Privacy Policy

Effective date: August 01, 2026
Version: 1.2

Maliya Wellness Centre for Women Ltd., operating as Maliya Wellness Centre ("Maliya," "we," "us" or "our"), operates a multidisciplinary wellness centre in Cochrane, Alberta. This Privacy Policy explains how Maliya collects, uses, discloses, stores and protects personal information through our website, shared clinic operations, communications, administration and the systems we manage.

Maliya handles personal information within its custody or control in accordance with Alberta's Personal Information Protection Act (PIPA), Canada's Anti-Spam Legislation (CASL) and other applicable requirements. Some independent practitioners working through Maliya may also be custodians under Alberta's Health Information Act (HIA) or may have separate privacy, recordkeeping and professional obligations.

1. Scope of this policy

This policy applies to personal information handled by Maliya through:

·       the Maliya website, website forms, cookies and analytics;

·       telephone, email, physical fax, mail and in-person communications;

·       general inquiries and complimentary consultations;

·       registration, scheduling, wait-lists, reminders and shared reception services;

·       billing, payment processing, direct billing, insurance administration, invoices, receipts and gift cards;

·       newsletters, events, workshops, reviews, feedback and other communications;

·       Maliya-managed accounts and shared systems, including Jane; and

·       Maliya's administrative, operational, financial, employment and contractor-management activities.

This policy applies across the services offered through Maliya, including mental and emotional health services, psychological and psychoeducational assessment, counselling, social work, family and marriage therapy, physiotherapy, chiropractic care, massage therapy, manual lymphatic drainage, pelvic-floor rehabilitation, acupuncture and Traditional Chinese Medicine, nutrition and metabolic programs, nurse-practitioner and hormone-related services, reflexology, Reiki, Access Bars, TMJ and Thai yoga therapy, areola, scar and stretch-mark tattooing, teeth whitening, workshops, groups and related wellness services. Services may change over time; this policy applies to all services offered through Maliya's shared clinic environment.

This is Maliya's general public privacy policy. It does not replace a treatment consent form, a collection notice required for a particular service, or an independent practitioner's own privacy notice and professional obligations.

2. Maliya and Independent Practitioners

Maliya provides the shared clinic setting and may provide reception, booking, billing, payment, communications, Jane administration and operational support. Maliya is responsible for personal information in its custody or control and for reasonable safeguards governing the premises, employees and systems it administers.

Practitioners providing professional or clinical services through Maliya operate as independent contractors and independent businesses. They are not employees of Maliya. Each practitioner remains responsible for their own professional practice, including clinical judgment, treatment decisions, consent, documentation, record retention, disclosures, privacy assessments, technology choices, vendor review and compliance with applicable laws and professional requirements.

Some practitioners may be HIA custodians. Others may handle personal information under PIPA and the requirements of their profession. A practitioner's use of Maliya's premises, reception services, Jane environment or other shared infrastructure does not, by itself, transfer custody or control of the practitioner's clinical records to Maliya or make Maliya the HIA custodian.

Questions or requests concerning a treatment record, clinical note, diagnosis, treatment consent or a practitioner's use of clinical technology may need to be addressed directly by that practitioner. Maliya's Privacy Officer can help identify and route a request to the appropriate person.

3. Personal information we collect

Depending on how you interact with Maliya and the service involved, information may include:

·       identity and contact information, such as name, date of birth, address, telephone number, email address, preferred name and client identifier;

·       parent, guardian, substitute decision-maker, emergency-contact and other representative information;

·       registration and scheduling information, including appointment history, wait-list status, attendance, reminders, practitioner and location;

·       information you voluntarily provide in an inquiry, intake form, consultation or communication;

·       health and service information reasonably required for assessment, treatment, care coordination or another requested service;

·       service-specific information, which may include mental-health, family, sexual, reproductive, hormonal, pelvic-floor, trauma, disability, injury, nutrition, wellness or minor-client information;

·       consent records, expressed wishes, authorizations, access or correction requests, complaints and incident-related information;

·       billing, payment, insurance, direct-billing, invoice, receipt and gift-card information;

·       photographs or images where appropriate to a requested service and collected with the required explanation and authorization;

·       employment, contractor, credential, training and access-administration information;

·       records of communications with Maliya; and

·       website and technical information described below.

Please do not submit detailed medical information, clinical records or urgent health concerns through a general website form, newsletter form or ordinary social-media message. Use the appropriate secure booking or practitioner communication channel.

4. How we collect information

Maliya may collect personal information:

·       directly from you when you contact us, submit a form, book or attend an appointment, complete registration, make a payment, subscribe to communications or otherwise interact with us;

·       from a parent, guardian, authorized representative or substitute decision-maker;

·       from an independent practitioner where authorized and reasonably necessary for shared administration, scheduling, billing, safety or service coordination;

·       from an insurer, referring provider, benefit administrator or other authorized source;

·       through Maliya-managed systems and service providers; or

·       automatically through cookies and similar website technologies.

5. How we use personal information

Maliya may use personal information to:

·       respond to inquiries and requests;

·       arrange consultations and connect you with an appropriate service or practitioner at your request;

·       register clients and administer bookings, wait-lists, reminders and communications;

·       support reception, billing, invoicing, payment, insurance and direct-billing activities;

·       provide and coordinate authorized shared-clinic services;

·       confirm identity, representative authority and communication restrictions;

·       operate, secure, maintain and improve Maliya's premises, systems and website;

·       understand website traffic, performance and user experience;

·       send newsletters, workshop information, clinic updates and promotions where permitted;

·       manage consent, communication preferences and unsubscribe requests;

·       prevent, identify and respond to fraud, misuse, safety concerns and privacy or security incidents;

·       maintain appropriate financial, business, employment, contractor and operational records; and

·       meet legal, professional, regulatory, insurance and contractual obligations.

Maliya limits collection, use and disclosure to purposes that are reasonable and appropriate in the circumstances. Independent practitioners determine the purposes and legal authority for information they collect and use within their own practices.

6. Consent, legal authority and choices

Maliya obtains consent where required. Consent may be express or implied depending on the sensitivity of the information, the purpose and the circumstances. Certain collections, uses or disclosures may instead be authorized or required by law.

You may withdraw consent prospectively, subject to legal, professional, contractual and record-retention requirements. Withdrawing consent may affect our or a practitioner's ability to provide a service where the information is necessary for that service.

Where a practitioner is an HIA custodian, the practitioner may rely on authority under the HIA rather than consent for certain activities. The practitioner remains responsible for identifying the applicable authority, providing any required notice, documenting expressed wishes and complying with HIA requirements.

7. Children, youth and representatives

Maliya serves children and teens. Capacity and authority are considered according to the individual, the service, applicable law and professional requirements rather than age alone.

Maliya or the responsible practitioner may verify identity, guardianship, parenting arrangements, substitute decision-making authority or another representative relationship before accepting instructions, providing access, communicating information or obtaining consent. A parent or guardian does not automatically have unrestricted access to every part of a capable young person's clinical record.

Where legal documents establish communication, parenting, guardianship or decision-making restrictions, Maliya and the responsible practitioner will follow those documents. This may include communicating separately with authorized parents or representatives. Safety, confidentiality and mandatory-reporting obligations may also affect what information can be shared.

8. Clinical Records and Practitioner Privacy Practices

Clinical information may be stored in Jane or another system selected and controlled by the responsible practitioner. Even when Maliya administers a shared system, the practitioner may remain the legal custodian or organization responsible for the clinical record.

Each practitioner is responsible for:

·       determining what clinical information is required;

·       providing service-specific privacy and consent information;

·       documenting assessment, treatment and professional decisions;

·       limiting access and disclosure to lawful purposes;

·       responding to clinical access and correction requests where the record is in their custody or control;

·       meeting profession-specific record-retention requirements; and

·       making appropriate arrangements for records when they leave the clinic or stop practising.

Maliya does not routinely inspect independent practitioners' clinical notes solely to determine whether individual consent requirements have been met. Targeted access may occur where authorized and reasonably necessary to respond to an incident, complaint, access request, safety concern, legal obligation or shared-system issue.

9. Website Forms, Cookies and Analytics

The Maliya website is hosted through Squarespace and may use cookies or similar technologies for website functionality, security, performance and measurement.

Maliya may use Google Analytics and Google Tag Manager to understand how visitors find and use the website. Depending on configuration and consent choices, these tools may process information such as browser and device details, IP-derived or approximate location, language, page address and title, referring source, pages viewed, session identifiers, outbound clicks, downloads, form interactions, scrolling and configured video interactions. Google Search Console provides aggregated information about search queries, pages, countries, devices, dates, clicks, impressions, click-through rates and average search position.

Maliya uses this information to evaluate website performance and improve communications and services. Marketing and analytics information is kept separate from clinical records. Where required, non-essential analytics technologies will be controlled through the website's cookie choices. You may also adjust your browser settings to block or delete cookies, although some website functions may not work as intended.

Website forms should be limited to the information reasonably required for the stated purpose. Do not include a detailed clinical narrative unless the form clearly indicates that it is an approved channel for that information.

10. Newsletters and Electronic Communications

Maliya may use Mailchimp or another approved provider for newsletter subscriptions and email campaigns. Subscription information may include name, email address, subscription status, consent source, preferences, tags, unsubscribe history and engagement information such as campaign opens or link clicks.

Newsletter consent is optional and is not required to receive clinical or wellness services. Commercial emails will identify the sender and provide an unsubscribe mechanism as required by CASL. You may unsubscribe using the link in an email or by contacting Maliya.

Email and text messaging carry privacy risks. Maliya uses Microsoft Outlook for business email and may use telephone, voicemail, text messaging, Jane notifications and physical fax for authorized communications. We take reasonable steps to verify recipients and use secure portals for sensitive documents where practicable. Please tell us if you have communication restrictions or preferences.

11. Booking, Virtual Services and Communications

Maliya uses Jane for shared booking, intake, reminders, client profiles, billing, secure client communications and, where applicable, clinical records. Access is assigned according to role and operational need.

Virtual services may be provided through Jane, Zoom, telephone or another approved method selected by the practitioner. Maliya does not record virtual video sessions. If an independent practitioner proposes any audio recording, transcription or documentation technology, the practitioner is responsible for explaining it, determining the applicable legal and professional requirements, and obtaining and documenting any required consent before use.

12. Artificial Intelligence and Automated Tools

Maliya may use artificial intelligence tools for limited non-clinical administrative work, such as drafting, organization, training, website content, media or marketing. Maliya does not enter identifiable client information, client charts or health information into a general-purpose administrative AI tool unless Maliya has completed an appropriate privacy, legal, contractual and security assessment and specifically authorized that use. A person reviews AI-assisted administrative material before it is used.

Independent practitioners may separately choose whether to use AI-assisted scribing, transcription, summarization or documentation tools in their own practices. Not every practitioner uses AI. Maliya does not select, approve or endorse a practitioner's clinical AI tool merely because the practitioner works at Maliya or stores the final record in Jane.

Each practitioner is independently responsible for:

·       determining whether the proposed use is lawful and professionally appropriate;

·       reviewing the vendor, plan, data location, subprocessors, security, retention, deletion and model-training terms;

·       completing any required privacy assessment, agreement or regulatory process;

·       explaining the technology and any material privacy risks to the client;

·       obtaining and documenting acknowledgement or informed consent where required;

·       offering a reasonable non-AI option where required;

·       limiting information to the minimum necessary;

·       personally reviewing, correcting and approving the resulting documentation; and

·       reporting any suspected privacy or security incident.

A practitioner must obtain Maliya's authorization before directly connecting an independent tool to a Maliya-administered system. That authorization concerns the technical security of the shared environment and is not approval of the practitioner's clinical use. Clients may ask their practitioner whether AI or another documentation technology will be used in their care.

13. Service Providers and Shared Platforms

Maliya uses service providers to support clinic operations. Depending on your interaction with us, these may include:

·       Squarespace for website hosting, forms and website functionality;

·       Mailchimp for newsletter subscriptions and email delivery;

·       Google Analytics, Google Tag Manager and Google Search Console for website measurement and search-performance reporting;

·       Jane for booking, intake, reminders, billing, secure communications and clinical-record functions;

·       Microsoft Outlook and related Microsoft services for business communications and office productivity;

·       Zoom or another approved virtual-care platform for applicable remote services;

·       QuickBooks and financial-service providers for accounting, invoicing, reconciliation and financial records;

·       payment processors, insurers and direct-billing portals;

·       telephone, voicemail, text and physical-fax providers; and

·       IT, security, legal, insurance, audit and professional advisers.

These providers may collect information directly through their services or process information for Maliya or an independent practitioner. We limit access to information reasonably necessary for the relevant purpose and use contractual, access and security measures appropriate to the relationship.

When a provider handles health information for an HIA custodian, the responsible custodian must determine whether an Information Manager Agreement or another HIA arrangement is required.

14. Processing outside Alberta or Canada

Some service providers or their subprocessors may store, access or process personal information outside Alberta or outside Canada, including in the United States and other countries where they or their subprocessors operate. Support personnel may also access systems remotely from another jurisdiction.

When information is processed in another country, it may be subject to that country's laws and may be accessible to courts, law-enforcement bodies or government authorities in accordance with those laws. Maliya and each responsible HIA custodian must assess location, access, contractual terms and safeguards as applicable to the information and service involved.

You may contact the Privacy Officer for more information about Maliya's policies and practices concerning service providers outside Canada or the location of a particular Maliya-managed service.

15. Disclosure of Personal Information

Maliya does not sell personal information.

Maliya may disclose personal information:

·       to an independent practitioner or service at your request or with lawful authority;

·       to service providers supporting Maliya's operations;

·       where reasonably necessary to administer registration, scheduling, billing, payment, insurance, direct billing or another requested service;

·       to a parent, guardian, authorized representative or substitute decision-maker where authorized;

·       to insurers, benefit administrators, payment providers, professional advisers, auditors or regulators where appropriate;

·       in connection with a proposed or completed business transaction, subject to applicable safeguards;

·       to investigate or respond to misuse, a complaint, safety concern or privacy or security incident; or

·       where required or authorized by law.

Independent practitioners make disclosure decisions for clinical records within their custody or control and must consider applicable consent, legal authority and expressed wishes.

16. Safeguards

Maliya uses reasonable administrative, physical and technical safeguards appropriate to the sensitivity of the information. These may include:

·       privacy policies, role definitions, confidentiality requirements and training;

·       individual accounts, role-based permissions and multifactor authentication;

·       secure systems, encryption where available, screen locks, updates and device-security practices;

·       controlled clinic access, private treatment spaces and locked storage;

·       recipient verification and secure transmission methods;

·       vendor review, incident procedures, access reviews and timely offboarding; and

·       secure destruction of paper and electronic records.

Personal devices may access approved systems only where required safeguards are in place. Client information must not be stored in personal photographs, downloads or unapproved applications.

No system or method of transmission is completely secure. Maliya and the responsible practitioner or custodian will assess and respond to suspected privacy incidents and provide notices where required by applicable law.

17. Retention and Disposal

Maliya retains personal information only for as long as reasonably necessary for the identified purpose and to meet legal, accounting, insurance, operational and contractual requirements. When information is no longer required, it is securely destroyed, deleted or anonymized, subject to lawful holds, technical limitations and required retention periods.

Original financial records may be archived by fiscal year in secured, access-restricted storage and destroyed after the applicable retention period using a documented secure process.

Independent practitioners determine retention and disposal of their clinical records according to applicable laws, professional standards, custody arrangements and any complaint, claim, investigation, access request or legal hold.

18. Access, Correction and Complaints

You may request access to personal information about you that is in Maliya's custody or control, or ask us to correct information that is inaccurate or incomplete. We may need to verify your identity and authority before responding. Access may be limited where permitted or required by law, and any lawful limitation will be explained.

If the requested information is a clinical record in an independent practitioner's custody or control, Maliya may route you to that practitioner. HIA access and correction requests must be addressed by the applicable custodian in accordance with HIA requirements.

Privacy concerns and complaints may be directed to Maliya's Privacy Officer. We will document and investigate concerns involving Maliya's operations and will coordinate with the responsible practitioner or custodian where appropriate. If a concern is not resolved, you may contact the Office of the Information and Privacy Commissioner of Alberta or the applicable professional regulator.

19. External Links and Third-Party Services

The Maliya website may link to independent practitioner pages, booking services, social media or other third-party websites and platforms. A third party's own privacy terms may apply when you use its service. Maliya is not responsible for the privacy practices of a third party acting independently from Maliya.

20. Changes to this statement

Maliya may update this Privacy Statement to reflect changes in services, technologies, legal requirements or clinic practices. The current version will be posted on the website with its effective date. Material changes may be communicated through an additional notice where appropriate.

21. Contacting the Privacy Officer

Questions, concerns, access or correction requests, complaints, and requests for more information about Maliya's privacy practices may be directed to:

Privacy Officer
Maliya Wellness Centre for Women Ltd.
Operating as Maliya Wellness Centre
2204 - 120 5th Avenue West
Cochrane, Alberta T4C 0A4
Email: private@maliya.ca
Phone: 403-981-9868
Fax: 403-444-9835

You may also ask the Privacy Officer whether a more specific privacy notice, public policy document or practitioner contact applies to your request. Operational or security-sensitive documents may not be available in full, but Maliya will provide appropriate information about its privacy practices and applicable request process.

If we are unable to resolve a privacy concern, you may contact the Office of the Information and Privacy Commissioner of Alberta.

Applicable laws and resources

·       Alberta Personal Information Protection Act

·       Alberta Health Information Act

·       Office of the Information and Privacy Commissioner of Alberta

·       Canada's Anti-Spam Legislation