Privacy policy

Who is responsible

Mounir, owner of Shay Esthétique, is the person responsible for the protection of personal information. To exercise your rights or ask a question: info@shayesthetiques.ca or 438 796-3111.

What we collect, and why

Your name, phone number and email — to book, confirm and remind you of your appointments, and to send you your receipt.

Your treatment notes and contraindications — so the person treating you knows what is safe for you. They are used by the clinic's team; some also go to the services listed below (“Who we share part of it with”).

The health questions on our booking pages — skin phototype, pregnancy or breastfeeding, photosensitising medication, medical conditions, allergies. They are answered by you, none of them is required, and they are used for one thing only: knowing whether the treatment is safe for you. They live on that appointment, never in a text message or an email, and only the people who can open your full file can read them.

Your consent forms — what you signed, when, and from where.

If you save a card, it is stored by Stripe; we only keep a reference to it. We never see the number.

Calls made through the clinic

When a practitioner calls you through the clinic's line, neither of you sees the other's personal number: the call is placed by Telnyx, our telephony provider, and the two of you are connected through our number.

If the call is recorded, you are told so at the beginning of the call, before anyone is connected. If we cannot tell you, we do not record.

A recording may be turned into text automatically, by an artificial-intelligence model hosted by Telnyx (Whisper). Only the clinic's accounts with the “owner” role can listen to it or read it.

Recordings and their transcripts are deleted after 90 days, automatically — and immediately if you ask for your file to be erased.

Who can see your file

The clinic's team, each within their role — and, for the part described below, the services we share it with. When a team member opens your file or the sheet of your appointment, the app records who opened it and when.

No data is sold.

Who we share part of it with

• Supabase — our database, hosted in Montréal : your file.
• Hostinger — the rented servers that run the app and keep our backups, in the United States : everything the app shows or records goes through them; they keep backups of our database (your file included), and working copies: your profile, appointments and treatment notes as Fresha gives them to us, and the text messages you send us.
• Fresha — the clinic's booking software : your profile (name, phone, email), your appointments, your purchases and the treatment notes written in Fresha.
• Stripe — card payments : your card (we never see its number), your name, email, phone and each payment.
• Telnyx — our text messages and calls : your number, the text messages between us, and the recording of a call if it is recorded (transcribed by an artificial-intelligence model hosted by Telnyx).
• Google — our mailbox (Gmail) and our spreadsheets : a copy of the emails we send you and of the text messages you send us; some sales (your name, the treatment, the amount) and some text messages, copied into the clinic's Google spreadsheets.
• Meta (Facebook, Instagram) — measuring our ads, and Messenger : on our booking and offer pages, a Meta tool (the pixel, with a cookie) records the pages viewed and the steps taken, with your IP address and browser — never on your card page, and without the day or time of your appointment; your email and phone, scrambled, only if you ticked the offers box; and your messages, if you write to us on Messenger or Instagram.
• Telegram — the team's alerts : when you book an appointment (online, in Fresha or by phone), and when that appointment no longer takes place: your name and, depending on the case, your number, your email and the appointment note; and the answers of Nova's assistant to its team (see Nova).
• Aircall — the phone system of the team that answers our calls : your name and number, copied into its contact list.
• Nova (close, NextLine) — the team that answers our calls and text messages, and its follow-up tools : the text messages you send to the clinic; to book for you, your name, number and appointments with their notes; and its assistant (Gaïa, inside close) reads your file — your email, the note on your file, your purchases, credits and packages, the notes of your appointments and sessions — and passes them to OpenAI (ChatGPT) and Telegram to answer Nova's team.
• OpenAI (Gaïa) — the clinic's assistant, when it is on : on the website, only what a visitor types — no name, no file — and that conversation is erased after 30 days; inside the team's app, the appointments, names and files of clients that Gaïa needs to answer a team member, sent through the clinic's ChatGPT account, only to produce the answer; and what Nova's assistant reads from your file (see Nova).

Outside Quebec: Hostinger, Fresha, Stripe, Telnyx, Google, Meta (Facebook, Instagram), Telegram, Aircall, Nova (close, NextLine) and OpenAI (Gaïa). Our database itself is in Montréal.

How long we keep it

5 years after your last visit. After that, your file is anonymized automatically in the app: your name, phone, email, notes, messages, health answers and card reference are removed, the recording of any call is deleted at our telephony provider; the clinic's sales records remain, without your name.

Call recordings and their transcripts are the exception: 90 days, whatever the rest of your file does.

Your rights

You can ask to see your file, correct it, or have it erased. Erasure is done from the clinic: in the app, your identifying details are removed for good, while the accounting records stay anonymous. As long as an appointment is still booked, the file cannot be erased.

What we passed on to Hostinger, Fresha, Google, Meta (Facebook, Instagram), Telegram, Aircall, Nova (close, NextLine) and OpenAI (Gaïa) is not erased automatically: we remove it by hand, wherever that is possible. Stripe : your saved card is deleted at Stripe; the record of payments stays there, as accounting requires. Telnyx : recordings are deleted there; the record of text messages stays at Telnyx.

You can stop text messages at any time by replying STOP.

If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec.