Who we are, and who is responsible
This is the website of Derma Bar (the clinic), in Toronto, Ontario.
To write to the clinic about your privacy, the address is Derma Bar, 2145 Danforth Ave, Toronto, ON M4C 1K2.
The person to write to about anything on this page is the owner of the clinic through the front desk; the clinic's telephone number and email address are on the contact page.
Steven Lansangan, for asapcontent, answers how it works and passes anything else to the person responsible; asapcontent is the agency that built this website.
What this website keeps about you
Nothing: the site has no database and no person record, and it has no accounts.
It takes in three things: the inquiry form on the contact page, which it passes to the clinic, the newsletter signup at the foot of every page, which it passes to the clinic's email newsletter provider, and the shop's bag when you ask for your total or continue to payment, which it passes to the clinic's own system. It keeps a copy of none of them; the next sections say how.
The clinic's own records about its clients, such as their bookings, payments and inquiries, are kept in the clinic's own system, separately from this website, and this website cannot read them.
The clinic's own privacy notice covers those records, and it is published at https://dermabar-platform.vercel.app/legal/privacy.
The inquiry form
The inquiry form on the contact page asks for your name, email and phone, and whether you would like the clinic's emails.
When you send it, the name, email and phone typed into it travel through a bridge to the clinic's own system, where the front desk sees them as an inquiry, so the clinic can reply to you.
This website keeps no copy of what you type. It records only whether a sending worked, never what was in it.
Before the form sends, Cloudflare Turnstile checks that you are a person and not an automated program. Turnstile is run by Cloudflare, a company outside Canada, so this check is a service outside Canada: while it runs, Cloudflare receives your internet address and information about your browser, and this website sends Cloudflare your internet address again to confirm the check.
To stop hearing from the clinic, or to see, correct or remove your inquiry, write to the owner of the clinic through the front desk; to stop its emails about offers, you can also use the link in any of them.
The newsletter signup
The newsletter signup at the foot of every page asks for your email address and nothing else.
When you sign up, your email address goes to Flodesk, the clinic's email newsletter provider, with the time you signed up and your internet address, as a record of your consent. Flodesk keeps them in the United States, so this is a service outside Canada.
Flodesk first sends you an email asking you to confirm. The clinic sends you its news and offers by email only after you confirm.
This website keeps no copy of your email address. It records only whether a sign up worked, never what was in it.
The same Cloudflare Turnstile check as on the inquiry form runs once you start to use the signup, and this website sends Cloudflare your internet address again to confirm it.
To leave the newsletter, use the unsubscribe link in any of its emails, or write to the owner of the clinic through the front desk.
The shop's bag and checkout
When you add a product to your bag, this website keeps the bag in your own browser's storage on this device: which products, how many, a promo code if you add one, the shop page you came from, and a random number that stops one bag making two orders. It holds no name, address or card.
To show your total, and when you continue to payment, the products, quantities, promo code, whether you pick the order up or have it shipped, and a random number for the order travel through a bridge to the clinic's own system, which prices them from the clinic's Square account and records the order there.
If you choose shipping, the street, the apartment, suite or unit when you give one, and the city and postal code you type in the bag go to the clinic's own system and to Easyship, a shipping service outside Canada, to find the shipping options and their prices, and they are kept nowhere on this website. When you continue to payment, the clinic's own system also passes them to Square to fill in its page, and any delivery notes you typed, such as a buzzer code or where to leave the parcel, go to the clinic's own system, which keeps them on your order. Once you have paid, the clinic's own system sends Easyship your name, phone number, email address and shipping address, your delivery notes, and the products in your order, to make the shipping label for the courier you chose.
You pay on Square's own secure page, which has its own terms: Square asks for your card and, for shipping, your address, and the website never sees a card number.
The same Cloudflare Turnstile check as on the inquiry form runs on the bag page before you continue to payment, and this website sends Cloudflare your internet address again to confirm it.
This website keeps no copy of your order. It records only whether a step worked, never what was in it. The thank you page after payment empties the bag on your device, and removing its products empties it too.
Cookies and tracking
This website sets no cookies of its own. It keeps a daily count of a few things done on its shop pages, such as how many times a page opened or a gift card link was pressed, in the clinic's own system, holding no address, no identifier and nothing about who did it. There is no outside analytics, no pixel and no tag manager on any page, and the pages use fonts already on your device, so your browser downloads no font from this website or any other company.
The shop's bag is kept in your browser's own storage on this device, not in a cookie, and this website reads it only on this device; the shop section below says what it holds.
The one piece of another company's content on the site is Cloudflare's Turnstile check: on the contact page beside the inquiry form, under the newsletter signup once you start to use it, and on the bag page before you continue to payment. It runs in its own frame and may use its own cookies there, under Cloudflare's terms.
If the clinic's owner ever chooses outside analytics, a banner and this sentence change together.
Booking, gift cards and links to other sites
The Book button opens the clinic's booking system (Acuity today), which has its own terms; the website sees nothing of a booking.
Buying a gift card opens Square's own page, which has its own terms; the website never sees a card number.
A link to another site, such as the clinic's pages on Facebook and Instagram, the financing provider or the college, takes you to that site, under its terms. Nothing is sent to it until you follow the link, and then it is told only that you came from this website, not which page.
Where it lives
This website is hosted by Vercel. Its functions, including the one that sends the inquiry form to the clinic, run in Montreal.
One small function, which answers the old addresses of the clinic's previous website that no longer exist, runs wherever is nearest to the visitor, and it reads nothing but the address asked for.
The pages themselves are served from Vercel's network, and the website is built on Vercel's machines in Washington, in the United States.
The clinic's photographs on these pages are kept in the website's own storage at Vercel, the same company that hosts the site, and your browser fetches them from there. Like the pages, those requests reach Vercel with your internet address, and they tell it only that they came from this website, not which page.
Your rights, and how to use them
Because this website keeps nothing about you, there is nothing on it to see, correct or remove.
To see, correct or remove what the clinic holds about you, write to the owner of the clinic through the front desk.
To complain: write to the owner of the clinic through the front desk first. Then to the Office of the Privacy Commissioner of Canada, which oversees the private sector rules, or, for anything about health information held by the clinic, to the Information and Privacy Commissioner of Ontario.
Changes
This page changes when the website changes; the date below says when.
Last changed: