Privacy Policy

Last updated: July 27, 2026

MediLab Aesthetics (“MediLab Aesthetics,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information that we collect through our website, online store, communications, and related services.

This Privacy Policy explains what information we collect, how we use and disclose it, how we protect it, and the choices available to you.

By using our website or submitting personal information to us, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

We may collect the following types of personal information:

Information you provide directly

When you create an account, place an order, contact us, subscribe to communications, or submit a professional account application, we may collect:

• Your full name
• Billing and shipping addresses
• Email address
• Telephone number
• Company, clinic, or business name
• Account username and password
• Products ordered and order history
• Delivery instructions
• Communications you send to us
• Professional licence, certification, clinic information, or other documents submitted for account verification
• Interac e-Transfer payment confirmation information
• Any other information you voluntarily provide

Please do not send confidential banking passwords, online banking credentials, or Interac security answers through our website.

Information collected automatically

When you visit our website, we may automatically collect:

• IP address
• Browser type
• Device type
• Operating system
• Referring website
• Pages viewed
• Date and time of access
• Shopping-cart activity
• Cookie identifiers
• General website usage and diagnostic information

2. How We Use Personal Information

We may use personal information to:

• Create and manage customer accounts
• Process and confirm orders
• Verify receipt of Interac e-Transfer payments
• Arrange shipping, delivery, or local pickup
• Communicate about orders, payments, product availability, returns, and customer service
• Verify professional eligibility for restricted products
• Maintain purchase and transaction records
• Detect fraud, misuse, security incidents, or unauthorized activity
• Improve our website, products, and services
• Troubleshoot technical problems
• Comply with tax, accounting, legal, regulatory, and record-keeping requirements
• Send marketing communications where we have the required consent or another lawful basis
• Enforce our website terms and policies

We seek to collect only the information reasonably necessary for the purposes described above.

3. Professional Account Verification

Certain products may be available only to licensed healthcare professionals, clinics, or other approved purchasers.

To determine eligibility, we may request information such as:

• Professional licence number
• Licence jurisdiction
• Clinic or business details
• Professional identification
• Supporting certificates or documents

This information is used only to review eligibility, administer account access, meet legal or supplier requirements, prevent unauthorized purchases, and maintain appropriate business records.

Approval of an account does not constitute medical, legal, or regulatory advice and does not replace the purchaser’s responsibility to comply with applicable laws and professional standards.

4. Orders and Payments

Our store is operated using WooCommerce.

When you place an order, we collect the information necessary to process the order, including your contact details, billing and shipping information, products purchased, order value, and payment status.

Interac e-Transfer

Where payment is made by Interac e-Transfer, the payment is completed through your financial institution and not directly through our website.

We do not receive your online banking password or complete banking login credentials. We may receive information supplied through the transfer, such as:

• Sender’s name
• Sender’s email address or telephone number
• Payment amount
• Transfer date
• Message or order number included with the transfer
• Payment confirmation or reference information

Orders may remain on hold until payment is received and confirmed.

If additional payment services are introduced, those providers may collect and process payment information under their own privacy policies.

5. Shipping and Delivery

We may disclose the information necessary to fulfil your order to shipping, courier, postal, logistics, or delivery providers.

This may include:

• Your name
• Shipping address
• Telephone number
• Email address
• Order reference
• Package details
• Delivery instructions

Shipping providers process this information according to their own privacy practices.

6. How We Share Personal Information

We do not sell or rent personal information.

We may disclose information to service providers that assist us with:

• Website hosting
• WooCommerce store operation
• Email delivery
• Website security
• Data backup
• Analytics
• Accounting and bookkeeping
• Shipping and order fulfilment
• Customer support
• Fraud prevention
• Professional account verification

Service providers are given only the information reasonably necessary to perform their services.

We may also disclose personal information:

• With your consent
• To comply with a law, court order, subpoena, regulatory request, or legal process
• To investigate suspected fraud, misuse, security incidents, or unlawful activity
• To protect our rights, customers, employees, property, or safety
• In connection with a business sale, merger, financing, restructuring, or transfer of assets, subject to appropriate confidentiality measures

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

• Keep the website functioning
• Maintain your shopping cart
• Remember account and session information
• Support checkout and security
• Remember preferences
• Understand website usage
• Diagnose technical problems
• Measure website performance
• Support analytics or advertising, where enabled

Some cookies are necessary for the operation of the store. Others may be optional.

You can adjust cookie settings through your browser and, where provided, through our cookie-consent tool. Blocking necessary cookies may prevent parts of the store, cart, account, or checkout from working correctly.

Canadian privacy guidance requires organizations to clearly explain online tracking and obtain appropriate consent where required.

8. Email Communications

We may send transactional messages relating to:

• Orders
• Payment instructions
• Shipping
• Account administration
• Security
• Customer-service requests
• Product or service notices

Where permitted, we may also send promotional emails about products, offers, or company news.

Marketing communications will include an unsubscribe option where required. You may unsubscribe at any time, although you may still receive necessary transactional or account-related messages.

Canadian anti-spam rules generally require commercial electronic messages to have appropriate consent, sender identification, contact information, and a working unsubscribe mechanism.

9. Retention of Information

We retain personal information only for as long as reasonably necessary to:

• Process and administer orders
• Maintain customer accounts
• Provide customer service
• Meet warranty, return, tax, accounting, legal, and regulatory obligations
• Resolve disputes
• Prevent fraud
• Enforce agreements
• Maintain security and business records

Retention periods vary depending on the type of information and the reason it was collected.

When information is no longer required, we may securely delete, destroy, or anonymize it, subject to legal and operational requirements.

10. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against:

• Unauthorized access
• Loss or theft
• Misuse
• Disclosure
• Alteration
• Destruction

These measures may include encrypted website connections, account-access controls, software updates, backups, security monitoring, and restricted administrative access.

However, no website, email system, wireless transmission, or storage system can be guaranteed to be completely secure.

You are responsible for protecting your account password and should notify us promptly if you believe your account has been accessed without authorization.

11. Storage and Processing Outside Canada

Some service providers used by our website may store or process information outside Canada, including in the United States or other jurisdictions.

When information is processed in another country, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, or government authorities under applicable law.

12. Accessing or Correcting Your Information

You may contact us to request:

• Access to personal information we hold about you
• Correction of inaccurate information
• Information about how your data has been used or disclosed
• Withdrawal of consent, where applicable
• Deletion of information, where legally and operationally possible

We may need to verify your identity before processing a request.

Certain information may need to be retained for legal, accounting, security, transaction, or dispute-resolution purposes. Canadian privacy law generally gives individuals rights to request access to personal information held by businesses, subject to applicable exceptions.

13. Withdrawal of Consent

You may withdraw consent to certain uses of your personal information by contacting us.

Withdrawal may not apply where collection, use, disclosure, or retention is required or permitted by law. It may also affect our ability to provide an account, complete an order, verify professional eligibility, or supply requested services.

14. Children’s Privacy

Our website and products are intended for adults and business or professional purchasers.

We do not knowingly collect personal information from children under the age of 18. If you believe that a minor has submitted personal information to us, please contact us so that we can review and, where appropriate, delete it.

15. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the content, security, or privacy practices of third parties. You should review their privacy policies before providing personal information.

16. Privacy Incidents

If we experience a security breach involving personal information, we will investigate it and take appropriate steps.

Where required by applicable Canadian privacy law, we will notify affected individuals and report a breach to the appropriate authority if it creates a real risk of significant harm. PIPEDA also requires applicable organizations to keep records of security breaches.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our:

• Business operations
• Website
• Services
• Technology
• Service providers
• Legal or regulatory obligations

The revised policy will be posted on this page with an updated “Last updated” date.

Your continued use of the website after an update means that the revised policy will apply to future interactions, subject to applicable law.