Our commitment. Vitafiq connects people with verified wellness, fitness, and personal care professionals. Trust is the foundation of that relationship. This Privacy Policy sets out, in plain and binding terms, what personal information we collect, why we collect it, who we share it with, how we protect it, and the rights you can exercise. We collect only what we need, use it only for the purposes we state, protect it with safeguards proportionate to its sensitivity, and never sell it.
Who this policy protects. It applies to everyone who interacts with Vitafiq: Customers who search, book, and receive services; Professionals, studios, and clinics who list and deliver services; visitors to our website; and anyone who contacts us.
1. Scope, definitions, and roles
This policy governs personal information collected through vitafiq.com, the marketplace, booking and messaging tools, virtual service features, and all related support channels (together, the “Platform”).
Definitions
- “Vitafiq”, “we”, “us”, and “our” mean Vitafiq Solutions, a Canadian company operating as Vitafiq and the accountable organization under this policy.
- “Customer” means an individual who browses, searches, books, purchases, or receives a service through the Platform.
- “Professional” means an independent wellness, fitness, or personal care practitioner, clinic, studio, or business listed on the Platform, together with its authorized staff.
- “Personal information” means information about an identifiable individual, in any form, as defined by applicable Canadian privacy law.
- “Sensitive information” includes health, biometric, financial, and any other information whose loss or misuse could cause significant harm or embarrassment, and which requires a higher standard of care and express consent.
Vitafiq’s role versus a Professional’s role
Vitafiq is accountable for personal information under its custody or control, including your account, login credentials, booking history, messages, and payment records. A Professional is independently responsible for clinical, treatment, assessment, and client records it creates or maintains to deliver a service, and for complying with its own professional, licensing, and health information obligations.
Where Vitafiq stores or processes such records on a Professional’s behalf, Vitafiq acts as a service provider under a written agreement and processes that information only on the Professional’s documented instructions. Vitafiq does not make, and is not responsible for, any clinical, therapeutic, fitness, or personal care decision.
2. Personal information we collect
We collect personal information in three ways: directly from you, automatically when you use the Platform, and from limited outside sources. We do not collect more than is reasonably necessary for the purposes identified in Section 3.
2.1 Information you provide
| Category | Examples | Who it concerns |
|---|---|---|
| Account and identity | Name, email, phone number, date of birth or age range, preferred language, password (stored only as a salted hash), profile photograph, and social sign-in identifiers | Customers and Professionals |
| Booking and transaction | Services selected, appointment date, time, and location, packages, memberships, waitlists, attendance, cancellations, missed appointments, invoices, refunds, payment status | Customers and Professionals |
| Professional and business | Biography, services and rates, availability, business address, credentials, licences, certifications, insurance, portfolio, government identifiers required for verification or tax reporting, payout details, staff profiles | Professionals |
| Communications and content | Messages sent through the Platform, support requests, surveys, reviews, ratings, feedback, consent records, uploaded files and images | Customers and Professionals |
| Preferences and accessibility | Service interests, notification settings, accommodation requests, information you volunteer to support a requested service | Customers |
| Emergency contact and others | Name and phone number of an emergency contact, or details of a dependant you book for. By providing information about another person, you confirm you are authorized to do so | Customers |
2.2 Sensitive and health information
A booking or service request may reveal sensitive information, such as wellness goals, injuries, physical limitations, dietary needs, pregnancy, skin or hair conditions, or the nature of a service sought. We treat all such information as sensitive regardless of how it is submitted, and we apply the following rules:
- We collect it only with your express consent and only where it is necessary to deliver a service you have requested or to keep you safe.
- You should share only what is reasonably necessary, and you should share clinical detail directly with your Professional through the secure intake or consultation tools provided, not in public reviews, general messages, or support tickets.
- Professionals must record clinical notes, treatment records, and assessments only in approved, access-controlled workflows and only when authorized to do so.
- We never use sensitive information for advertising, profiling, or model training, and we never sell or rent it.
2.3 Information collected automatically
- Device and technical data: IP address, browser type, operating system, device identifiers, app version, language settings, crash reports, and approximate location derived from IP address.
- Usage data: Pages viewed, searches, clicks, booking flow progress, session times, referring links, error logs, and feature interactions.
- Device permissions: The app may ask for access to your precise location (to show nearby Professionals), camera and photo library (to upload a profile photo or portfolio image), microphone and camera (for virtual sessions), calendar (to add bookings), and contacts (to invite people you choose). Each permission is optional, is requested only when you use the related feature, and can be revoked at any time in your device settings.
- Support interactions: Calls and chats with our support team may be recorded or monitored for quality, training, and dispute resolution. You will be told at the start of the interaction.
- Cookies and similar technologies: Described in Section 5.
2.4 Information from other sources
We may receive information from Professionals and studios (for example, appointment confirmations), payment processors (transaction status and fraud signals), identity and credential verification services, referral partners, social sign-in providers, and publicly available professional registries. We use this information only for the purpose for which it was provided or as otherwise permitted by law.
2.5 Information we infer
We may draw limited inferences from the information above, such as your approximate region from your IP address or the service categories in which you are most likely interested based on your booking history. We use inferences only to improve relevance within the Platform and never to infer health status or any characteristic protected under human rights law.
3. Why we use personal information
We use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and only for the purposes listed below. If we need to use your information for a new purpose, we will tell you first and obtain your consent where the law requires it.
| Purpose | What we do | Basis |
|---|---|---|
| Provide the Platform | Create, authenticate, secure, and administer accounts; display Professional profiles; power search and discovery | Contract; implied consent |
| Bookings and services | Process bookings, waitlists, packages, memberships, attendance, cancellations, refunds, reminders, and virtual service connections | Contract |
| Payments and payouts | Facilitate payments through our payment processor, issue payouts to Professionals, maintain financial records | Contract; legal obligation |
| Verification and trust | Verify Professional identity, credentials, licences, insurance, and business details; display verification status | Legitimate business need; consent |
| Communication and support | Enable messaging, notifications, customer support, reviews, and dispute resolution | Contract; implied consent |
| Safety, security, and compliance | Detect and prevent fraud, abuse, and security threats; investigate incidents; enforce our terms; meet legal, tax, and regulatory obligations | Legitimate business need; legal obligation |
| Improvement and research | Measure performance, fix errors, improve accessibility, test and develop features using anonymized data wherever possible | Legitimate business need |
| Marketing | Send promotional messages about Vitafiq services and offers only with the consent required by law; you can opt out at any time | Express or implied consent (CASL) |
| Analytics and insights | Create aggregated or anonymized statistics that cannot reasonably identify you | Legitimate business need |
What we do not do
We do not sell or rent personal information. We do not use personal information for automated decisions that produce legal or similarly significant effects without human review. We do not use health or other sensitive information for advertising. We do not share your data with data brokers. We do not attempt to re-identify information we have anonymized, and we require the same of anyone we share it with.
4. Consent and your choices
We obtain meaningful consent before collecting, using, or disclosing personal information, and we explain the nature, purpose, and consequences in clear language when it matters: at registration, at booking, when you share sensitive details, when you enable a device permission, and when you opt in to marketing. The form of consent reflects the sensitivity of the information. We require express consent for sensitive information, precise location, marketing, and AI-related uses, and rely on implied consent for the essential functions you would reasonably expect.
You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawal does not affect processing that already occurred lawfully. Because some information is essential, withdrawing it may mean we can no longer provide certain services. For example, we cannot complete a booking without your name, contact details, and payment authorization. We will explain the consequences of withdrawal at the time you ask.
Where the law permits or requires it, we may collect, use, or disclose personal information without consent, for example to investigate a breach of an agreement or contravention of law, to respond to a lawful demand, to collect a debt, or to address an emergency that threatens life, health, or security.
Marketing and notifications
Every promotional email includes an unsubscribe link, and you can manage marketing, push notification, and SMS preferences in your account settings. We honour opt-outs within 10 business days, as required by Canada’s Anti-Spam Legislation (CASL). Your SMS consent and phone number are never shared with third parties for their own marketing. We will continue to send transactional and service messages, such as booking confirmations, reminders, receipts, security alerts, legal notices, and material service changes, because they are necessary to operate your account.
5. Cookies and similar technologies
We use cookies, local storage, software development kits, and similar technologies for four purposes. You control all optional technologies through our cookie preference centre, which is presented on first visit and always available in the site footer, and through your browser and device settings.
| Type | Purpose | Your control |
|---|---|---|
| Strictly necessary | Login, session integrity, security, load balancing, fraud prevention, cookie preference memory | Always active; required for the Platform to function |
| Functional | Language, region, saved searches, accessibility settings | Opt out in the preference centre |
| Analytics | Aggregate measurement of pages, features, errors, and performance | Off by default where the law requires; opt out anywhere |
| Marketing | Measuring campaign effectiveness and, where enabled, showing relevant Vitafiq offers on other platforms | Off until you opt in |
We do not use session replay tools that capture keystrokes. Blocking necessary cookies may cause parts of the Platform to stop working. We respond to Global Privacy Control signals where the law recognizes them.
6. When we disclose personal information
We disclose personal information only to the recipients below, only to the extent necessary, and always under obligations of confidentiality and lawful use.
- Professionals and their authorized staff: when needed to respond to your inquiry, manage your booking, deliver the service you requested, communicate with you, or resolve a complaint. A Professional receives your name, contact details, booking information, and any intake information you chose to provide for that service, and nothing more. A Professional never receives your password or payment card details.
- Customers: when needed to display a Professional’s public profile, availability, credentials, verification status, reviews, and booking communications.
- Service providers: that support hosting, security, communications, analytics, customer support, identity and credential verification, payments, accounting, video and virtual services, and AI features. Each provider is bound by contract to use personal information solely to deliver services to Vitafiq, to apply safeguards at least as protective as ours, to notify us of incidents, and to delete or return data when the engagement ends. We publish a current list of our service providers and their locations on the Platform and update it before adding a new provider that handles personal information.
- Professional advisers, auditors, and insurers: under confidentiality obligations.
- Regulators, law enforcement, courts, and government authorities: where required by law, subpoena, court order, or other lawful demand, or where necessary to protect the rights, safety, or property of Vitafiq, our users, or the public. We review every demand for validity and scope, disclose only what is legally required, and notify affected individuals where the law permits.
- A successor or acquirer: in connection with a proposed or completed financing, merger, acquisition, reorganization, or sale of assets, subject to confidentiality during due diligence and to the acquirer continuing to honour this policy or providing notice and the opportunity to delete your data. Health and other sensitive information are never disclosed during due diligence.
- Anyone you direct us to, or with your consent.
7. Payments
Payments on the Platform are processed by a PCI DSS-compliant third-party payment processor. When you pay, your full payment card or bank details are transmitted directly to and stored by that processor under its own privacy terms. Vitafiq never stores full card numbers, CVV codes, or bank credentials on its systems.
Vitafiq receives only the transaction status, the last four digits and card type, a tokenized reference, and the identifiers required to administer bookings, refunds, payouts, disputes, and tax records. The processor may independently collect identity verification and fraud prevention information from Professionals to satisfy its customer identification and anti-money-laundering obligations. The name of our current payment processor is published on the Platform’s payments page.
8. Where your information is stored and processed
Vitafiq is headquartered in Saskatchewan, Canada, and stores personal information primarily on servers located in Canada. Some service providers, such as those that deliver email and SMS notifications, video sessions, and AI features, process limited information in the United States or other jurisdictions. Information processed outside your province or country is subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, or national security authorities there.
Vitafiq remains accountable for personal information it transfers. Before any transfer we assess the sensitivity of the information, the purpose, the destination’s legal protections, and the provider’s safeguards, and we use written contracts, encryption, access restrictions, and audit rights appropriate to the sensitivity involved. Our published service provider list identifies where each provider stores data.
9. Retention and deletion
We retain personal information only as long as necessary to fulfil the purposes in this policy, to satisfy legal, tax, and regulatory obligations, to resolve disputes, and to enforce our agreements.
When information is no longer required, we delete or irreversibly anonymize it using industry-standard methods. Closing your Vitafiq account does not delete records a Professional controls under its own retention obligations, and it does not delete information Vitafiq must keep by law. We will tell you what we are keeping and why.
10. Security safeguards
We protect personal information with administrative, technical, and physical safeguards proportionate to its sensitivity and the risk of harm from its misuse. All data is encrypted in transit and at rest, and health and other sensitive information is held in separately secured storage.
No system is perfectly secure. You are responsible for keeping your password confidential, enabling multifactor authentication where offered, and reporting suspected unauthorized access to us immediately.
11. Privacy breaches and incidents
If personal information is lost, stolen, or accessed, used, or disclosed without authorization, we will contain the incident, investigate its cause and scope, assess the risk of harm to affected individuals, and remediate it.
Where the incident creates a real risk of significant harm, or where any other legal threshold is met, we will notify affected individuals as soon as feasible, report it to the Office of the Privacy Commissioner of Canada and any applicable provincial regulator, and notify other organizations that can reduce the harm. Notifications will describe what happened, what information was involved, what we have done, and the practical steps you can take. We maintain a record of every breach as required by law.
12. Your privacy rights
Subject to the exceptions in applicable law, you have the following rights with respect to personal information Vitafiq holds about you:
To exercise a right, contact the Privacy Officer or use the privacy controls in your account. We will verify your identity before acting, and an authorized representative may act for you if they provide proof of authority. We will not charge a fee except where the law permits a reasonable one for access requests, and we will respond within 30 days or such shorter period as applicable law requires.
If we refuse a request in whole or in part, we will explain why in writing and tell you how to challenge the decision. You will never be treated differently or denied service for exercising a privacy right. If the information you seek is controlled by a Professional, we will direct you to that Professional and assist where we can.
13. Children and youth
The Platform is designed for adults. You must be at least 18 years old, or the age of majority in your province, to create an account. A parent or legal guardian may book services for a minor through the guardian’s own account, in which case the guardian provides consent on the minor’s behalf, remains responsible for the minor’s use of the service, and should share only the information the Professional needs.
We do not knowingly collect personal information directly from anyone under 18, do not use a minor’s information for behavioural advertising or profiling, and will delete any such information promptly on becoming aware of it. If you believe a minor has provided personal information to us without guardian consent, contact the Privacy Officer.
14. Obligations of Professionals
Every Professional on the Platform agrees, as a condition of listing, to protect the personal information of Customers to a standard no lower than this policy. Specifically, a Professional must:
- comply with the Professional Agreement, its professional and licensing duties, and all applicable privacy and health information laws, including provincial health information statutes where they apply;
- use Customer information solely to deliver the booked service, communicate about it, and maintain required records, and never for unrelated marketing, resale, or sharing without the Customer’s valid consent;
- restrict staff access to those with a need to know, secure devices and accounts, and enable multifactor authentication;
- keep clinical notes, treatment records, and assessments in approved workflows only, and keep unnecessary sensitive detail out of profile, messaging, review, and support fields;
- respond to Customer requests for access to or correction of records the Professional controls;
- notify Vitafiq within 24 hours of discovering any suspected privacy or security incident involving Platform data;
- delete or return Customer information obtained through the Platform when the relationship ends, except records required by law.
A breach of these obligations may result in suspension or removal from the Platform and other remedies under the Professional Agreement.
15. Reviews, profiles, and public content
Professional profiles, portfolios, credentials, verification badges, and reviews designated as public are visible to anyone and may be indexed by search engines. Do not include personal health, financial, contact, or third-party information in public content.
Reviews are attributed to the reviewer’s display name, and Customers may choose an abbreviated display name. Vitafiq may moderate, edit for compliance, or remove content that violates our Terms of Use or community standards, but you remain responsible for information you choose to publish. Professionals may respond to reviews but may not disclose a customer’s private information in doing so.
16. Contact and complaints
Questions, requests, or complaints about this policy or our handling of personal information should be directed to:
We acknowledge every privacy complaint within 5 business days, investigate it, and respond in writing.