Your information, protected.

1. Who this policy is from

This policy is provided by LaserPeak Spa, an independent laser and skin studio led by Anna Nikolaenko in Calgary, Alberta, Canada. References to “we”, “us”, and “our” mean the business operating as LaserPeak Spa. References to “you” mean the person whose information we are describing.

Our handling of personal information is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for activities inside Alberta, the provincial Personal Information Protection Act (PIPA Alberta).

2. What information we collect

a) On this website.

This site is a static information site. It does not contain contact forms, account sign-up, e-commerce checkout, or newsletter sign-up. The only personal information we receive from the website itself is what our hosting provider (Vercel Inc.) logs automatically for security and reliability: approximate IP address, user agent, referrer, and pages requested. We do not place first-party cookies or run third-party analytics that track individuals.

b) When you contact us directly.

If you call, text, or email us, we receive whatever you choose to share — typically your name, phone number, email address, and the reason for your message. We use that information only to respond and, if you become a client, to schedule and deliver care.

c) When you book online.

Online bookings are handled by Jane App, operated by Jane Software Inc. (a Canadian company). When you click any “Book” button you are taken to laserpeakspa.janeapp.com. Jane collects and stores the information you enter (name, contact details, treatment selection, intake answers, and payment information if pre-authorised). Jane’s practices are governed by its own privacy policy. We act as Jane’s customer and access your booking information through Jane to deliver your appointment.

d) When you visit the clinic.

During consultation and treatment we collect the information we need to provide safe care: full name, date of birth, contact details, a health history relevant to laser, cryotherapy, and chemical-peel safety (medications, conditions, allergies, pregnancy status, recent sun exposure, recent treatments), photographs of treated areas where applicable, treatment notes, and payment records.

e) Photographs.

Before-and-after photographs are taken only with your written consent. Marketing use of your photographs (website, social media) requires a separate, specific written consent, which you can withdraw at any time.

3. Why we collect it

• To schedule appointments and provide your treatments.
• To screen for medical contraindications and operate equipment safely.
• To track your treatment plan and compare progress over time.
• To send you appointment reminders and post-care follow-ups.
• To accept and reconcile payment.
• To comply with health, tax, consumer-protection, and other legal obligations.
• To answer your questions and respond to complaints or feedback.

We do not use your information to make automated decisions about you, to profile you, or to train artificial-intelligence models.

4. Your consent

Under PIPEDA and PIPA Alberta we collect, use, and disclose your personal information only with your consent, except where the law allows or requires us to do so without consent (for example, to respond to a court order).

Consent can be express (you sign a written form — for example, the treatment-consent form on intake) or implied (you voluntarily provide your phone number so we can call you back). You can withdraw consent at any time by writing to laserpeakspa@gmail.com, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide certain services.

5. Service providers we rely on

We use the following third-party service providers. Each is bound by its own privacy practices and is permitted to use your information only to provide its service to us.

• Jane App(Jane Software Inc., Canada) — online booking, scheduling, intake forms, and stored client records. Data is stored in Canada. Jane’s privacy policy.
• Vercel Inc. (United States) — hosts this website and keeps server logs (IP, request data, error reports) for operational security. Vercel’s privacy policy.
• Google LLC (United States) — the embedded map on our Contact page is provided by Google Maps. When the map loads, Google receives your IP address and may set its own cookies. Google’s privacy policy.
• In-clinic payment processor — we use a payment terminal at the clinic to accept card payments. The processor receives card data directly; we do not store full card numbers.

6. Cookies and similar technologies

This website itself does not set first-party cookies, run advertising scripts, or use cross-site tracking pixels. The embedded Google Map on the Contact page is the only third-party element on the site, and it loads only when you visit that page. If you do not interact with the map your browser will not store Google Maps cookies. You can also block third-party cookies in your browser settings.

7. Where your information is stored (cross-border)

Jane App stores client records on servers located in Canada. Vercel and Google are United States companies and may process technical data (IP addresses, server logs, map requests) on infrastructure located in the United States or other jurisdictions. When information is stored or processed outside of Canada it is subject to the laws of that jurisdiction, which may include lawful access by foreign government authorities.

8. How long we keep it

• Treatment and consent records: retained for at least ten (10) years from your last appointment, in line with health-record retention expectations in Alberta. Records of clients who were minors at the time of treatment are retained until at least their twenty-fifth (25th) birthday.
• Booking and contact information held in Jane App: retained for as long as you remain an active client and thereafter per Jane App’s policy and our request.
• Photographs taken for treatment: retained for the duration of your treatment plan and deleted on request thereafter.
• Photographs used in marketing (with consent): retained until you withdraw consent, after which we will remove them from materials we control within a reasonable time.
• Server logs (Vercel): retained briefly for security and reliability, then deleted according to Vercel’s standard retention.

After the retention period we destroy or anonymise records so that they no longer identify you.

9. How we protect it

• Electronic records are held in services that encrypt data in transit (HTTPS / TLS) and at rest.
• Access to client records in Jane App is restricted to Anna through a password-protected account.
• Paper records, where they exist, are kept in a locked cabinet on the clinic premises.
• We will notify you and the Office of the Information and Privacy Commissioner of Alberta as required by law in the event of a privacy breach that creates a real risk of significant harm.

No system is perfectly secure. We follow reasonable safeguards appropriate to the sensitivity of the information, but we cannot guarantee absolute security.

10. When we may share information

We do not sell, rent, or trade personal information. We may share information only:

• With service providers (Section 5) strictly so they can perform their function;
• With a regulator, court, or law-enforcement authority when legally required (for example, in response to a subpoena or search warrant);
• With another health professional you authorise us, in writing, to communicate with about your care;
• In the unlikely event of a sale or restructuring of the business, in which case any successor would assume this policy or notify you of any change.

11. Your rights

Under PIPEDA and PIPA Alberta you may:

• Request access to the personal information we hold about you;
• Ask us to correct information that is inaccurate or incomplete;
• Withdraw consent to particular uses (for example, marketing photographs);
• Ask us to delete information we no longer have a legal reason to keep;
• Ask how your information has been used and to whom it has been disclosed.

Send your request to laserpeakspa@gmail.com. We will respond within thirty (30) days. We may need to verify your identity before releasing information. Access to certain records may be restricted where the law allows or requires us to do so.

12. Children

Our services are intended for adults. We do not knowingly collect personal information about children through this website. Treatments for clients under the age of eighteen require the written consent of a parent or legal guardian, who must also be present.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The “Last updated” date at the top of the page reflects when changes took effect. Material changes will be highlighted on the homepage for a reasonable period after they take effect.

14. How to reach us · How to escalate

Anna Nikolaenko is the person responsible for privacy at LaserPeak Spa. Please send privacy questions, access requests, corrections, or complaints to:

If you are not satisfied with our response, you have the right to bring a complaint to:

• The Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca; or
• The Office of the Privacy Commissioner of Canada — priv.gc.ca.

15. A note about this document

This policy is written in plain language to describe how we actually handle information. It is provided for transparency and is not legal advice. If you are looking for advice tailored to your situation, please consult a lawyer qualified in Alberta.