Privacy and Confidential Information Policy
Introduction
YaLisse Medical-Esthetic (hereinafter referred to as "YaLisse Medical-Esthetic") is committed to respecting your privacy and protecting your personal information.
In the course of using our services, YaLisse Medical-Esthetic may collect and you may communicate personal information.
This policy aims to outline, to users of the services offered by YaLisse Medical-Esthetic, the following:
How their personal data is collected and processed;
What their rights are regarding their data;
Who is responsible for the processing of the collected and processed personal data;
To whom this data is transmitted;
Applicable Laws
In the course of using our services, YaLisse Medical-Esthetic may collect and you may communicate personal information. The collection, use, communication, and storage of your personal information are subject to the Private Sector Privacy Act (RLRQ, c. P-39.1).
Similarly, the personal information of a European resident will be processed in accordance with the General Data Protection Regulation (GDPR) of the European Union.
Personal Information
Personal information is any information concerning an identifiable individual. This includes, but is not limited to, name, contact information, billing information, information entered when creating a profile to access one of our services, lifestyle, or health information.
However, information concerning the performance by the individual of a function within a business, such as their name, title, and function, as well as the address, email address, and phone number of their workplace, will not be considered personal information.
Our Commitment
We have established and implemented internal policies and procedures aimed at adequately protecting the personal information in our possession regardless of its format. We regularly review them.
We raise awareness among our employees about the importance of protecting personal information by requiring training on this topic and issuing occasional guidelines highlighting their role and obligations in this regard.
Purposes of Information Collection
In the course of our functions, we collect your personal and confidential information only to enable us to provide the requested services adequately and personalized. In all cases, the communication of your personal and confidential information will be subject to obligations of confidentiality maintenance and compliance with applicable laws.
Consent
Subject to exceptions and requirements of applicable laws, we will not disclose or divulge your personal information to any other third parties without your consent.
By using our services, you consent to the collection, use, and disclosure of your personal and confidential information in accordance with this policy. The form of consent may vary depending on the context or the requested service.
You may withdraw your consent at any time, subject to certain legal or contractual restrictions.
In certain particular circumstances, we may collect, use, or disclose personal information without informing you or obtaining your consent. Such circumstances include, among others, when, for legal, medical, or security reasons, it is impossible or unlikely to obtain your consent or when the information is necessary for investigating a potential breach of contract, preventing or detecting fraud, or enforcing the law.
Before disclosing personal information about another person, you must obtain the consent of that person regarding the disclosure and processing of that personal information according to the terms of this policy.
Limits of Collection, Use, and Disclosure
Use
We may use the personal information collected, among other purposes, for the following:
To provide the requested service;
To confirm your identity and respond to your information requests;
To provide any other complementary service associated with the requested service;
To meet the requirements of laws and regulations;
Disclosure
We may disclose your personal information to any of our employees, professional advisors, suppliers, or subcontractors or affiliates to the extent reasonably necessary for the provision of the requested services and for the purposes stated in this policy.
Generally, we do not disclose your personal information. Occasionally, we may disclose your personal information to certain suppliers or agents to provide the services you have requested. In all cases, we comply with the restrictions and requirements provided by law when disclosing your personal information.
Your personal information will not be disclosed to third parties other than in accordance with this Privacy Policy, except as required or permitted by law, or as ordered by a competent court.
We do not sell your personal information to third parties.
International Data Transfers
The information we collect may be stored, processed, and transferred in any country where YaLisse Medical-Esthetic or its subcontractors offer their services, to allow us to use the information in accordance with this policy.
The information we collect may be transferred or processed in Canada.
Personal information you post on our website or submit for publication may be available worldwide via the internet. We cannot prevent the use, good or bad, of this information by third parties.
You expressly agree to the transfer of personal information described in this section.
Non-Personal Information
We automatically collect certain non-personal information using third-party analytics programs such as Google Analytics to help us understand how our visitors use our web services, but none of this information can identify you.
Retention of Information
When your personal information is no longer required, it is destroyed in accordance with the law and our record retention policy. In certain circumstances, we may anonymize the personal information we retain.
Your personal and confidential information is retained, directly or through subcontractors, only for the duration necessary for the purposes of the requested services and the applicable legal and regulatory requirements. We require our subcontractors to adhere to confidentiality agreements and apply policies equivalent to this one. In all cases, access to your personal and confidential information is restricted to persons for whom access is required in the performance of their duties.
Responsibility
We are responsible for the personal information we have in our possession or under our control, including the information we entrust to third parties for the purpose of providing the requested service. We require these third parties to retain this information according to strict standards of confidentiality and security.
We adhere to the principles set out by the law. We have established policies and guidelines that ensure protection of your privacy. The person responsible for the protection of personal information oversees this personal information protection policy and the various frameworks of the company.
Our staff is informed and adequately trained on policies and practices regarding the protection of personal information.
Security Measures
We have implemented several security measures regarding the personal information and confidential data we hold to protect them against loss, theft, and prevent unauthorized access, transmission, use, or modification of this personal information, including the following subsections:
Secure IT Environments
The infrastructure and equipment are hosted in a secure environment in a data center located in Quebec, Canada. In cases where it is impossible to host a solution or service in Quebec, we ensure that security measures equivalent to or greater than those required by this Policy are implemented.
Access Management
Only employees whose tasks require it have access to personal or confidential information.
Destruction
YaLisse Medical-Esthetic ensures physical and technological security for the personal information it retains to counteract accidental destruction, loss, and disclosure, as well as inappropriate destruction.
We retain your personal information for as long as necessary for the purposes for which it was collected. We must destroy or anonymize this information in accordance with the law and our retention schedule. When we destroy or anonymize your personal information, we take necessary measures to ensure its confidentiality and ensure that no unauthorized person can access it during the destruction or anonymization process.
Incident Management Involving Personal Information
If YaLisse Medical-Esthetic has reason to believe that a privacy incident involving personal information has occurred and that it presents a risk of serious harm from the incident, YaLisse Medical-Esthetic will promptly inform the Access to Information Commission and any person whose personal information is affected by the incident. It may also notify any person or entity likely to reduce this risk, by providing only the personal information necessary for this purpose without the consent of the person concerned. In all cases, a record will document the incident for reference purposes.
User Rights
Request for Access, Withdrawal, or Correction
You may, subject to any regulatory or contractual restrictions, view, correct, or destroy the personal information we hold about you via this form.
We will provide you with such information within a maximum of 30 days from the date of receipt of the written request and in a structured and commonly used technological format. However, fees may be required to process your request.
You may verify the accuracy and completeness of your personal information and, if necessary, request its modification. Any request for modification will be processed in accordance with the law.
Data Portability
The user has the right to request the portability of their personal data held by YaLisse Medical-Esthetic to another site.
Requests, Complaints, and Questions
We are committed to addressing your questions and concerns regarding the protection of your personal information. If the response is unsatisfactory, you can contact the Personal Information Protection Officer at the above address.
Contact Information
Any request or complaint regarding the protection of personal information should be addressed to the Personal Information Protection Officer at the following address:
Personal Information Protection Officer