Privacy Policy

Louise Green Skin Care ("we," "us," or "our"), operating as Great Skin Forever in Ottawa, Ontario, Canada, is committed to protecting your privacy. This policy explains what personal information we collect, why we collect it, how we use and safeguard it, and the rights you have over your information under Canadian privacy law (PIPEDA).

What changed on November 7, 2026. This version covers the online shop and your online account, names every service provider that receives personal information (adding Stripe, MailerLite, Sentry, Cloudflare and AlumierMD), corrects where our server is hosted, describes more exactly what Google Analytics receives, including online purchases, and explains the reminders we may send about a checkout you did not finish.

What we collect

We collect personal information directly from you when you:

• Submit a consultation form on this website
• Book or attend an in-studio appointment
• Receive a personalized skincare routine or care guide
• Buy from us, online or in the studio
• Use your online account
• Email, message, or call us

The categories of information we may collect include:

• Contact details: name, email address, phone number
• Skin and health information you choose to share for treatment planning, including medical history, allergies, current medications, and skin concerns
• Photographs of your skin (with your consent) for treatment planning, before-and-after comparisons, and progress tracking
• Your responses on consent and intake forms
• Records of your treatments, recommended products, and any notes Louise records during your visits
• Orders and payments: what you bought, your pickup time or shipping address, and the payment confirmation (see “When you buy from the shop” below)
• Your online account: when you last signed in and the email choices you set. Your password is stored only in a scrambled form that cannot be turned back into it
• How you reached us: the page you arrived on and the website that referred you (its name only — for example, google.com), and, if you accepted advertising cookies, the campaign details those cookies carry

Why we collect it

• To provide skincare consultations, treatments, and routines tailored to you
• To maintain accurate client records as required for professional practice
• To communicate with you about your appointments, routines, and follow-up care
• To send you transactional emails (routine delivery, consent form invitations, appointment confirmations)
• To take payment for your orders, have them ready for pickup or shipping, and send your receipts
• To comply with our legal and regulatory obligations
• To understand which searches, referrals, and advertising actually bring people to us

We do not sell your information. We do not use it for behavioural advertising.

Email from us

Receipts, appointment confirmations and reminders, routines, and account emails such as password resets are part of the service and are always sent.

We email you news and offers only if you have said yes (by ticking the box on this site, in your account, or by telling Louise in person), or for two years after a purchase, as Canada's anti-spam law allows, unless you tell us to stop. Every one of these emails has an unsubscribe link that works at once, without signing in.

Product reminders and check-ins after a visit are separate: they are sent only if you have said yes to them, and you can switch them on or off at any time in your account or from any of those emails.

How we store and protect it

Your information is held in systems we control:

• A secure, password-protected database on our application server, hosted by Hetzner in the United States (Ashburn, Virginia)
• Encrypted file storage (Bunny.net) for any photos or documents you submit
• Encrypted, access-controlled backups stored with Cloudflare R2 in compliance-grade write-once storage

Access is limited to Louise and any authorized staff bound by confidentiality. Admin sessions require a password and time out automatically; your own online account stays signed in for up to 30 days unless you sign out. Data in transit is encrypted with HTTPS.

Sharing with third parties

We share your personal information only with service providers who help us run the practice, and only to the extent necessary:

• Stripe — processes card payments, online and in the studio. Your card details go straight to Stripe; we receive a confirmation and the card brand, never the card number. For a shipped order, Stripe also works out the sales tax from the delivery address
• AlumierMD — when you buy AlumierMD products online, your email is checked with AlumierMD, and if you are not registered with them yet, your name and email are registered with AlumierMD under Louise's clinic
• Resend — sends the emails our system sends you: receipts, appointment and consultation emails, routines, account emails, and the follow-up emails you have said yes to
• MailerLite — holds our list for news and offers and sends those emails. It receives your email address and name, whether you are a client, whether you said yes yourself or through a purchase and when that ends, whether you have not visited or ordered for a while, and whether you have unsubscribed
• Cloudflare — serves this website and protects it from attacks, so every visit passes through its network, which sees your internet address and browser as any web server does. Its Web Analytics counts visits to our pages without cookies and without identifying you
• Sentry — error reporting: when a page breaks or something in our system goes wrong, technical details of the error are sent to Sentry so it can be fixed (which page, which browser, what failed). What you type into forms, your cookies and the private links in our emails are removed first
• Bunny.net — stores and delivers any images you upload
• Cloudflare R2 — holds encrypted backups of our database
• Hetzner — hosts our application server
• Google — only if you accept cookies: Google Analytics and Google Ads, as described in “Cookies and tracking” below
• The carrier that delivers a shipped order — your name, shipping address and phone number, for the label

Each provider is bound by their own privacy commitments. Some of them keep information outside Canada, including in the United States and the European Union, where the laws of that country apply to it. We never sell your information, and we do not share it with data brokers.

When you buy from the shop

For an online order we collect your name, email address and phone number, what you bought, your pickup time or the shipping address you typed (kept as a record of where the parcel went), and the payment confirmation from Stripe. We never see your card number. If you buy a gift card for someone else, we use their name and email address only to send them the card and keep a record of it.

Your cart is kept in a signed cookie in your browser for 30 days, so you can come back to it. It holds the products and quantities you added and, for a gift card, its amount, the recipient's name and email address and your message; nothing else about you.

If you start a checkout and reach the payment step without finishing it, we may email you up to two reminders about the order you left. Canada's anti-spam law treats that checkout as an inquiry; we use it for these reminders only, for six months at most, and it never adds you to our news and offers. Each reminder has an unsubscribe link that works at once. Order and payment records are kept for at least six years, as described below.

Your online account

A paid order, online or in the studio, sends you an invitation to set up an online account if you do not have one yet. You can ignore it; nothing requires you to sign in.

Your account shows the orders, receipts, appointments and product routine recorded for you, and your email choices. It shows nothing you have not already seen from Louise, and none of the notes she keeps for her own practice. Links we email you to set or reset your password, or to confirm a new email address, work once and expire.

How long we keep it

We keep client records for as long as you remain a client and for ten years afterward, in line with Ontario professional record-keeping norms. This covers your intake answers, skin photographs, product routines and treatment notes. Records of purchases and payments are kept for at least six years, as required for tax purposes.

Consultation form submissions from non-clients are kept for one year unless you become a client (in which case they become part of your client record), or you ask us to delete them sooner.

If you ask us to delete your information, we will remove you from any marketing lists, stop all optional emails, close your online account so you can no longer sign in, and remove your record from day-to-day use so it no longer appears in our working lists. We cannot delete the clinical and financial record itself while we are required to keep it, for the periods described above. We will tell you what has been removed and what has been retained.

About backups. Our backups are write-once, which means they cannot be edited after they are made — that is what allows us to recover your information if something goes wrong. Deleted information therefore remains in backups until those backups expire on their normal schedule, which can take up to about seven months. It is not used for anything during that time.

Links for setting a password or confirming a new email address are deleted a day after they are used or expire. The Google Analytics identifier kept with an online order (see “Cookies and tracking”) is deleted as soon as the purchase has been reported, and in any case within eight days.

Cookies and tracking

Some cookies are necessary for the site to function, and are always on: keeping Louise signed in to the admin area; keeping you signed in to your online account, for up to 30 days or until you sign out (it holds only a reference to your account, not your details); your shopping cart (see “When you buy from the shop”); remembering an order you left unpaid, for up to 7 days, so a new checkout can release it; noting, for one day, that you opened your consultation form from the link in your own email, so the form knows it is you; and remembering the cookie choice you make below.

With your consent — and only with it — we additionally use Google Analytics (via Google Tag Manager) to see how the site is used, and advertising-attribution cookies (including Google Ads click identifiers, kept for up to 90 days) that tell us which of our ads brought you here. Google Analytics records the pages you visit, your device and browser, your approximate location worked out from your internet address, and a random identifier kept in a cookie. It does not receive your name, email address or phone number from us. If you decline, none of these load and the site works exactly the same. You can change your choice at any time using the “cookie preferences” link in the footer of every page.

Two services run on every visit, whatever you choose, and neither sets a cookie: Cloudflare's Web Analytics counts visits to each page without identifying you, and Sentry sends us the technical details when a page breaks, so it can be fixed (see “Sharing with third parties”).

If you accepted these cookies and buy from the online shop, our server tells Google Analytics about the purchase once it is paid: the order number, what you bought and the amounts, linked only to that random identifier. Google Ads may count the sale as the result of an ad. We do not use it, or anything else, to build advertising audiences or to follow you with ads.

Separately from cookies: when you submit a form on this site, we record the page you were on and the website that referred you — its name only, such as google.com, never the full address. We record this whether or not you accept cookies, because it is how we know which of our efforts bring people to us. It is kept with your enquiry and is never used for advertising.

We never sell your information, and we do not share it with data brokers. Apart from the purchase report above, Google Analytics is never joined to your client record. The arrival information described above is kept with your record, so we can see which referrals and campaigns lead to real consultations and orders.

Your rights

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Correct any inaccuracies in that information
• Withdraw consent for ongoing collection or use, where applicable
• Request deletion of your records (subject to legal retention requirements)
• Make a complaint to the Office of the Privacy Commissioner of Canada at priv.gc.ca

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

Children

Our services are intended for adults. If you are under 16, please have a parent or guardian contact us on your behalf before submitting personal information through this site.

Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of this page reflects the most recent revision. Material changes will be highlighted here for at least 30 days.

Contact us

Questions, requests, or complaints about your personal information can be sent to:

Louise Green Skin Care
Ottawa, Ontario, Canada
Email: help@greatskin.ca