Privacy and patient information

Privacy Policy

Effective Date: September 6, 2026

1. Scope

Bespoke Functional Medicine respects your privacy and is committed to protecting personal information and personal health information. We handle information in accordance with applicable privacy laws, including Ontario's Personal Health Information Protection Act, 2004 (PHIPA) and, where applicable, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy explains the information practices for this website. Clinical records created in the course of care are also governed by the clinic's professional, legal and record-keeping obligations.

2. Information we may collect

Depending on how you interact with the clinic or this website, we may collect:

• contact information you choose to provide, such as your name, telephone number or email address;
• information needed to respond to appointment, service or intake enquiries;
• limited technical request information processed by the website host for delivery, security and abuse prevention; and
• personal health information collected separately through appropriate clinical and intake processes when you seek or receive care.

Please do not send urgent concerns or detailed personal health information through general website channels. Call the clinic for intake guidance. If you are experiencing a medical emergency, call 911 or go to the nearest emergency department.

3. How information may be used

We may use information to respond to enquiries, provide and administer care, communicate about clinic services, maintain website security, meet professional and legal obligations, and protect patients, staff and the public.

Personal health information is collected, used or disclosed only with consent or as otherwise permitted or required by law. We seek to limit collection, use and disclosure to what is reasonably necessary for the applicable purpose.

4. Appointment requests and website storage

An appointment request does not confirm an appointment. Information submitted through the request form is used to contact you about availability and next steps. Do not provide symptoms, medications, test results or other detailed medical information through the general request form.

Service pages record limited, first-party operational events such as starting or completing an on-page guide, viewing the callback form, selecting a call link or successfully submitting a callback request. These records contain a timestamp, generic event type, generic campaign code, page path and temporary random page-instance identifier. They exclude names, email addresses, patient telephone numbers, symptoms, guide answers, IP addresses and advertising click identifiers.

With your permission, this marketing website uses Meta Pixel and, when configured, Google Analytics 4 and Google Ads measurement to understand page visits and generic actions such as selecting a call link or submitting a callback request. Google receives a generic page category. Meta Pixel receives marketing page and browser information through its standard website integration after you allow measurement. Our marketing event payloads do not include names, contact details, form contents, guide answers, symptoms, diagnoses or medical records. Google Signals and Google ad personalization are disabled. Meta automatic matching and automatic event tracking are disabled. You may choose essential operation only or change your choice using the website's Privacy choices control.

Google measurement may use first-party cookies, pseudonymous browser identifiers and advertising click identifiers to connect a consented website interaction with its traffic source and advertising report. These identifiers are not placed in the clinic's callback email or medical record. The clinic does not upload diagnoses, treatment information or patient status to Google.

Some interactive pages use temporary browser session storage solely to preserve navigation or guide progress during the current browser session. Guide answers remain in the browser and are not included in website analytics.

5. Telephone attribution

The male-hormone pages display Canadian telephone numbers supplied by Nimbata. They route calls to the clinic and connect an inbound call with limited visit context, such as source, campaign, landing page, referrer and timestamp. Nimbata necessarily processes the caller's telephone number and ordinary call-routing information to connect the call. A non-personal Bespoke request reference may also be linked after a callback request. Contact details, questionnaire answers and medical information are not added to the website analytics record.

Calls may be recorded and transcribed after the caller hears a notice. Pressing 9 stops subsequent recording. When a caller uses that opt-out, the related audio and transcript must be deleted while non-clinical call and attribution metadata may be retained. Call recording, transcription and attribution records are governed separately from the clinic's medical records.

If you allow measurement, generic call-button actions and callback requests may be sent to Meta Pixel and, when configured, Google Analytics or Google Ads. The caller's telephone number, call contents, transcript, diagnosis and medical information are not included in Meta or Google marketing events. A call is an engagement signal only and does not establish that the caller became a patient or was clinically appropriate.

6. Service providers and disclosures

We may use service providers for website hosting, security, communications, aggregate measurement and clinic administration. Providers receive only the information reasonably required for their services and are expected to protect it. Information may also be disclosed where you consent or where disclosure is permitted or required by law.

Some service providers, including Google, Meta and Nimbata, may process information outside Ontario or Canada, where it may be subject to the laws of the jurisdiction in which it is processed.

7. Safeguards and retention

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information. No internet transmission or storage system can be guaranteed completely secure.

Information is retained only as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, regulatory, insurance and professional record-keeping requirements. It is then securely destroyed or de-identified where appropriate. Google Analytics, Meta Pixel, Nimbata call-attribution and clinical-record retention are configured separately.

8. Your privacy rights

Subject to applicable law, you may request access to or correction of personal information or personal health information held by the clinic. You may also ask questions, raise a concern or withdraw consent for certain uses or disclosures, subject to legal and clinical limitations. Withdrawing optional website-measurement consent does not prevent you from reading the website, calling the clinic or requesting a callback.

9. Privacy contact

Contact the Privacy Officer to ask a privacy question, request access to or correction of information held by the clinic, withdraw consent where applicable, or raise a concern. Please do not include detailed personal health information in an ordinary email or voicemail unless clinic staff have asked you to do so.

10. Changes to this policy

We may update this policy when our practices, technologies or legal obligations change. The current version and effective date will be posted on this page.