Privacy Policy

Last updated: January 15, 2026

PRIVACY POLICY

Compliant with PIPEDA, PHIPA, and CASL

1. Introduction and Commitment to Privacy

his_actualbody ("we," "our," or "us") is deeply committed to protecting the privacy and confidentiality of your personal information and personal health information. This Privacy Policy explains our practices concerning the collection, use, disclosure, retention, and protection of your information when you visit our website at hisactualbody.com (the "Site") and use our wellness services (the "Services").

We comply with all applicable Canadian privacy legislation, including:

The Personal Information Protection and Electronic Documents Act (PIPEDA)
The Personal Health Information Protection Act, 2004 (PHIPA) of Ontario
Canada's Anti-Spam Legislation (CASL)
Professional practice standards of the College of Physicians and Surgeons of Ontario (CPSO)
Other applicable federal and provincial legislation

By using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to our collection, use, and disclosure of your information as described herein.

2. Definitions

For clarity, the following terms have these meanings:

Personal Information: Information about an identifiable individual, as defined under PIPEDA, including your name, contact information, date of birth, and other identifying information.

Personal Health Information (PHI): Identifying information about an individual in oral or recorded form relating to their physical or mental health, provision of healthcare, payments for healthcare, or other information as defined under PHIPA.

Health Information Custodian (HIC): Under PHIPA, his_actualbody is a Health Information Custodian with specific obligations regarding the protection of your personal health information.

3. Information We Collect

We collect various types of information to provide and improve our Services:

3.1 Personal Information

Information you provide directly to us:

Full legal name, date of birth, and gender
Contact information (mailing address, email address, telephone number)
Government-issued identification for age and identity verification
Health card number (Ontario Health Insurance Plan number, if provided)
Payment card information and billing details
Account credentials for our client portal (if applicable)
Emergency contact information
Communication preferences and language preference
Any other information you choose to provide

3.2 Personal Health Information

Medical and health information collected during consultations and treatment:

Comprehensive medical history, including past illnesses, surgeries, and treatments
Current health status and symptoms
Family medical history relevant to your care
Current and past medications, dosages, and supplements
Known allergies, sensitivities, and adverse reactions
Lifestyle factors (diet, exercise, smoking, alcohol consumption)
Physical examination findings and vital signs
Laboratory test results and diagnostic reports
Treatment plans, prescriptions, and clinical notes
Progress notes and treatment outcomes
Informed consent documentation
Clinical photographs or videos (with separate explicit consent)
Correspondence with other healthcare providers regarding your care

3.3 Automatically Collected Technical Information

When you visit our Site, certain information is automatically collected:

IP address and approximate geographic location
Browser type, version, and language settings
Device type, operating system, and screen resolution
Date and time of access
Pages viewed, links clicked, and navigation paths
Referring website or source
Search terms used to find our Site
Cookies and similar tracking technologies (see Section 9)

4. How We Use Your Information

We collect and use your information for specific, identified purposes only. Under PIPEDA and PHIPA, we limit our collection, use, and disclosure to what is necessary for these purposes.

4.1 Providing Healthcare Services (PHIPA-Permitted Use)

Conducting medical consultations and assessments
Developing and implementing personalized treatment plans
Prescribing medications and therapies
Monitoring treatment progress and outcomes
Coordinating care with other healthcare providers (with your consent or as permitted by law)
Ordering and interpreting laboratory tests and diagnostics
Providing follow-up care and support
Managing adverse reactions and complications

4.2 Administrative and Operational Purposes

Scheduling and managing appointments
Sending appointment reminders via email, SMS, or phone (with consent under CASL)
Processing payments and managing billing
Maintaining accurate medical records as required by PHIPA and CPSO standards
Communicating with you about your care and our Services
Responding to your inquiries and providing client support
Managing client portal accounts and access
Processing insurance documentation and reimbursement support

4.3 Quality Improvement and Research (De-identified Data)

Conducting quality assurance and improvement activities
Training healthcare practitioners and staff
Analyzing treatment outcomes (using de-identified or aggregated data)
Contributing to research studies (only with your explicit consent and research ethics board approval)
Evaluating and improving our Services

4.4 Legal and Regulatory Compliance

Complying with PHIPA, PIPEDA, CPSO, and other regulatory requirements
Responding to lawful requests from government authorities, law enforcement, or courts
Reporting communicable diseases as required by public health legislation
Reporting concerns about child abuse or risk of serious bodily harm as required by law
Participating in College of Physicians investigations or proceedings
Defending legal claims or establishing legal rights

4.5 Marketing Communications (With Express Consent)

In compliance with CASL, we will only send you commercial electronic messages if you have provided express consent. This includes:

Promotional materials about new services or treatments
Special offers and wellness programs
Educational content about men's wellness and health optimization
Newsletters and updates

You may withdraw your consent at any time by using the unsubscribe mechanism in our communications or by contacting us. Withdrawal of marketing consent does not affect communications related to your healthcare or account administration.

4.6 Website Functionality and Improvement

Operating and maintaining our Site
Analyzing Site usage and user behavior
Personalizing your Site experience
Improving Site design, functionality, and content
Detecting and preventing fraud, security breaches, and technical issues

5. PHIPA and PIPEDA Compliance Framework

5.1 Our Status as a Health Information Custodian

Under PHIPA, his_actualbody is a Health Information Custodian (HIC) because we are a healthcare provider that operates a healthcare facility in Ontario. As an HIC, we have specific legal obligations to protect your personal health information and respect your privacy rights.

5.2 Collection, Use, and Disclosure Principles

We adhere to the following core privacy principles:

Accountability: We are responsible for personal information under our control and have designated a Privacy Officer.
Identifying Purposes: We identify the purposes for which we collect information at or before the time of collection.
Consent: We obtain your consent for collection, use, and disclosure, except where permitted or required by law.
Limiting Collection: We collect only information that is necessary for identified purposes.
Limiting Use, Disclosure, and Retention: We use and disclose information only for identified purposes and retain it only as long as necessary.
Accuracy: We strive to keep personal information accurate, complete, and up-to-date.
Safeguards: We protect information with security safeguards appropriate to its sensitivity.
Openness: We make information about our privacy policies and practices readily available.
Individual Access: We provide you with access to your personal information upon request.
Challenging Compliance: We provide mechanisms for you to challenge our compliance with these principles.

5.3 Your Rights Under PHIPA

As an individual whose personal health information we hold, you have the following rights under PHIPA:

Right of Access: You have the right to request access to your personal health information in our custody or control. We will respond to your request within 30 days (or 60 days in certain circumstances).
Right to Request Correction: If you believe your personal health information is inaccurate or incomplete, you may request correction. If we agree, we will make the correction. If we disagree, we will note your request in your record.
Right to Request Additional Disclosure Restrictions: You may request that we not disclose your information for certain purposes. We will accommodate reasonable requests that do not compromise care quality.
Right to Request an Accounting of Disclosures: You may request a list of disclosures we have made of your personal health information, subject to certain exceptions.
Right to Complain: If you believe we have violated your privacy rights, you may file a complaint with our Privacy Officer or with the Information and Privacy Commissioner of Ontario (IPC).

5.4 Consent Under PHIPA

Under PHIPA, we obtain your consent for the collection, use, and disclosure of your personal health information except where law permits or requires otherwise. Your consent may be:

Express Consent: Given verbally or in writing explicitly for a specific purpose.
Implied Consent: Reasonably inferred from your actions or circumstances (e.g., providing information during a consultation).

You may withdraw or modify your consent at any time, subject to legal and contractual restrictions. Withdrawal may affect our ability to provide Services. We will explain any consequences of withdrawal before you make your decision.

6. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information or personal health information. We share your information only in the following limited circumstances:

6.1 With Your Consent

We may share your information with third parties when you provide explicit consent, such as:

Sharing medical information with other healthcare providers involved in your care
Providing testimonials or case studies (always with specific written consent and opportunity to review)
Disclosing information to family members or designated contacts
Participating in research studies

6.2 Service Providers and Agents

We engage third-party service providers who perform services on our behalf and require access to your information. These include:

Electronic health record (EHR) system providers
Payment processors and financial institutions
Laboratory and diagnostic service providers
IT and cloud services providers
Appointment scheduling and reminder services
Marketing and analytics platforms
Legal and professional advisors

All service providers are contractually required to:

Maintain the confidentiality and security of your information
Use your information only for the specified purpose
Comply with applicable privacy legislation
Return or destroy information when no longer needed

6.3 Healthcare Operations

Under PHIPA, we may use and disclose personal health information for healthcare operations without your consent, including:

Quality improvement and risk management activities
Training healthcare practitioners and staff
Auditing and evaluation of services
Business planning and resource allocation

6.4 Legal and Regulatory Requirements

We may disclose information without your consent when required or permitted by law:

In response to a court order, subpoena, or other legal process
To comply with statutory or regulatory requirements
To report communicable diseases to public health authorities
To report suspected child abuse or neglect to Children's Aid Society
When there is a serious risk of bodily harm to you or another person
For proceedings before the College of Physicians and Surgeons of Ontario
For law enforcement purposes as permitted under PHIPA
To defend legal claims or establish legal rights

6.5 Circle of Care

Under PHIPA, we may share your personal health information with other healthcare providers in your "circle of care" for the purpose of providing or assisting in providing healthcare to you, without obtaining your express consent. Your circle of care may include:

Your family physician or specialist
Other healthcare professionals involved in your care
Pharmacists filling your prescriptions
Laboratory and diagnostic services

You have the right to request that we not share your information within your circle of care, but this may affect the quality of care you receive. We will explain any implications before you make this decision.

7. Data Security and Protection Measures

We implement comprehensive physical, technical, and administrative safeguards to protect your personal information and personal health information against loss, theft, unauthorized access, disclosure, copying, use, or modification.

7.1 Physical Safeguards

Secure clinic premises with controlled access
Locked storage for physical records and documents
Secure disposal of physical documents (shredding)
Private consultation rooms ensuring confidentiality
Security measures to prevent unauthorized physical access

7.2 Technical Safeguards

Encryption of data in transit (TLS/SSL) and at rest
Secure, password-protected user authentication
Multi-factor authentication for sensitive systems
Firewalls and intrusion detection systems
Regular security vulnerability assessments and penetration testing
Automatic session timeouts for inactive users
Secure data backup and disaster recovery procedures
Anti-virus and anti-malware software
Audit logs monitoring system access and activities

7.3 Administrative Safeguards

Written privacy and security policies and procedures
Mandatory privacy and security training for all staff and practitioners
Confidentiality agreements with employees and contractors
Role-based access controls limiting information access to need-to-know basis
Regular privacy audits and risk assessments
Incident response and breach notification procedures
Background checks for employees with access to personal health information
Designated Privacy Officer overseeing privacy program

7.4 Breach Notification

In the event of a privacy breach involving your personal health information, we will:

Contain and investigate the breach promptly
Notify the Information and Privacy Commissioner of Ontario as required by PHIPA
Notify affected individuals if there is a real risk of significant harm
Document the breach and our response
Take steps to prevent future breaches

7.5 Limitations of Security

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information. You acknowledge and accept this inherent risk when using our Services.

8. Data Retention and Disposal

We retain your personal information and personal health information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal and professional obligations.

8.1 Medical Records Retention

Under CPSO's Medical Records Documentation policy and PHIPA requirements:

Adult patient records: Retained for a minimum of 10 years from the date of last entry
Minor patient records (if applicable): Retained until the patient reaches age of majority plus 10 years
Diagnostic imaging and reports: Retained for minimum periods specified by regulation

8.2 Other Information Retention

Billing and Financial Records: Retained for 7 years as required by Canada Revenue Agency
Marketing Communications: Retained until you withdraw consent or request deletion
Website Analytics: Retained for up to 26 months
Consent Records: Retained for the duration of the relationship plus applicable limitation periods

8.3 Secure Disposal

When information is no longer required, we dispose of it securely:

Physical records: Shredded or incinerated
Electronic records: Securely deleted using data sanitization methods
Storage media: Degaussed or physically destroyed

8.4 Archival Records

Some records may be retained longer than standard retention periods for:

Ongoing legal proceedings or investigations
Research purposes (with appropriate ethics approval and de-identification)
Historical or archival purposes (de-identified)

9. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies to enhance functionality, analyze usage, and support marketing efforts.

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our Site. They help us recognize your browser and capture certain information about your visit.

9.2 Types of Cookies We Use

Essential Cookies: Required for Site functionality, security, and access to secure areas. These cannot be disabled.
Performance and Analytics Cookies: Help us understand how visitors use our Site, which pages are most popular, and how to improve Site functionality. We use Google Analytics for this purpose.
Functionality Cookies: Remember your preferences and settings to personalize your experience.
Advertising and Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness through platforms like Google Ads and Meta Pixel.

9.3 Third-Party Analytics and Advertising Services

We use the following third-party services:

Google Analytics: Analyzes Site traffic and user behavior. Privacy policy: google.com/policies/privacy
Google Ads: Delivers targeted advertising and conversion tracking
Meta Pixel (Facebook): Tracks conversions and supports remarketing campaigns

These services may collect information about your online activities across different websites for interest-based advertising.

9.4 Managing Cookies and Opting Out

You can control cookies through:

Browser Settings: Most browsers allow you to view, delete, and block cookies. Note that disabling cookies may affect Site functionality.
Google Analytics Opt-Out: Install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout
Interest-Based Advertising Opt-Out: Visit youradchoices.ca (Digital Advertising Alliance of Canada) to opt out of interest-based advertising
Mobile Device Settings: Use your device's privacy settings to limit ad tracking

10. Your Privacy Rights and How to Exercise Them

You have significant rights regarding your personal information and personal health information under Canadian law.

10.1 Right of Access

You may request access to your personal information and personal health information. Upon receipt of a written request, we will provide you with:

A copy of your personal health information
Information about how your information has been used and disclosed
An explanation of any codes, abbreviations, or technical terms

We will respond within 30 days (or 60 days if extension is necessary). There may be a reasonable fee for providing copies, which we will inform you about in advance.

10.2 Right to Correction

If you believe your personal information is inaccurate or incomplete, you may request a correction. If we agree with your request, we will correct the information. If we disagree, we will note your request for correction in your record and notify anyone who received the information within the past year.

10.3 Right to Withdraw Consent

You may withdraw your consent for certain uses and disclosures at any time by contacting our Privacy Officer. However, withdrawal may affect our ability to provide Services. We will explain the implications before processing your request. Note that we may continue to use information where required or permitted by law.

10.4 Right to Request Restrictions

You may request that we restrict certain disclosures of your personal health information. We will accommodate reasonable requests that do not compromise the quality of your care or our legal obligations.

10.5 Right to Complain

If you have concerns about our privacy practices, you may:

Contact our Privacy Officer to resolve the issue internally
File a complaint with the Information and Privacy Commissioner of Ontario (IPC) at www.ipc.on.ca or 1-800-387-0073
File a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376

10.6 Marketing Opt-Out (CASL Compliance)

You may opt out of marketing communications at any time by:

Clicking the unsubscribe link in our emails
Replying "STOP" to text messages
Contacting us directly

Opt-out does not affect communications related to your healthcare or account administration.

11. Children's Privacy

Our Services are intended only for individuals who have reached the age of majority in their province of residence (18 years in Ontario). We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a minor, we will delete it immediately. If you believe we have information about a minor, please contact our Privacy Officer immediately.

12. Third-Party Websites and Services

Our Site may contain links to third-party websites, services, or resources that we do not own or control. This Privacy Policy applies only to our Services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party sites you visit. Providing links does not constitute our endorsement of these third parties or their content.

13. International Data Transfers

Your personal information and personal health information is primarily stored and processed in Canada. However, some of our service providers may store or process data outside Canada, including in the United States. When we transfer information outside Canada:

We ensure service providers provide a comparable level of protection as required under Canadian law
We enter into contractual agreements requiring protection of your information
We inform you that information stored or processed outside Canada may be subject to foreign laws and accessible to foreign authorities under lawful access provisions

By using our Services, you consent to the storage and processing of your information as described above.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Services. Material changes will be communicated by:

Posting the updated Policy on our Site with a revised "Last Updated" date
Providing notice via email to registered users
Displaying a prominent notice on our Site

Material changes take effect 30 days after notice is provided. Your continued use of the Services after changes become effective constitutes acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically.

15. Questions and Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

Privacy Officer

his_actualbody

[Physical Address]

[City, Province, Postal Code]

Email: privacy@hisactualbody.com

Phone: [Phone Number]

Website: hisactualbody.com

Regulatory Complaint Contact Information:

Information and Privacy Commissioner of Ontario (IPC)

2 Bloor Street East, Suite 1400

Toronto, ON M4W 1A8

Phone: 416-326-3333 / 1-800-387-0073

Website: www.ipc.on.ca

Office of the Privacy Commissioner of Canada

30 Victoria Street

Gatineau, QC K1A 1H3

Phone: 819-994-5444 / 1-800-282-1376

Website: www.priv.gc.ca

ACKNOWLEDGMENT

BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO OUR COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN.