Privacy notice

Face On Optical (“we”) respects your privacy. This notice explains how we handle personal information and personal health information (PHI) under Ontario’s PHIPA and Canada’s PIPEDA, as applicable. It covers our website, online shop, booking forms, and patient portal. It is not legal advice.

Operating location and contact details appear in the website footer when configured in clinic Settings. Until then, ask staff in clinic.

What we collect (minimum necessary)

• Identity and contact details needed to serve you (name, email; phone only if you provide it; date of birth when required to match or create a clinic chart).
• Appointment and booking requests.
• Shop order lines and pickup details.
• Portal sign-in (email authentication via a secure magic link).
• Clinical information in your chart — visible in the portal only after verification and consent, limited to what you need for self-service.
• Security and accountability logs (for example, portal access audits).

We do not ask for payment card numbers on this website. We do not run advertising analytics pixels on public pages today. See our Cookies page.

Why we collect it

• Care and dispensing — exams, fittings, prescriptions, and orders (PHIPA / treatment).
• Portal access — appointments, booking requests, and order references after you sign in.
• Care communications — confirmations, pickup readiness, and clinically necessary follow-up (optional preference).
• Marketing (CASL) — only if you opt in. Commercial electronic messages require consent; you can withdraw anytime in your account.
• Security and accountability — preventing unauthorized access and maintaining an access trail.

Consent

Shop checkout and booking forms require acknowledgment of this notice before we accept your submission. Portal account linking records required consents with this notice version and a timestamp. Marketing is opt-in only (not pre-checked).

Service providers & transfers

We do not sell your personal information. We use service providers under contracts that require appropriate safeguards, which may include:

• Hosting and application infrastructure (for example, Vercel or similar).
• Database and authentication (for example, Supabase).
• Optional email or SMS delivery (for example, SendGrid, Twilio) when configured.
• Map directions if you choose to open Google Maps.

Some providers may process data outside Canada. Where that occurs, we rely on contractual and organizational safeguards. We may disclose information when required by law or to prevent serious harm.

How we protect information

• Encrypted transport (HTTPS) and authenticated sessions.
• Passwordless magic-link sign-in to reduce weak-password risk.
• Identity check (email + date of birth matching your chart) before account linking.
• Patient accounts are separated from staff accounts.
• Portal views are limited to a summary needed for self-service (minimum necessary).
• Access to patient portal data is logged for accountability.

Your rights

Subject to PHIPA and PIPEDA, you may request access to, or correction of, your personal health information, ask how it has been used or disclosed, and withdraw marketing consent. Contact the clinic to make a request. We may need to verify your identity first.

You may also contact the Information and Privacy Commissioner of Ontario about PHIPA concerns, or the Office of the Privacy Commissioner of Canada about PIPEDA.

Retention

Clinical records are retained according to professional and legal requirements for optical / optometric practice in Ontario. Portal consent and access logs are kept as needed for accountability and security. Unneeded website form drafts are not retained beyond operational need.

Contact

For privacy questions or access requests, contact Face On Optical using the phone, email, or address on this website, or speak with our staff in clinic. Ask for the privacy contact / health information custodian on duty.

This notice may be updated. The version shown at sign-in is the one that applies to your consent. Patient sign-in