Privacy Policy

1. Introduction

TouchBase Wellness Inc. ("TouchBase", "we", "us", or "our") operates a mobile and web platform that connects guests with licensed wellness practitioners, practices, and wellness experiences across Ontario. We are committed to protecting your privacy and the security of your personal information, including any health information you choose to share with your chosen provider.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). Please read this policy carefully.

2. Information We Collect

Information you provide directly:

• Account information: name, email address, phone number, and role (guest, practitioner, practice owner, host).
• Profile information: professional credentials, licence numbers, regulatory college information, service areas, and business details.
• Identity verification: government-issued photo ID and selfie verification, stored securely and accessibly only to authorized administrators for verification purposes.
• Booking information: appointment preferences, service addresses, and intake notes shared with your chosen provider.
• Payment information: processed securely through Stripe; we do not store full card numbers on our servers.
• Documents: insurance certificates, professional credentials, and property photos as applicable to your role.

Information collected automatically:

• Device identifiers, approximate location (with permission), and usage analytics.
• IP address, browser type, and app interaction data.
• Calendar sync data when you explicitly authorize a calendar connection.

3. How We Use Your Information

• To create and manage your account and authenticate your identity.
• To process bookings, payments, and provider assignments.
• To verify practitioner credentials and conduct Trust Verification checks.
• To communicate with you about bookings, assignments, and platform updates.
• To match guests with nearby or preferred practitioners based on service area.
• To maintain records required for healthcare compliance where applicable.
• To prevent fraud, enforce our Terms of Service, and protect platform safety.
• To comply with legal obligations under the Personal Health Information Protection Act (PHIPA) and other applicable laws.

4. Health Information

If you are a guest receiving healthcare services, any health information you share (such as intake notes or treatment preferences) is collected and stored for the purpose of providing care. This information is accessible to your treating practitioner and their practice for clinical purposes. TouchBase acts as a platform facilitator and does not provide medical advice.

Practices using our Records & Compliance add-on store clinical records in accordance with PHIPA. Access to health records is restricted, logged, and available only to authorized providers and administrators within the practice.

5. Information Sharing and Disclosure

We share your information only as necessary to operate the platform:

• With providers: booking details and service address necessary to fulfil your appointment.
• With practices: practitioner profiles, assignment data, and clinical records as applicable.
• With payment processors: Stripe processes all payments and handles payout disbursement.
• With regulatory authorities: if required by law, court order, or to report a safety concern.
• With hosting providers: cloud infrastructure providers that support our platform operations.

We never sell your personal information to third parties.

6. Data Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, role-based access controls, and regular security reviews. Identity verification documents are stored privately and are never publicly accessible. Access to sensitive data is logged and audited.

7. Data Retention

We retain your information for as long as your account is active and as necessary to provide our services. Healthcare records are retained in accordance with PHIPA retention requirements. Financial records are retained for the period required by applicable tax and accounting laws. You may request deletion of your account at any time, subject to legal retention obligations.

8. Your Rights

• Access and review the personal information we hold about you.
• Correct inaccurate or outdated information.
• Request deletion of your account and associated data.
• Withdraw consent for optional data processing, such as calendar sync or location access.
• Manage notification preferences within the app.
• File a complaint with the Information and Privacy Commissioner of Ontario.

9. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or via email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us through the Help Centre within the app or email us at privacy@touchbasewellness.ca.