Canadian Privacy

Alberta PIPA (our primary governing law)

Waine operates from Alberta, so Alberta's Personal Information Protection Act (PIPA) is the primary law governing how we handle personal information. Alberta's PIPA is substantially similar to the federal PIPEDA below — the same fair information principles apply. Waine is built to support PIPA obligations, including help notifying the Office of the Information and Privacy Commissioner of Alberta of breaches involving significant harm.

PIPEDA (federal framework, applies where PIPA doesn't)

PIPEDA applies to certain commercial personal-information activities across Canada, including interprovincial and international personal-information flows. Alberta PIPA generally governs our Alberta-based private-sector activities, while PIPEDA may apply to information handled across provincial or national borders and in other circumstances within its scope. Waine is designed around the same 10 fair information principles in PIPEDA Schedule 1 that underlie Alberta's PIPA above:

1. Accountability — Waine designates a Privacy Officer responsible for compliance.
2. Identifying Purposes — We collect data only for stated, specific purposes.
3. Consent — We obtain and record express or implied consent before collecting personal information.
4. Limiting Collection — We collect only what is necessary for the purpose.
5. Limiting Use, Disclosure, and Retention — Data is not sold. Retention periods are documented.
6. Accuracy — Businesses and clients can correct their information at any time.
7. Safeguards — Encryption, access controls, audit logs, and breach monitoring. See our Security page.
8. Openness — Our policies are publicly available.
9. Individual Access — Users can access, correct, or request deletion of their data.
10. Challenging Compliance — Contact us at privacy@waineappointments.com with any concerns.

CASL (Canada's Anti-Spam Legislation)

CASL requires express or implied consent before sending commercial electronic messages (CEM). Waine supports CASL compliance in the following ways:

• Marketing emails and SMS require client consent. Waine records whether a client has opted in to marketing messages.
• Every marketing message includes a one-click unsubscribe link. Unsubscribe requests are processed immediately.
• Service messages such as appointment confirmations, reminders, receipts, and security notices are sent to facilitate or provide information about the requested service or transaction. Where a message constitutes a commercial electronic message (CEM) under CASL, Waine and businesses using Waine must comply with the applicable consent, identification, and unsubscribe requirements or rely on an applicable statutory exception.
• Consent records include the date, method, and IP address of consent — available in your dashboard for audit purposes.
• Implied consent applies for existing clients for 2 years after their last transaction (CASL Section 10(9)(a)).

Businesses are responsible for ensuring their own marketing campaigns sent through Waine comply with CASL.

Data residency and cross-border transfers

Waine's servers are hosted on Railway's infrastructure, which may be located in the United States. Waine remains accountable for personal information transferred to service providers for processing. We use contractual, technical, and organizational measures appropriate to the sensitivity of the information, and disclose the jurisdictions and purposes of our service providers in our Subprocessors list. Railway is a SOC 2 Type II certified provider.

If your business requires Canadian data residency (e.g., for regulated health professions), please contact us at privacy@waineappointments.com to discuss your requirements.

Health information (massage therapists, estheticians, and health-adjacent professionals)

PIPEDA applies to health information collected by private-sector organizations in provinces without substantially similar legislation. If your business collects health information (e.g., skin conditions, medical history, allergy information) via intake forms or client notes, you have additional obligations:

• Obtain informed consent before collecting health information.
• Use health information only for the stated purpose (e.g., service delivery).
• Do not use client health information for marketing without separate, express consent.
• Health information must be retained only as long as necessary and securely deleted when no longer needed.

Note for regulated health professionals: If your practice is regulated under provincial health legislation (e.g., regulated massage therapists in Ontario under RHPA), sector-specific legislation may apply in addition to PIPEDA. Ontario health information custodians should also be aware of the Personal Health Information Protection Act(PHIPA), which governs the collection, use, and disclosure of personal health information in that province. Waine does not constitute an Electronic Health Records (EHR) system and is not intended for use in highly regulated clinical settings.

Your rights as a Canadian individual

Under Alberta PIPA (and PIPEDA, where applicable), individuals have the right to:

• Know that an organization holds information about them and how it is used.
• Access their personal information. Under Alberta PIPA, organizations generally have 45 calendar days to respond to a written access request, subject to permitted extensions. Other laws may prescribe different response periods.
• Correct inaccurate information.
• Withdraw consent for use of their information (subject to legal and business obligations).
• Complain to the Office of the Privacy Commissioner of Canada (OPC) if they believe their rights have been violated.

To exercise any of these rights, email privacy@waineappointments.com. Client accounts can also submit a data deletion request from the client portal (the privacy icon in the header); business owners, from Settings → Privacy & Data. Either way, you'll be asked to confirm your password, and you'll get an email when the request is submitted and again once it's complete.