How we handle your information
Treasury Aesthetics is a health information custodian under Ontario's Personal Health Information Protection Act (PHIPA). This notice explains what personal and personal health information our website, AI consultation assistant, and personalized plan pages collect, how it is protected, and the choices you have.
What we collect
- AI consultation chat: what you type — which may include your skin concerns and goals — plus your name, email, and age range if you choose a personalized plan.
- Personalized plan pages: your name, date of birth (used only to unlock your plan the first time), a passphrase you may set to replace it (stored only as a cryptographic hash), your treatment plan, and preferences you save — including a custom web address if you choose one.
- Sign-ups and bookings: name and contact details you submit, and appointment details in our clinic management system.
How it is used
To answer your questions, prepare and deliver your personalized treatment plan, book appointments, follow up on consultations, and — where you have agreed — send you clinic updates. AI features are reviewed by our clinical team; treatment plans are prepared and signed off under physician oversight.
How it is protected
- Treatment plans are encrypted at rest (AES-256) and unlock only with information personal to you — your date of birth at first, or a passphrase you set yourself.
- Plan web addresses are random by default so the link itself reveals nothing about you; you may choose a personalized address, with a clear notice of what that shares, and switch back at any time.
- Access by clinic staff is authenticated, time-limited, and logged.
- Conversations and plans are transmitted over encrypted connections (HTTPS).
Where it is processed
We use carefully selected service providers to run these tools — including cloud hosting and encrypted storage (Vercel), AI processing (Anthropic), and email delivery (Resend). These providers process data on servers located outside Canada, primarily in the United States, under agreements that require them to protect it. Our clinic management system (Phorest) holds your appointment and consultation records.
How long we keep it
Consultation chat logs are kept for a limited period for quality and follow-up, then deleted on a schedule. Clinical records — including treatment plans that form part of your care — are retained as required for medical records in Ontario.
Your choices and rights
- You can use the AI assistant without providing your name or contact details — they are only needed if you want a personalized plan.
- You may ask to see, correct, or (where the law allows) delete the information we hold about you.
- You can ask us to stop emailing you at any time.
Questions or requests
Contact our privacy contact at hello@treasuryaesthetics.ca. You also have the right to complain to the Information and Privacy Commissioner of Ontario (ipc.on.ca).