DBLVGO Inc.

BARLATËS Medical Aesthetics Clinic

Effective date

August 1, 2026

Last updated

August 1, 2026

Applies to

Clinic services, website, online booking, communications and retail transactions

Our commitment: We treat privacy as part of safe, respectful care. We collect only information reasonably needed to serve you, safeguard it according to its sensitivity, and explain your choices in clear language.

This Privacy Policy explains how BARLATËS Medical Aesthetics Clinic (“BARLATËS,” “we,” “us” or “our”) collects, uses, discloses, protects, retains and provides access to personal information and personal health information. It is intended to reflect applicable Canadian and Ontario privacy requirements, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable to the clinic or a regulated provider, Ontario’s Personal Health Information Protection Act, 2004 (“PHIPA”). If a more protective legal or professional requirement applies, that requirement governs.

This policy is general information, not legal advice. The clinic should have it reviewed against its actual corporate structure, service-provider agreements, clinical recordkeeping practices and technology before publication.

1. Scope and accountability

This policy applies when you visit our clinic or website, request information, create or use a booking account, book or receive a consultation or treatment, purchase a product or service, communicate with us, attend an event, complete a form, participate in a promotion or otherwise interact with BARLATËS.

BARLATËS is accountable for personal information under its control. We designate a Privacy Officer to oversee our privacy program, respond to questions and complaints, coordinate access and correction requests, and support compliance by employees, contractors and service providers.

Certain physicians, nurses, nurse practitioners or other regulated health professionals may be independently accountable for personal health information in their custody or control. Where another health information custodian is responsible for a record, we will direct your request to the appropriate person and cooperate as required.

2. Information we collect

Identity and contact information

• Name, pronouns, date of birth or age, mailing address, email address, telephone number, emergency contact and preferred communication method.

Appointment, account and transaction information

• Booking history, appointment status, waitlists, cancellations, package or membership information, products and services purchased, invoices, receipts, gift cards, refunds and communications about your account.

• Payment-related information. Card details are generally collected and processed by our payment processor or booking platform; BARLATËS may receive a token, card type, last four digits and transaction status rather than the full card number.

Clinical and treatment information

• Health history, medications, allergies, pregnancy or breastfeeding status, contraindications, symptoms, prior procedures, treatment goals and other information you provide during screening, consultation or care.

• Assessment findings, treatment plans, consent and refusal records, products or devices used, lot numbers where appropriate, dosage or treatment settings, procedure notes, aftercare instructions, outcomes, adverse reactions, follow-up information and referrals.

• Clinical photographs or videos, including before-and-after images. Images taken for clinical care form part of your record. We seek separate express consent before using identifiable images for marketing, education or social media.

• Insurance or benefits information if you ask us to prepare or support documentation, where applicable.

Website and device information

• IP address, device and browser type, operating system, approximate location derived from IP, referral page, pages viewed, links clicked, session duration, cookie identifiers and similar usage information.

Communications and optional content

• Emails, text messages, calls, voicemails, chat messages, reviews, survey responses, contest entries, feedback and any content you submit to us.

• Marketing preferences and records of consent, opt-out or unsubscribe requests.

3. How we collect information

We collect information directly from you, including through intake and consent forms, consultations, treatment, our website, online booking, email, telephone, text, social media, purchases and in-person interactions. With your consent or as permitted by law, we may also receive information from a referring or treating provider, a family member or substitute decision-maker, payment processor, booking or records platform, or another person you authorize.

We and our technology providers may collect limited technical information automatically through cookies, pixels, local storage and similar tools. Some third parties may collect information directly under their own privacy policies when you use an embedded feature, payment service, map, social-media link or booking portal.

4. Why we use information

• Confirm identity and eligibility; respond to inquiries; schedule, remind, reschedule and manage appointments.

• Assess suitability, contraindications and risks; provide consultations and treatments; document informed consent; monitor progress; arrange follow-up; provide aftercare; and support continuity and safety of care.

• Maintain complete and accurate clinical, business, tax and transaction records.

• Process payments, deposits, refunds and purchases; prevent fraud; collect amounts owing; and administer packages, memberships, promotions and loyalty benefits.

• Communicate service updates, safety notices, recalls, appointment information and other messages related to your care or account.

• With appropriate consent, send news, offers and other commercial electronic messages, and measure their effectiveness.

• Operate, secure, troubleshoot, personalize and improve our website, services, client experience, training, quality assurance and business operations.

• Investigate complaints, incidents, suspected fraud, security threats or violations; establish, exercise or defend legal claims; and comply with law, regulatory duties, professional standards, court orders and lawful requests.

• Create aggregate or de-identified information that does not reasonably identify an individual, and use it for analytics, planning, quality improvement and reporting.

5. Consent and your choices

We obtain consent in a form appropriate to the sensitivity of the information and the reasonable expectations of the individual. Consent may be express or implied where permitted by law. We seek express consent for sensitive or unexpected uses, including identifiable promotional before-and-after images.

You may decline to provide optional information or withdraw consent for future collection, use or disclosure, subject to legal, contractual, clinical and professional restrictions and reasonable notice. Withdrawing consent does not invalidate prior authorized handling. It may limit our ability to safely provide a requested service—for example, if we cannot obtain information needed to assess contraindications or document treatment.

Consent to treatment is separate from consent to collect, use or disclose information and separate again from consent to marketing or promotional photography. You may refuse marketing without affecting your access to clinic services.

6. When we disclose information

We do not sell personal information. We disclose only what is reasonably necessary for an identified purpose, with consent or as permitted or required by law. Recipients may include:

• Regulated health professionals, medical directors, prescribers, consulting or referring providers, pharmacies, laboratories, emergency services or other care providers involved in your care, as authorized or permitted by law.

• Service providers that support booking, electronic records, forms, payments, website hosting, cloud storage, email, SMS, analytics, cybersecurity, accounting, legal services, document destruction and other operations. They may use the information only to perform authorized services, subject to contractual or other safeguards where appropriate.

• A person you authorize, or a substitute decision-maker, parent or legal guardian where authorized by law.

• Regulators, professional colleges, insurers, law enforcement, courts, government authorities or other parties when disclosure is legally required or permitted—for example, to comply with a subpoena, report a risk of serious harm, respond to a privacy investigation or protect rights and safety.

• Parties to a proposed or completed financing, reorganization, merger, sale or transfer of all or part of the business, subject to lawful confidentiality, due-diligence and notice requirements.

BARLATËS does not disclose identifiable clinical photographs for advertising, social media, portfolio use, education or other promotional purposes unless you have given specific permission. Where practical, you may choose whether your full face, partial face or treatment area may be shown, and may withdraw permission for future uses subject to content already lawfully published or distributed.

7. Service providers and transfers outside Ontario or Canada

Some service providers may store, access or process information outside Ontario or Canada. Information handled in another jurisdiction may be subject to that jurisdiction’s laws and may be accessible to courts, law enforcement or national security authorities there. BARLATËS remains accountable for personal information transferred to a processor under its control and uses contractual, administrative and technical measures appropriate to the sensitivity and circumstances. Contact our Privacy Officer for information about relevant service-provider locations and safeguards.

8. Cookies, analytics and online advertising

Cookies are small files or identifiers placed on a device. We may use essential cookies for security, navigation, account or booking functionality; preference cookies to remember choices; analytics cookies to understand website use; and, only where implemented and lawfully authorized, advertising technologies to measure campaigns or deliver relevant promotions.

You can adjust browser settings to block or delete cookies, and use any consent-management tool we make available. Blocking essential cookies may affect site or booking functions. Browser “Do Not Track” signals are not interpreted consistently across the industry; we honour legally required preference signals where applicable and supported.

9. Email, SMS and telephone communications

We may contact you about appointments, aftercare, safety, transactions, account administration and other service-related matters. With consent or another lawful basis, we may also send promotional email or text messages. Commercial electronic messages will identify the sender and include a working unsubscribe method as required by Canada’s Anti-Spam Legislation (“CASL”). You can unsubscribe from marketing at any time; service and care-related communications may continue where needed.

Email and ordinary text messaging may not be fully secure. Please avoid sending highly sensitive information through unsecured channels. By asking us to communicate through a particular channel, you acknowledge its inherent risks; we may recommend a more secure method for sensitive exchanges.

10. Safeguards and privacy incidents

We use administrative, technical and physical safeguards proportionate to the sensitivity, volume, format and location of the information. Measures may include role-based access, unique accounts, passwords and multi-factor authentication where available, encryption in transit and at rest where supported, secure premises and storage, staff confidentiality obligations and training, vendor assessment, access logging, backups, secure disposal and incident-response procedures.

No system or transmission is completely secure. If a loss, unauthorized access, use or disclosure occurs, we will contain and investigate the incident, mitigate harm, document the event, and notify affected individuals, regulators or others when required by applicable law. We will maintain breach records as required.

11. Retention and secure disposal

We retain information only as long as reasonably necessary for the purposes described, to provide safe continuity of care, and to meet legal, tax, insurance, contractual and professional recordkeeping requirements. Clinical records may be subject to retention periods established by PHIPA and the professional college or standards applicable to the treating provider. Because those periods vary by record type, provider and client age, BARLATËS maintains an internal retention schedule rather than promising one universal period in this policy.

When information is no longer required, we securely destroy, erase or de-identify it. Backups and immutable systems may retain residual copies until they cycle out under established schedules, with continued safeguards and access restrictions.

12. Accuracy, access and correction

You may ask whether we hold your personal information, request access to it, ask for an account of relevant uses or disclosures, or request correction of information that is inaccurate or incomplete. Submit a written request to the Privacy Officer and describe the records sought. We may verify your identity and authority before responding.

We will respond within the timeframe required by applicable law and may charge only a permitted, reasonable fee after giving an estimate where required. Access may be limited where a legal exception applies—for example, if disclosure would reveal another person’s information, privileged information, confidential commercial information, or information whose disclosure could reasonably risk serious harm. If we refuse all or part of a request, we will explain the reason and available complaint options, subject to legal restrictions.

If you successfully demonstrate that a record is inaccurate or incomplete for the purposes for which we use it, we will amend it as required and, where appropriate, notify relevant recipients. Clinical opinions made in good faith or records that must be preserved may not be replaced, but a correction, addendum or statement of disagreement may be attached where required.

13. Children and capacity

Our website is not directed to children. We do not knowingly collect personal information online from children for marketing without appropriate authorization. For clinic services involving a minor or a person who may lack capacity, consent and access decisions are handled according to applicable law, the person’s capacity, the nature of the treatment, and the authority of a parent, guardian or substitute decision-maker. A capable minor may have privacy rights in their own health information.

14. Third-party websites and social media

Our website or communications may link to booking platforms, payment services, maps, social networks or other third-party services. Those services operate under their own terms and privacy practices. We are not responsible for their independent handling of information. Information posted publicly or sent through social media may be visible to others; do not use public comments to share confidential medical details.

15. Changes to this policy

We may update this policy to reflect changes in our practices, services, technology or legal obligations. We will post the revised version with a new “Last updated” date and provide additional notice of material changes where appropriate or required. Unless otherwise stated, changes apply from the date posted and do not retroactively authorize a materially new use without consent where consent is required.

16. Questions, requests and complaints

Please contact the Privacy Officer first. We will acknowledge and investigate privacy complaints fairly, document our response, and take corrective action where appropriate. Raising a concern will not affect your access to services.

Privacy Officer:

Bonnie Chung & Ulana Hunter

Legal Entity:

DBLVGO INc.

Mailing Address:

3328A Dundas St. W, Toronto, ON M6P 2A4

Email:

hello@barlatescanada.com

Telephone:

437-210-0358

Depending on the information and the organization responsible for it, you may also have the right to complain to the Information and Privacy Commissioner of Ontario or the Office of the Privacy Commissioner of Canada. Their current contact information is available on their official websites.