Privacy policy.

SECTION 01

Who this policy is for

Owneli is the software a salon, spa, medspa, studio or wellness practice uses to run its day. Two very different people read this page, and which one you are changes almost every answer below.

This policy explains how Owneli Software Inc. ("Owneli", "we", "us") handles personal information across the Owneli platform: this website, the staff application, the client portal, the booking and shop pages we host for businesses, the secure links we send by email and text, and the mobile apps.

• You run a business on Owneli, or you work in one. You hold an Owneli sign-in, and this policy tells you what we hold about you.
• You are a client of a business that uses Owneli. Your appointments, forms and treatment records live in that business’s workspace. This policy tells you what the software does with them, and who to ask about them.
• You are reading the website. You have given us nothing beyond the request that loaded this page, unless you asked for early access, registered a business, or asked us to help move your data across.

SECTION 02

Two roles: controller and processor

For your account with us, Owneli decides what is held and why. For everything a business records about its own clients, the business decides and we act on its instructions.

Owneli is the controller of the data behind an Owneli account: the sign-in itself, the profile attached to it, the sessions it opens, and the enquiry that may have preceded it. We decide what that needs to contain for the software to work, and we answer for it.

Owneli is a processor, also called a service provider, of everything a business records about its clients: the client record, the appointment, the intake form, the chart, the photograph, the sale, the message. The business decides that data exists, decides who on its team may see which part of it, and decides when it goes. We store it, protect it, and do what the business’s use of the software instructs. Where a business is a health information custodian under a provincial health privacy law, Owneli acts as its electronic service provider on the same terms.

That split is enforced in the database, not just described here. Every record carries the organisation it belongs to, and the access rules attached to each table refuse rows belonging to another organisation. A business’s team cannot reach another business’s clients, and no business can reach the platform’s other customers.

One person can be a client of several businesses on Owneli. Each business holds its own separate record of you, and one portal sign-in can be linked to several of them. Deleting the sign-in unlinks all of them at once; it does not reach into any business’s own records.

SECTION 03

What is held

Grouped by whose data it is, because the answer to “who decides about this” differs for each group.

People who hold an Owneli staff sign-in: owners, managers, practitioners and front desk. Owneli is the controller of the account; the employer is the controller of the employment record behind it.

A business’s booking pages show the names of the team members a client can book. A fuller public profile, with a photo, a short biography, specialties, credentials and the reviews clients left, appears only when the business publishes it and the team member has agreed, and it comes down if the team member withdraws that agreement.

Clients of a business using Owneli. The business is the controller of all of it; we hold it on their behalf.

If you leave a review, the business can publish it on its booking pages with your first name and the initial of your last name, your rating, the service, the date and the business’s reply. Anyone can report a published review, which takes it off the public pages until the business decides whether to keep it.

People with their own Owneli sign-in who are not on a business’s team: clients using the client portal or the Owneli app, and outside accountants a business invites. Owneli is the controller of the sign-in.

When you sign in to the client portal or the Owneli app, the sign-in is linked automatically to every client record, at any business on Owneli, that carries the same email address, so you see your visits, receipts, memberships and gift cards from each of them in one place. Each business still sees only its own record of you, and a record a business has blocked is not linked.

Visitors, and people who ask us for something. Owneli is the controller.

Where it comes from: typed by a business’s team, entered by you when you book, fill in a form or use the portal, generated by using the software, imported by a business from a system it used before, or returned to us by a payment, email or messaging provider (a payment outcome, a delivery receipt, a text message you sent back).

SECTION 04

Health data

Medical and treatment information is sensitive information. Owneli handles it as such rather than as ordinary client detail.

A medspa or clinic records health information as a matter of course, and this platform is built to hold it: consultation and intake forms, treatment charts written against an appointment, allergies on the client record, patch test results, clinical free text, before and after photographs, and whatever a person types into the “anything we should know?” box when booking.

Health data is not treated as ordinary client data anywhere in the product:

• Seeing it is a separate permission. A colleague who can book appointments does not automatically see charts, allergies or clinical notes; a business grants those capabilities deliberately, per person.
• A form a business marks as containing health information has its answers and signatures hidden from staff without the charting permission, and revealing them is a deliberate, audited action.
• Where a field is hidden from someone by permission, the screen says it is hidden. It never renders as empty: “no allergies recorded” is a clinical assertion, and the software will not make it on a permission’s behalf.
• Photographs, signatures, uploaded documents and imported files live in private storage that is never publicly readable, and are served through short-lived signed links.
• The AI assistant has no access to it at all. There is no chart tool, and the search index it reads is built from a business’s own authored material, never from a client record.
• Owneli does not sell health data, does not use it for advertising, and does not use it to infer anything about you.

The lawful basis for holding health data, usually express consent given to the business on a consultation or consent form, is the business’s to establish and record. Owneli provides the forms, the signature and the evidence trail that shows when consent was given.

Owneli is not itself a health care provider.

SECTION 05

Why it is processed

Each kind of processing exists for a stated reason. For client data the purpose is set by the business; the column below describes the purpose the software serves.

Owneli does not sell personal information and does not share a business’s client list with another business. A client of two businesses on the platform has two separate records that never meet. We use personal information only for the purposes described here, or for a new purpose with your consent or where the law allows it.

SECTION 06

Who else receives it

The companies that hold or handle data on our behalf, what each one gets, and whether it is always in use.

Each provider handles what it receives under its own data processing terms, and only to provide its service to us. Beyond those providers, data is disclosed to a business’s own people under the permissions it sets, and to an outside accountant the business invites, for the areas the business chooses. The first three rows are always in use and error reporting runs wherever a deployment has been given a reporting key; every other row depends on a feature being configured, and several depend on an individual business turning it on.

A business that holds video appointments uses its own Google Meet, Zoom or Teams room. Owneli stores the link and sends it to you with your booking; the call itself happens on that service, under the business’s account with it, and Owneli does not see or record it.

We may also disclose personal information where the law requires it, such as a valid court order, warrant or subpoena; to protect the safety of a person or the security of the platform; or as part of a merger, acquisition or sale of assets, in which case the information stays subject to the promises in this policy. We review each legal demand and disclose only what the demand lawfully requires. Where the demand concerns a business’s own client records, we tell the business unless the law forbids it.

SECTION 07

Payments, payouts and disputes

Card details go to Stripe, not to us. Stripe also verifies every business that takes payments, and hears both sides when a client disputes a charge.

Card payments on Owneli are processed by Stripe. When you pay or save a card, you type the card details into a payment form that Stripe serves into the page, and they go from your device to Stripe directly. Owneli receives a reference to the card, its brand, the last four digits and the expiry date, never the full number or the security code. The same is true of a card a business takes at its front desk.

Stripe’s payment form sets its own cookies and reads information about your device and browser so that Stripe can detect fraud.

Businesses that take payments. To be paid, a business opens a Stripe connected account through Stripe’s own onboarding. Stripe asks the business, and the people who own or run it, for what it needs to verify them and to meet its legal duties, such as legal names, dates of birth, addresses, identity documents, tax numbers, business details and the bank account for payouts. That information goes to Stripe, not to Owneli. We keep the connected account’s identifier and whether it can take payments. When an administrator opens the payment settings, we ask Stripe for the account’s payout status, balance, recent payouts and anything Stripe still needs, and show it there. We never receive the identity documents or the full bank account number.

Because Owneli answers to Stripe for refunds and chargebacks a business cannot cover, we review what Stripe shares about each business that takes payments, such as its name, what it sells, its website and whether Stripe has verified it, and we keep the payout, refund and dispute records needed to recover an amount a business owes.

Owneli’s own charges to a business, for its plan, add-ons and messaging, are billed through Stripe too, with Owneli as the merchant.

Disputes. If a client disputes a card payment with their bank, Stripe tells Owneli and the business the amount, the reason given and the deadline to respond. Owneli prepares an answer from the business’s records, and the business, or Owneli support on its behalf, reviews it and sends it to Stripe, which passes it to the client’s card issuer. The answer can include the client’s name and email address, the date and details of the booking or sale, the policy the client accepted and the internet address it was accepted from, a timeline of the visit with recent messages between the client and the business, the receipt, and any file the business attaches. A business should leave out clinical detail that the dispute does not need.

SECTION 08

AI features

Oryx is the assistant inside the app. It is off unless an administrator turns it on, it reads what the person asking is already allowed to read, and it cannot reach clinical charts.

Oryx is switched off for an organisation until an administrator enables it, and then reaches only team members holding the capability for it. It is not available to clients and it is not part of the booking flow.

What it can look up: clients and their contact details, tags, visit history and memberships; the schedule; services, products and stock; reviews; the recent messages in a client’s conversation thread, in both directions; published policies; form templates; reports and business totals; settings; and the help centre. Every result is filtered through the permissions of the person who asked, so Oryx never becomes a way around a permission. It drafts and explains. It cannot charge a card, send a campaign, delete a record or change a permission.

What it cannot reach: clinical charts. There is no chart tool, and the search index Oryx reads is built from a business’s own authored material (policies, care pages, services, products, form templates and our help articles) and contains no client records.

Where the data goes. A question, and the records fetched to answer it, are sent to a large language model provider: Anthropic or Google, depending on how the deployment and the organisation are configured. The search index behind Oryx is built with Google’s embedding model in every configuration. A file attached to a question, including a scanned document, is sent to the provider in full. Voice input is sent to Google for transcription along with the business’s own glossary of service and product names; the audio itself is never stored. It exists for the length of the request and is gone when it returns. Only usage totals are recorded, not the transcript.

Oryx conversations are deleted thirty days after they are saved, discarded or expire. A file staged for a question is swept within the hour if the question is never asked.

One related use outside Oryx: when a business imports clients from another system, the column headings are sent to a model to work out which column is which. The sample values that go with them are masked first (an email becomes a shape, a phone number becomes a run of hashes, free text keeps only its word count), so no real value leaves. Drafting campaign copy and rewriting a venue description also go to a model; neither is sent anything about a particular client. Drafting a reply to a client’s review sends the review’s text, with the client’s name and contact details taken out first.

SECTION 09

Messages, marketing and consent

Service messages are part of the booking. Marketing messages need consent, respect opt-outs, and are held to a civilised hour.

Service messages (a booking confirmation, a reminder, a receipt, a form request, a payment link, a sign-in email) are part of what a business does for you and are sent because you have an appointment or a purchase. They carry no unsubscribe link, because unsubscribing from your own appointment confirmation is not a thing anyone wants.

Marketing messages (campaigns, win-backs, birthday and loyalty notices, review requests, expiring-offer nudges) go out only where the consent flag on the client record allows them, and the moment consent was given or withdrawn is recorded beside it.

Text messages pass one gate before they are sent, and the gate fails closed:

• The business must have messaging switched on at all.
• Anyone who has opted out receives nothing, of any kind, from that business.
• A marketing text additionally requires the consent flag on the client record.
• If the recipient cannot be positively matched to a client record, nothing is sent.

Replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT opts you out immediately, for the business that owns the number that texted you. START, UNSTOP or YES opts back in, and HELP returns the business’s contact details. The change is written to the client record, dropped into the conversation thread so the business can see it happened, and logged. Because an unverified opt-out could be used to revoke consent in bulk, the platform refuses to act on a reply it cannot verify came from the messaging provider. Message frequency depends on your appointments and the business’s campaigns, and your carrier’s message and data rates may apply.

We do not share mobile numbers or text-message consent with third parties or affiliates for their own marketing. A number is passed to the messaging provider only to deliver the messages you are due.

Marketing texts are held to a daytime window, 09:00 to 20:00 by default and adjustable by the business. A message that would land in the quiet hours waits. The window is evaluated in the business’s own timezone, or its location’s where it runs more than one, rather than in yours, so if you live somewhere else a message timed for that business’s evening can reach you in your early morning.

Marketing email carries a one-click unsubscribe in the mail headers as well as a link in the footer, alongside the business’s postal address. Unsubscribing switches the consent flag off for that business’s marketing entirely, not just for that campaign, and takes effect at once. Reporting an email as spam does the same thing, permanently, as soon as the delivery provider tells us.

A client with a portal sign-in can see and change both consent flags themselves at any time, and a business can change them on request.

SECTION 10

Cookies, storage and measurement

The app sets a handful of cookies and, without any, records which features each business’s team uses. Owneli’s public website uses Google Analytics, but only if you allow it. Advertising measurement exists on the booking pages of a business that has switched it on.

Rather more is kept in your browser’s own storage, to support the features you use: an unfinished booking so a refresh does not lose it, a shopping bag, a form draft, your language and appearance, your calendar and report preferences, which notifications you have read, and your cookie choices. Cookie choices are also recorded on our server using a random receipt identifier, without your name, email or IP address.

Nothing on the platform runs session recording, and the client portal and a business’s own pages run no analytics of Owneli’s. Owneli’s public website, meaning the home page, the help centre, sign-up and the other pages about Owneli, uses Google Analytics to count visits, but only after you choose to allow it. Until then the tag is not loaded at all, nothing is sent to Google and no analytics cookie is set. Google signals and ad personalisation are switched off, and page addresses are sent without their query string. Your choice is kept for up to 180 days, and the Cookie settings link at the foot of those pages lets you change it at any time; declining after allowing also deletes the analytics cookies.

Inside the application, Owneli records which parts of it a business’s team uses, to support the business and to improve the product. Each record is the screen as a pattern rather than an address (for example “a client’s page”, never which client), the feature it belongs to, the time, the team member, and whether it was a phone, tablet or computer. The rest is read from the activity log the application already keeps. It stays in Owneli’s own database, sets no cookie and is sent to no one else. Owneli support staff see it only as counts per feature and per day of use, to notice a business that has stopped using Owneli or is paying for a feature it does not use. Screen views are kept 90 days, each team member’s days of activity 13 months, and the daily totals per feature, which name no one, for as long as the business’s account exists.

The website and application also run error reporting: when a page or a request fails, a report goes to Sentry, as described under who else receives it. It carries the technical shape of the failure, not the form you were filling in, and it sets no cookie. The fonts and icons the pages use are served by the application itself rather than fetched from a third party. The exception is the brand-themed surfaces (a business’s own venue page, the client portal and shared care pages), which load two typefaces from Google Fonts, so Google sees the request for them and the address it came from. A business’s venue page also embeds a map from OpenStreetMap, which likewise sees the request for the map and its address. Directions links open Google Maps only when you choose to follow them. Where Google sign-in is offered, the sign-in page loads Google’s button from Google, and pages that take a card load Stripe’s payment form from Stripe; both see the request and the address it came from.

Conversion tracking is different, and it is worth being precise about it. It is an add-on an individual business switches on for its own booking and shop pages. Where it is on, you choose analytics and advertising separately before the corresponding tags load or server-side reports are sent. Google Analytics receives events only with analytics permission. Meta and Google Ads receive events only with advertising permission. The report to Google Analytics carries the booking’s value, what was booked and the random analytics identifier from your browser. The reports to Meta and Google Ads also carry a hashed form of your email address and phone number, and the one to Meta your IP address and browser string unhashed. The business decides to use this measurement and is responsible for it; Owneli does not use it for its own advertising. Inside the Owneli app only the business’s Google Analytics runs, as the section on the Owneli apps describes.

Advertising click identifiers and campaign tags are stored in your browser for up to thirty days only after advertising permission. Your choice is separate for Owneli and each business and expires after 180 days. We record the receipt identifier, business or site, categories, notice version, language, time and expiry. The server checks the current receipt before delivering queued conversions. Expired receipts are removed by the scheduled retention process. Withdrawal stops future tracking for the category, clears accessible optional cookies and reloads the page to stop scripts already loaded. If saving fails, tracking pauses on the page and we ask you to retry; the server cannot apply the withdrawal until it receives it.

The cookie policy at /cookies explains these choices in every language Owneli is offered in. Owneli’s consent controls cover the tracking it operates. A separate website embedding an Owneli widget remains responsible for its own scripts and consent controls. Data already delivered to a provider is not automatically recalled by changing cookie settings; contact the business or Owneli, as appropriate, to exercise your privacy rights.

SECTION 11

The Owneli apps

Owneli, for clients, and Owneli Business, for a business’s team, run on iPhone and Android. They hold the same records as the website, plus what a phone adds: notifications, the camera and the calendar.

The apps show the same records as the website, and the rest of this policy applies to them in the same way. This section covers what a phone adds.

• Notifications. If you turn notifications on, the app registers your phone with Apple’s push notification service on an iPhone, or Google’s Firebase Cloud Messaging on Android, and we keep the device token they issue, which app it belongs to and the sign-in it is attached to. Each notification passes through Apple or Google on its way to your phone, carrying its title and text, which can name a business, a client, a service and a time, and the screen it opens. Notifications go only to a phone that is still signed in. Turning notifications off in the app clears the token, and deleting your sign-in deletes it.
• Camera, photos and microphone. The apps use the camera or your photo library only when you choose to attach a photo or a document, and the microphone only when someone on a team dictates to Oryx in Owneli Business. Nothing is captured in the background. Dictation is transcribed and discarded, as the section on AI features describes.
• Add to calendar. On an iPhone, the visit is handed to the phone’s own calendar editor and nothing is sent to us. On Android, it opens Google Calendar with the visit filled in, so Google receives the details you choose to save. On the web, it downloads a calendar file.
• Sharing. The share button hands a link, such as a business’s page, a referral link or a gift card, to your phone’s share sheet. Sharing a visit shares the business’s page, never the link that can change or cancel the booking.
• Staying signed in. The apps keep your session in the app’s own storage on the phone.

The apps do not collect your location, your contacts, your browsing history or the other apps on your phone. They show no advertising, and they do not track you across other companies’ apps or websites.

Inside the Owneli app, a business’s booking pages can report to that business’s own Google Analytics, if it uses it and you allow analytics, which pages you viewed and the value of a booking you make, with advertising storage switched off. No Google Ads or Meta tag runs in either app, and a booking made in the app is never reported to Google Ads or Meta. Error reports from the apps follow the same rules as those from the website.

To delete your sign-in from inside an app, request account deletion from Account in the Owneli app, or from My profile in Owneli Business. The account deletion page linked at the end of this policy takes the same request without signing in.

SECTION 12

Signing in with Google

Where it is offered, you can sign in with your Google account instead of a password. Google tells us who you are; we cannot see into your Google account.

The staff sign-in page, the client portal and the Android apps offer “Continue with Google” where it is set up. The iPhone apps do not offer it.

When you use it, Google confirms your identity with a signed token that carries your Google account identifier, your email address and whether Google has verified it, your name and a link to your Google profile picture. Our sign-in provider keeps those details with your Owneli sign-in. We ask Google for nothing else: not your password, contacts, calendar, files or email, and we cannot post or act in your Google account. We use what Google sends only to sign you in and keep your account, never for advertising, and we do not sell it.

Signing in with Google cannot by itself make you a member of a business’s team: a business has to invite you first. In the client portal, it signs you in or creates your portal sign-in, and links it to your records by your verified email address, as described under what is held. If a sign-in with the same email address already exists, the Google identity is added to it.

Google knows you signed in to Owneli and handles that under its own privacy policy. On the web, the sign-in button is loaded from Google when the page opens, so Google receives that request even if you do not press the button. Deleting your Owneli sign-in removes the Google identity with it.

SECTION 13

Where it is processed

The database and the application are in the United States, and its providers operate internationally, while many of the businesses using it are in Canada.

Our database provider hosts the database, the sign-in service and file storage in Amazon Web Services’ northern Virginia region. The application runs in the hosting provider’s Washington, D.C. region, which means requests are served, and code executes, in the United States. Scheduled work such as reminder sending, billing and retention sweeps runs from the same place.

The providers named above operate internationally. Payment, messaging, email, push and AI providers each process data in their own regions, which are not all in one country, and app notifications travel through Apple’s and Google’s worldwide networks. Error reports are the exception we have pinned down: they go to Sentry’s European Union region, and the software refuses a reporting key from any other region unless the deployment explicitly accepts one.

If you are in Canada, this means your personal information may be stored and processed outside Canada, mainly in the United States. While it is there, it is protected by the safeguards in this policy and by our providers’ contractual commitments, and it may be accessible to the courts, law enforcement and national security authorities of that country under its laws.

SECTION 14

How it is protected

Separation between businesses, permissions per person rather than per job title, private storage for the sensitive material, and a plan for when something goes wrong.

• Every table enforces its own access rules in the database, so a query that escapes the application still cannot cross from one business to another.
• Permissions are granted per capability, not per job title. Contact details, financial figures, clinical fields and photographs are each their own permission, and a business gives them out deliberately.
• Photographs, signatures, documents, message attachments and import files live in private storage and are reachable only through short-lived signed links.
• Presentational images are deliberately not in that private storage: staff profile photos, business logos and branding, care page media, and product, service and venue images sit in public storage, because they are drawn on booking and shop pages that anyone can open without signing in. Anyone holding one of those links can open it until the image is replaced or removed. The file paths cannot be listed or browsed, so a link has to have been given to you. Nothing clinical is stored this way.
• Card numbers never reach us. Card entry happens in a payment form hosted by the payment provider, and we receive only a token, the brand, the last four digits and the expiry.
• Sensitive actions are written to an audit trail with the person, the time, the IP address and the browser, including reads of restricted records, which require a written reason.
• Traffic is encrypted in transit, responses carry a strict content security policy, and public endpoints are rate limited and protected against automated abuse.
• Webhook calls from payment and messaging providers are signature-verified and rejected if they cannot be verified.
• Operational logs redact credentials, tokens, cookies, email addresses, phone numbers and clinical fields to a short prefix, so a request can be traced without the log becoming a copy of the data. Error reports are put through the same list, more strictly, before they leave the browser or the server.

If a breach of security safeguards involving personal information creates a real risk of significant harm, we notify the people affected and the regulators the law requires (for example, the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or a state attorney general), as soon as feasible. Where the information belongs to a business’s records, we tell that business without undue delay so it can meet its own obligations. We keep a record of every breach, whether or not it had to be reported.

No system is beyond compromise, and a policy that promised otherwise would be worth nothing. What we can say is where the boundaries are and how they are enforced.

SECTION 15

When Owneli staff see a business’s data

Owneli’s team sees what it needs to run the service. Looking inside a business’s records takes the business’s own code, is read-only and is recorded, and never reaches clinical records.

A small number of Owneli staff run the platform and support the businesses on it, and they need two-factor authentication to reach the support tools. Outside a support session, they see account-level information: a business’s name, plan, billing and setup progress; its team members’ names, roles, email addresses and whether they can sign in; counts of how each feature is used; whether messages were delivered, with the recipient’s address masked and never the message itself; card payment disputes; and technical errors.

To help with a sign-in problem, they can look up a sign-in by name, email address or phone number, see which businesses it is linked to and its recent sign-in activity, and send a password reset, sign it out everywhere or lock it. After verifying the request, they can also reset its two-factor authentication or change its sign-in email.

To look inside a business’s records, for example to find out why its booking page shows the wrong times, Owneli support needs an access code that someone at the business generates in Settings and reads out. The code works once and expires after ten minutes. The session it opens:

• Is read-only, and ends by itself after thirty minutes.
• Shows no more than the person who generated the code can see.
• Never shows treatment charts, client photographs, client conversations, staff pay and HR details, incident reports or Oryx.
• Cannot download, export, change, charge or refund anything.
• Records every request it makes, and the business can see each session in its settings.

While a new business is being set up, and before its owner takes it over, Owneli staff can open a setup session to configure it: its settings, team, schedules, appointments, locations, services and online booking. A setup session ends after ninety minutes or as soon as the business leaves setup, and it is written to the business’s audit trail.

Outside these sessions, the support tools do not open a business’s client records. A few engineers can also reach the database directly, to keep the service running, restore it after a failure, or carry out an erasure a business has asked for.

SECTION 16

How long it is kept

Clinical records have a long, deliberate window. Most other retention is a setting the business controls.

Deleted information can remain in backups of the database for a limited period, until those backups expire. Backups exist only to recover the service after a failure.

The eight-year default for clinical records is not arbitrary. Guidance for aesthetic and cosmetic practice sets a minimum of eight years from the final appointment, and professional liability insurers often want longer. A business can set a longer period where its regulator or province requires one.

Records for a person treated under eighteen should be kept until their twenty-fifth birthday or eight years after the final appointment, whichever is later. The automatic sweep does not read a date of birth and so does not apply that rule, so a business treating minors needs to hold those records deliberately rather than rely on the default.

Sign-in sessions, booking funnel events, conversion reports, early access enquiries and requests for help moving data in are kept for as long as they are needed for security, accountability and legal purposes. They do not yet have an automatic deletion schedule, and you can ask us to delete any of them that concern you.

SECTION 17

Erasure, and why some records are restricted instead

A request to be forgotten is honoured by destroying what can be destroyed and withdrawing what cannot, not by pretending records never existed.

Some records cannot simply be deleted on request. A signed consent form is the evidence that a treatment was authorised. A patch test is the evidence an allergy was checked. Before-and-after photographs are frequently the only evidence in a liability claim, a claim the same person remains free to bring. Destroying those to honour an erasure request would destroy the business’s defence to it, and the law does not ask for that. It asks that the records stop being available for everyday purposes.

When a client record is erased, four different things are done to four different kinds of data:

A withdrawn record can still be produced when a legal claim genuinely requires it, through one route only: an administrator, with a written reason, and a high-priority audit entry written for every retrieval. The access log is the entire justification for keeping the records at all.

If you want your details erased from a business’s records, ask that business. It is their record and theirs to decide about; they action the request, and we carry out the part of it that happens in the database.

SECTION 18

Deleting your Owneli sign-in

You can request account deletion inside the app or without signing in. Owneli reviews requests before any removal. Deleting a personal sign-in, closing a business and archiving an employee are separate actions.

If you have a client portal sign-in: deleting it destroys the sign-in and every link it held, across every business at once. Your saved cards, any outstanding card-capture link and your notification devices go with it. A membership that was billing a saved card will need a new one.

What stays is each business’s own record of you: your appointment history, treatments, consent forms, receipts, gift cards, packages and memberships. That record is the business’s, not the sign-in’s. It carries balances it may be owed and treatments it must be able to account for, and it exists identically for the many clients who never created a sign-in at all. To have your personal details erased from it, ask the business; the section on erasure describes what happens then.

If you have a team sign-in: deleting it ends your access everywhere you used it, and clears your personal phone numbers, home address, emergency contact, date of birth, profile photo, saved signature, email signature, bank details and any private note held about you, in your profile and in each organisation’s copy of it.

What stays is your employment record: your name, job title, hire and end dates, employment type, hours, pay rate and role, your timesheets and commission, and which treatments you performed. Payroll, tax and clinical records have to name the person who did the work, and replacing that name with “deleted user” would falsify a clinical record rather than anonymise one.

Before a team sign-in can go, the business it leaves behind has to stay workable: an owner hands the owner seat to someone else first, the last remaining administrator cannot leave an organisation with nobody to administer it, and future appointments, an open clock-in and an open cash drawer have to be resolved so no client is left without a practitioner. Personal account deletion never closes an organisation automatically, even one with no other members; business closure requires a separate owner request and review.

Submitting a request does not remove access or delete data on its own. We aim to complete requests within 30 days, subject to applicable legal deadlines, explain any additional steps, and confirm completion. Completed deletion is permanent. We keep a review history and document any records retained to meet legal obligations.

SECTION 19

Your rights, and the mechanism for each

Rights are only real if there is a way to use them. Here is the actual route for each, and who to address it to. The sections that follow add what is specific to Canada and the United States.

To make a request to Owneli, email privacy@owneli.com or use the contact page. We confirm receipt, verify that the request comes from you (usually by asking you to confirm from the email address on the account), and answer within 30 days, or within the shorter or longer period your local law sets. If we need more time we tell you why. Making a request is free, and we will not treat you differently for exercising a privacy right.

We will help a business answer a request about its own clients, but we will not answer it over their head or against their instructions: that is what being a processor means. If you write to us about a business’s record of you, we tell you which business holds it and how to reach it, and with your permission we pass your request to that business and offer it our help. If you have asked a business and got nowhere, tell us and we will do what we can.

SECTION 20

If you are in Canada

Canadian privacy law is built on consent, accountability and openness. Here is how each of those shows up at Owneli, and what Quebec, Alberta, British Columbia and the provincial health privacy laws add.

Owneli handles personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply instead, the private-sector privacy laws of Quebec, Alberta and British Columbia. In practice that means:

• Accountability. Our Privacy Officer is responsible for our compliance and can be reached at privacy@owneli.com.
• Consent. We collect, use and disclose personal information with your knowledge and consent, which is express where the information is sensitive, as health information always is. You can withdraw consent at any time, subject to legal or contractual limits, and we will tell you what withdrawing means for the service.
• Limited collection and use. We collect only what the purposes in this policy need, and keep it only as long as those purposes, or the law, require.
• Access and correction. You can ask what we hold about you, how it has been used and to whom it has been disclosed, and have it corrected where it is wrong.
• Safeguards and breaches. We protect information with safeguards suited to its sensitivity, report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to the people affected, and keep a record of every breach for at least 24 months.

Quebec. Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, the person in charge of the protection of personal information at Owneli is our Privacy Officer, whose contact details are above. You may ask for the information we hold about you in a structured, commonly used technological format; ask to be informed when a decision about you is made exclusively by automated processing; and complain to the Commission d’accès à l’information du Québec. Confidentiality incidents that present a risk of serious injury are reported to the Commission and to the people affected, and every incident is recorded in a register.

Health information. Where a business you visit is a health information custodian under a provincial health privacy law, such as Ontario’s Personal Health Information Protection Act or Alberta’s Health Information Act, that business remains the custodian of your health record. Owneli acts only as its electronic service provider: we do not use or disclose that information except to provide the service to the custodian, and we do not allow anyone to access it except as the custodian directs and the law permits.

Commercial messages. Marketing email and texts sent through Owneli are commercial electronic messages under Canada’s Anti-Spam Legislation (CASL). Each one identifies the business that sent it, includes a way to contact it and a working unsubscribe, and an unsubscribe takes effect immediately, well within the ten business days the law allows.

Complaints. You can complain to us first, and we will investigate and answer. You can also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d’accès à l’information du Québec (cai.gouv.qc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), whichever covers you.

SECTION 21

If you are in the United States

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have rights under their state’s consumer privacy law. This section is our notice under those laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Where Owneli holds a business’s client records, we act as that business’s service provider or processor, and requests about those records go to the business. For the personal information we control ourselves (account holders, team sign-ins, visitors and enquiries), the categories we collect in the last twelve months are:

Sources and purposes are described under what is held and why it is processed. Retention periods are described under how long it is kept: in short, for as long as the account is active and afterwards for as long as legal, tax and accountability purposes require.

Your rights. Depending on your state, you may have the right to know what personal information we hold and how we use and disclose it, to get a copy of it in a portable format, to correct it, to delete it, and to opt out of sale, sharing, targeted advertising and significant profiling (none of which we do). Make a request as described under your rights. We verify requests by matching the details you give against our records, respond within 45 days (extendable once by a further 45 where the law allows), and never discriminate against you for exercising a right.

Authorised agents and appeals. You may use an authorised agent to make a request on your behalf; we will ask for proof that you gave the agent permission and may ask you to verify your identity with us directly. If we decline your request, you can appeal by replying to our decision or writing to privacy@owneli.com with the subject line “Privacy appeal”. We answer appeals within the period your state sets, and if you are not satisfied you may contact your state attorney general.

Consumer health data. Washington’s My Health My Data Act, Nevada’s consumer health data law and Connecticut’s privacy law protect information that identifies a person’s health status, including treatments and procedures. A medspa, clinic or wellness business that uses Owneli is the regulated entity for the health data in its records, and Owneli processes that data only on its instructions and to provide the service. Owneli does not sell consumer health data, does not use it for advertising, and does not use geofencing around places where health services are provided.

Text messages. We send text messages only with the consent the Telephone Consumer Protection Act requires, honour STOP and HELP as described under messages, and do not share mobile numbers or text-message consent with third parties for their marketing. Marketing email follows the CAN-SPAM Act: it identifies the sender, includes a physical address, and honours unsubscribes promptly.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes. Do Not Track. Owneli does not track visitors across other websites, so there is nothing for a browser’s Do Not Track signal to switch off.

SECTION 22

If you are elsewhere

Owneli is built for businesses in Canada and the United States. If you use it from the United Kingdom or the European Union, the same practices apply, with the legal bases and rights your law provides.

Where the General Data Protection Regulation or the UK GDPR applies to Owneli’s own processing, we rely on the performance of our contract with you to provide the service, on our legitimate interests in securing and improving it, on legal obligations such as tax and accounting, and on your consent for anything optional. You have the rights to access, correct, delete, restrict and port your data and to object to processing, which you can exercise as described under your rights, and you can complain to your local data protection authority.

Personal information transferred out of the United Kingdom or the European Union is protected by the safeguards the law requires, such as standard contractual clauses in our providers’ data processing terms.

SECTION 23

Children

Owneli is business software for adults. A business may treat a minor, and that record belongs to the business.

Owneli is not directed at children. We do not knowingly create accounts for, or collect personal information directly from, children under 13, or under 14 in Quebec, without the consent of a parent or guardian. A staff sign-in is for a person employed by a business; a portal sign-in is created by the person themselves. The Owneli apps are meant for adults.

A business may treat a minor with a parent’s or guardian’s consent, and record them as a client. That record is the business’s, obtained and held under its own consent process, and its longer retention rule is described under retention. If you believe a child has created a sign-in, tell us and we will remove it.

SECTION 24

Changes, and how to reach us

The date at the top of this page is the version. When the product changes in a way that changes this document, the document changes.

This policy describes behaviour that exists in the software today. When a feature changes what is held, where it goes, or how long it stays, this page is updated with it and the date at the top moves. A change that materially affects you will be announced by email or in the app before it takes effect, rather than slipped in.

If you booked with a business, contact that business first: it holds your record and it decides about it. The contact page carries their phone number, email and address when you reach it from their booking pages.

For Owneli itself, including the platform, your sign-in and anything on this page, contact our Privacy Officer, who is responsible for Owneli’s compliance with this policy and with privacy law: privacy@owneli.com. You can also reach us through the contact page.