Privacy Policy
Soul Wellness Clinic respects your privacy. This policy explains how we handle personal information collected through our public website, contact form, and secure client portal.
Information we collect
- Contact details and information you choose to submit when requesting information or portal access.
- Appointment, intake, billing, and care-related information provided through the secure portal or directly to the clinic.
- Limited first-party public-page and section usage, active seconds, navigation, and website contact-success counts, classified as Google Ads, organic search, referral, direct, or unknown. Measurement is on for new visitors unless opted out. Hosting providers also process technical request information to operate and secure their services.
How we use information
We use information to respond to inquiries, manage approved client access, schedule and administer appointments, provide requested clinic services, maintain records, process authorized communications, protect our systems, and meet applicable legal and operational requirements.
Client portal and health information
The public website is not intended for detailed or urgent health information. Approved clients should use the secure portal or contact the clinic through an appropriate channel. Portal registration does not grant access until the clinic approves and links the account to the correct client record.
Service providers
We use carefully selected service providers for hosting, authentication, secure data storage, communications, analytics, and website operations. They may process only the information needed to provide those services and are subject to contractual or platform safeguards.
Security and retention
We use administrative, technical, and organizational safeguards appropriate to the information involved. No online system can be guaranteed completely secure. We retain information only as long as reasonably necessary for care, operations, legal obligations, dispute resolution, and security.
Your choices
You may request access to or correction of your personal information, withdraw consent where applicable, or ask a privacy question by emailing info@soulwellnessclinic.com. Some records may need to be retained where required or permitted by law.
Cookies and analytics
Limited first-party public-site measurement is on by default for new visitors. A previous rejection or withdrawal remains off, including after its original expiry, until you explicitly enable measurement here. Google Analytics, Google Ads, and Google Tag Manager do not load on our public pages; fonts are served by this website. Use Privacy choices below to opt out or enable measurement. No popup appears and a new visitor is not recorded as having accepted consent. Preferences are stored in this browser; clearing browser storage removes them. If preference storage cannot be read, measurement stays off. Your choice does not prevent contact or booking.
Measurement sends fixed public-page and section codes, navigation and contact-link click counts, active seconds, a broad source category, and website contact successes only after the form service confirms successful storage. The private report maps those codes to public pages and sections, including educational health topics; codes are not a claim that page interests cannot be inferred. No page addresses, query strings, referrers, health titles, form answers, typing, names, ad click IDs, or visitor identifiers are included in measurement payloads. Active seconds estimate visible time until 30 seconds without interaction, with one section at the viewport centre; they do not measure reading or attention. Source is classified locally. A nonunique tab source flag expires after 30 minutes without interaction; the source is preserved across pages in that tab during the window. A new explicit campaign or external referral replaces it; a non-Google paid campaign is reported as unknown rather than Google Ads. Raw campaign parameters are not stored by this feature. Daily aggregates use our first-party reporting service on Google Cloud infrastructure in the United States, separately from leads and patient records, with 30-day reporting retention and asynchronous deletion. Counts are not unique visitors or identified journeys. Infrastructure may process or retain IP addresses and other technical request metadata under its operational policies; these are not included in our aggregate records. Opting out stops new collection and clears the tab source flag, but cannot remove an individual contribution from existing aggregates. Authenticated portal activity remains excluded. The separate, limited new-registration measurement described below is not a public-site event. Link clicks are not completed bookings or registrations, and these first-party reports do not send conversions to Google Ads.
For a new portal access request, we may transfer a broad, client-asserted source category (Google Ads, organic, referral, direct or unknown) in a URL fragment that expires within ten minutes. The neutral Client Login choice removes it and holds it briefly in memory only for the New client link; it is never forwarded to existing-client sign-in, booking or account pages, and visiting that choice page is not counted. The registration page removes the fragment and sends only its source and expiry beside your request to our first-party registration endpoint. Browser opt-outs stop this transfer without blocking registration; choices on separate website origins are not automatically synchronized. This is not an additional consent acceptance and does not change consent for clinical records.
Only the first durably stored clinic registration/access request can increment a private UTC-day/source count. Sources are not verified ad clicks; counts are not unique people, approvals, verified emails or bookings. Aggregates contain no patient identifiers, event rows, exact registration times, campaign details, click IDs or health interests, and are separate from operational patient and notification records. There is no registration export to Google Ads, GA4 or GTM. Firebase/Google Cloud provide infrastructure: the clinic database is in Canada and the application runtime is in the United States. Reporting excludes buckets after 30 days; buckets carry a day-based expiry, but automatic deletion is not yet enabled. Operational logs and backups have separate retention and may retain technical metadata. Existing aggregate contributions cannot be individually removed through opt-out.
When you submit the contact form, its fields are sent to our existing lead-processing service so we can respond. Opening an external booking or client-portal link takes you to that service, whose privacy practices apply. No analytics or advertising consent is required to use these functions.
Updates
We may update this policy as our services or legal requirements change. The effective date above identifies the current version.