropriate confidentiality and legal safeguards.

Service providers are permitted to use information only for the services they provide to FHI or as otherwise allowed by law. FHI does not disclose personal health information to data brokers or use it for targeted advertising.

7. Jane and other third-party services

Links to Jane and other external services take you to systems that are not the FHI public website. Those providers may collect information directly from you and process it under their own privacy notices, contractual commitments to FHI and applicable law. Review the privacy information presented by the provider. If a link is used to send clinical information to FHI, follow the specific instructions shown in the secure workflow.

8. Processing outside your province or country

Some service providers may store or process information outside Ontario or Canada. Information processed in another jurisdiction may be subject to that jurisdiction’s laws and may be accessible to its courts, law-enforcement or national-security authorities. FHI selects providers and safeguards proportionate to the sensitivity of the information and the service being provided.

9. Retention and disposal

FHI keeps personal information only as long as reasonably necessary for the purposes described in this policy and to meet legal, professional, insurance, tax, accounting, dispute-resolution and record-retention obligations. Retention periods vary by record type and the nature of the relationship. When information is no longer required, FHI securely deletes, destroys or de-identifies it, subject to technical limitations and lawful backup cycles.

10. Safeguards and privacy incidents

FHI uses administrative, technical and physical safeguards appropriate to the sensitivity and volume of the information. Measures may include role-based access, authentication, secure transmission, vendor review, confidentiality obligations, training, backups, monitoring and incident-response procedures. No system can be guaranteed completely secure. If a privacy incident creates a real risk of significant harm or otherwise triggers a legal reporting duty, FHI will notify affected individuals and regulators as required.

11. Your choices and rights

Subject to applicable law and limited exceptions, you may ask FHI to:

• confirm whether FHI holds personal information about you and provide access to it;
• correct information that is inaccurate or incomplete;
• explain how information has been used and, where required, identify disclosures;
• withdraw consent for a future use or disclosure, recognizing that this may limit services FHI can provide;
• stop non-essential electronic communications; or
• address a concern about FHI’s privacy practices.

FHI may verify your identity before completing a request. Access may be limited where permitted by law, including to protect another person’s information, privileged material or a legal restriction. FHI will explain a refusal unless prohibited. Additional rights may apply where you live, including deletion, portability, restriction, objection or appeal. FHI does not discriminate against a person for exercising a legally protected privacy right.

12. Children and substitute decision-makers

The public website is intended for a general adult audience and is not directed to children. Services for a minor or a person who requires a substitute decision-maker are arranged through a parent, guardian or legally authorized representative and are subject to applicable consent and capacity requirements.

13. External links

The website may link to professional organizations, publications, research sources, educational programs and other third-party websites. FHI does not control their privacy, security or content practices. A link does not by itself mean that FHI endorses every statement, service or practice of the linked organization.

14. Changes to this policy

FHI may update this Privacy Policy to reflect changes in the website, services, providers, technology or law. The revised policy will be posted with a new “Last updated” date. If a change materially affects how previously collected information is used, FHI will provide additional notice or seek consent where required.

15. Contact the Privacy Officer

For a privacy question, access or correction request, or complaint, contact the FHI Privacy Officer. Do not include clinical records or urgent health information in an email. FHI will review complaints fairly and explain available escalation options, including the appropriate privacy regulator, where applicable.

Privacy Officer

Feldman Hair Institute

565 Eglinton Avenue West, Toronto, Ontario M5N 1B5 Canada | [email protected]