Instagram Facebook-f
Book Appointment

Privacy Policy

Last updated: October 12, 2026

Lumina Aesthetics Spa (“Lumina,” “we,” “us,” or “our”) operates the website located at www.luminaaestheticsspa.ca (the “Site”) and the Lumina Aesthetics & Spa location at 107A Colborne St W, Whitby, ON L1N 1W9 (the “Spa”). This Privacy Policy explains how we collect, use, disclose, and protect personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.

Ontario does not have its own private-sector privacy statute, so PIPEDA governs our collection and use of personal information in the course of commercial activity.

1. Who We Are

  • Legal entity: Lumina Aesthetics Spa
  • Business address: 107A Colborne St W, Whitby, ON L1N 1W9
  • Privacy contact: contact@luminaaestheticsspa.ca
  • Phone: (289) 367-9915

If you have questions about this policy or how we handle your personal information, contact us using the information above.

2. What Personal Information We Collect

We collect personal information you provide directly and information generated through your use of the Site:

  • Booking and appointment information: name, email address, phone number, preferred appointment times, treatment history and preferences, notes you provide about skin concerns or allergies relevant to your treatment.
  • Contact form submissions: name, email, phone number, and the content of your message.
  • Payment information: processed through our payment processor; we do not store full payment card numbers on our servers.
  • Marketing information: email address and communication preferences, if you opt in to receive promotional emails.
  • Website usage information: IP address, browser type, pages visited, and similar analytics data collected automatically through cookies and similar technologies (see our Cookie Policy).

3. Why We Collect Personal Information

We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

Purpose Information used
Booking and delivering spa services Name, contact details, appointment and treatment history
Processing payments Payment details via our payment processor
Responding to inquiries Contact form and email information
Sending promotional communications (with consent) Email address
Improving the Site and our services Aggregated website usage data
Meeting legal and regulatory obligations Records as required by applicable law

4. Consent

We rely on a combination of implied and express consent, depending on the sensitivity of the information and the purpose:

  • Implied consent applies to information you voluntarily provide to book an appointment or contact us — the purpose is obvious from the context.
  • Express (opt-in) consent is required, and obtained, before we add you to marketing email lists or use your information for any purpose beyond fulfilling your service request.

You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us at the details above or using the unsubscribe link in any marketing email. Withdrawing consent for marketing does not affect our ability to service an existing appointment or contractual obligation.

5. Cross-Border Data Transfer

Our website is hosted on servers located in Canada (WP Engine, Montreal data centre). Some of the service providers we use, such as our online booking and email platforms, may process or store personal information outside of Canada, including in the United States, where it becomes subject to the laws of the jurisdiction in which it is held, including potential access by foreign law enforcement or national security authorities (such as the US CLOUD Act).

By using the Site, you acknowledge these potential cross-border transfers. We take contractual and technical measures with our service providers to protect personal information regardless of where it is processed, but we cannot guarantee that a foreign government will not obtain access through valid legal process in that jurisdiction.

6. Disclosure to Third Parties

We do not sell personal information. We may share personal information with:

  • Service providers who perform functions on our behalf (hosting, payment processing, appointment scheduling, email delivery) under contractual obligations to protect your information and use it only for the purposes we specify.
  • Legal compliance: where required by law, regulation, court order, or to protect the rights, property, or safety of Lumina, our clients, or others.

We do not disclose personal information to third parties for their own independent marketing purposes without your express consent.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law (including tax and business record-keeping obligations). Booking and treatment records are retained only as long as necessary to provide our services and to meet legal, regulatory, and business record-keeping requirements, after which they are securely destroyed or anonymized.

8. Security Safeguards

We use reasonable physical, technical, and administrative safeguards appropriate to the sensitivity of the information to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. Your Rights — Access and Correction

Under PIPEDA, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Withdraw consent for uses beyond what’s necessary to fulfill an existing service

To exercise these rights, contact us at the details in Section 1. We will respond within 30 days of receiving your request, as required by PIPEDA. If we cannot meet this timeline, we will notify you of the reason and a revised response date.

10. Cookies and Tracking

The Site uses cookies and similar tracking technologies for essential site functionality, analytics, and (where you’ve consented) marketing purposes. See our Cookie Policy for full details, including how to manage your preferences.

11. Children’s Privacy

The Site and our services are not directed at children under 13. We do not knowingly collect personal information from children without parental or guardian consent, consistent with our teen facial service offerings, which require a parent or guardian’s involvement in booking.

12. Breach Notification

In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (OPC) and affected individuals in accordance with PIPEDA’s breach notification requirements, and will maintain records of all breaches as required by law.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates when the policy was last revised. Material changes will be communicated through a notice on the Site.

14. Contact Us

Questions, concerns, or requests regarding this Privacy Policy or your personal information should be directed to:

Lumina Aesthetics Spa

107A Colborne St W, Whitby, ON L1N 1W9

contact@luminaaestheticsspa.ca

(289) 367-9915

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca

Note on health information (PHIPA): This policy assumes Lumina Ontario operates as a non-medical aesthetics spa. If the Ontario location adds injectables under a physician or nurse practitioner’s medical directive, Ontario’s Personal Health Information Protection Act (PHIPA) will apply and this policy must be revised with counsel before that service launches.

Schedule Now