Privacy Policy
Align & Flow Pilates Inc. ("Align & Flow Pilates," "we," "us," or "our") respects your privacy. This policy explains what personal information we collect through our studio, website (alignandflowpilates.com), and online booking system, why we collect it, how we use and protect it, and the choices and rights you have.
Effective date: September 29, 2026 · Last updated: October 2, 2026
Quick summary
We collect contact details from everyone who books, plus health-screening answers so we can teach you safely. Our forms ask you to confirm, with a separate checkbox, that you agree to us using those answers for that purpose. You need to tick it to book. We share information only with the instructor teaching you, our service providers and professional advisors, and as required by law; some of our service providers store data outside Canada. We do not sell your information. You can ask what we hold, request a correction, or contact our Privacy Officer any time (see "Your rights" below).
We are a Pilates studio, not a health information custodian under Ontario's Personal Health Information Protection Act (PHIPA). The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector businesses in Ontario handle personal information, and this policy reflects those requirements.
Who we are
Align & Flow Pilates Inc. operates a Pilates studio at 7300 Warden Ave, Unit 118, Markham, ON L3R 9Z6, Canada. You can reach us at info@alignandflowpilates.com, by mail at the address above, or at 365-789-2838.
Privacy Officer: Our Privacy Officer is Katherine, the studio's founder. She oversees how we handle personal information and is responsible for our compliance with this policy. You can reach her at info@alignandflowpilates.com, or by mail at the address above.
What we collect
We collect different information depending on how you interact with us:
• Booking Form. When you book a class, we collect your name, phone number, and email; your birthday and address; any medical conditions or preferences you choose to list in the free-text field; how you heard about us (for example Google, Instagram, a friend); your consent to our use of health information, via a separate checkbox (see "Consent" below); and your signature and date on the waiver.
• Pilates Training Consent Form. We collect the same contact details, birthday, and address as the Booking Form, plus detailed health-screening answers: injuries or pain areas; whether you are pregnant or postpartum; recent surgeries or medical treatment; diagnosed medical conditions; any advice you've received from a healthcare professional about exercise; and any other concerns you'd like to note. We also collect your consent to our use of that health information, via a separate checkbox, and your signature and date.
• Waitlist. If you join the waitlist for a full class, we collect your name, email, and phone number so we can tell you when a spot opens.
• Purchases & payments. When you buy a class pack, membership, or session through our website or in-studio point of sale, our payment processor, Wix Payments, collects your full card details. We separately receive your name, email, billing details, order history, remaining session/plan credits, and a limited payment summary such as card type and last four digits. We never write down or keep a full card number.
• Accounts. If you create a member login on our site, we collect your email, any saved addresses, and your booking and plan history. Your password is handled by Wix; we cannot see it.
• Careers applications. If you apply to teach or work with us, we collect the information described in "Job applicants" below.
• Contacting us. If you email us, call us, or message us on Instagram, we collect whatever information you choose to share, including any health details you mention to us that way.
• Website & cookies. Our site runs on Wix and uses Wix's own platform cookies for session management, security, and basic site performance/analytics. See "Cookies & analytics" below.
• Social media. Our embedded Instagram feed may set cookies from Instagram/Meta when it loads, and Instagram DMs are held by Meta.
• Other records. We keep client records in our Wix account. Any paper forms we use are stored securely at the studio (see "Safeguards" below).
We collect only what we reasonably need for the purposes below. We ask for your birthday to confirm whether you are 18 or older, because clients under 18 need a parent or guardian to complete and sign our forms (see "Children and minors" below). Your birthday and address also identify you on your signed waiver.
We use your information to:
• Schedule, confirm, and manage your bookings and waitlist spot, and send booking confirmations, reminders, and changes (these are transactional messages, not marketing);
• Screen for injuries and health considerations so our instructors can teach you safely;
• Keep a record of your signed waiver and health disclosures to meet our insurance requirements and to respond to legal claims;
• Process payments and manage your plan/session credits;
• Create and manage your member account;
• Respond to job applications and, if hired, manage the working relationship;
• Understand how people find us (the "how did you hear about us" question);
• Respond to your questions and messages; and
• If you've separately agreed, send you newsletters or promotional emails (see "Email marketing & CASL" below).
We do not use your health information for marketing.
Why we collect it (our purposes)
Consent
For routine information (your name, contact details, and how you heard about us), we rely on your implied consent when you book a class with us, for the booking-related purposes above.
Health information is sensitive, so we ask for it separately. The Booking Form and the Pilates Training Consent Form each include a separate, unticked checkbox (apart from the liability waiver acknowledgement) that reads: "I consent to Align & Flow Pilates collecting and using the health information I provide only to assess my safety in class and to share it with my instructor for that purpose." You need to tick this box to submit the form. We make it a condition of booking because we cannot teach you safely without knowing about injuries or conditions that affect how you move, and we use your answers only for that purpose. If you share health details with us or your instructor in person, by email, or by message, we use them only to keep you safe in class and to respond to you. We also keep a record of your health disclosures for as long as described in "How long we keep your information" below, to meet our insurance and legal record-keeping needs.
You may withdraw your consent at any time by contacting us, unless the law or a contract requires us to keep the information. If you withdraw consent for health-screening information, we may not be able to safely teach you without it. We may need to decline or limit your participation in certain classes until updated information is provided.
Please tell us or your instructor before class if anything in your health screening has changed (for example a new injury or pregnancy), so we can keep your record accurate and continue to teach you safely.
Who we share your information with
We do not sell your personal information. We share it only as follows:
• Independent instructors. Instructors are independent contractors, not employees. Instructors access client booking and health-screening information through their own Wix staff login, only as needed to teach their clients. Every instructor signs an Independent Contractor Agreement with a confidentiality clause: they must keep client and health information confidential, and use it only to provide instruction to their clients; this obligation continues after the agreement ends. Client records stay under the studio's control, not the instructor's.
• Service providers. We use Wix to run our website, bookings, payments, forms, member accounts, and email tools; Wix Payments to process transactions; and Namecheap Private Email for messages and form notifications. Wix and Namecheap process information on our behalf, under terms that require them to protect it and use it only to provide their services to us; payment processors may also keep transaction data to meet their own legal obligations. If you message us on Instagram, Meta handles that message under its own privacy policy, not on our behalf.
• Website support providers. From time to time, we may give a website developer or consultant limited access to our Wix dashboard, for example to build or maintain forms or pages. They may see form and booking data as part of that work, under confidentiality terms.
• Professional advisors and insurers. Our accountant, lawyers, and insurer, where needed for accounting, legal advice, or an insurance claim, under a duty of confidentiality.
• Legal requirements. We may disclose personal information if required by law, court order, or to protect the safety of our clients, staff, or the public.
Storage outside Canada
Our website and booking platform (Wix) may store and process personal information outside Canada. This can include the United States, Israel (where Wix.com Ltd. is based), and other countries where Wix and its service providers operate. Our email provider, Namecheap Private Email, is a US company and may also store information outside Canada. Instagram/Meta may do the same. This means your information may be accessible to courts, law enforcement, or national security authorities in those countries under their laws. We remain responsible for your information even when it is handled by our service providers.
How long we keep your information
We keep personal information only as long as needed for the purposes described above, and to meet our legal, tax, and insurance requirements. We then securely destroy or anonymize it. Our retention periods are:
• Signed waivers and health-screening or consent forms (adult clients): 7 years after your last visit or class.
• Signed waivers and health-screening or consent forms (clients who were under 18 when signed): until the later of the client's 28th birthday or 7 years after their last visit.
• Payment and billing records: 7 years from the end of the fiscal year the transaction relates to.
• Member login and profile information: while your account is active, plus about 2 years after it becomes inactive or is cancelled. Booking records that include a waiver, health form, or payment record are kept under those categories above, not deleted at the 2-year mark.
• Waitlist entries: about 1 year, or until you book a class, whichever comes first.
• Unsuccessful job applications: 1 year from the date of application.
• Successful applicants' hiring records (résumé and application materials): for the length of the engagement, plus 7 years after it ends, alongside the Independent Contractor Agreement records below.
• Engaged instructors' records (signed Independent Contractor Agreement, certification documents, and compensation history): for the length of the engagement, plus 7 years after it ends. The confidentiality obligation in the Agreement continues after the agreement ends.
• General emails and messages: about 1-2 years. If a message involves a health disclosure, an incident, a complaint, or a contract term, we keep it under that record's own category above instead.
We also keep a record of every confirmed breach of security safeguards (see "Breaches of security safeguards" below).
Safeguards
We take reasonable steps to protect your personal information against loss, theft, and unauthorized access, use, or disclosure. We rely on Wix's account security for hosting, storage, and payment processing.
We limit access to health and payment information on a need-to-know basis. In practice, that means: day to day, health information is available only to the owner and our instructors, each through their own Wix staff login, and instructors use it only for the clients they teach; payment information is available only to the owner. We protect our accounts with strong, unique passwords. Any paper forms are kept secured at the studio, in a space not open to the public, and are securely shredded once no longer needed.
Your rights
You have the right to:
• Ask what personal information we hold about you, how we've used it, and who we've shared it with;
• Request a copy of your information; and
• Ask us to correct information that is inaccurate or incomplete. If we disagree, we will note your objection on file. If we've already shared the incorrect information with others, such as your instructor, we will pass along the correction where appropriate.
In limited cases the law allows or requires us to refuse access (for example, information about another person, or information protected by legal privilege), and if so, we will explain why in writing.
Requests must be in writing (email or mail to the contact details above); we may ask you to confirm your identity. Access is free or at minimal cost. If a fee applies, we will give you an estimate first and proceed only with your agreement. We will respond within 30 calendar days. If we need more time, we may extend by up to 30 more days where the law allows, and will tell you in writing within the original period, explain why, and remind you of your right to complain to the Office of the Privacy Commissioner of Canada.
If you have a concern about how we handle your information, please contact our Privacy Officer first. We will look into every complaint, reply to you in writing, and fix our practices if needed. If you remain unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada (toll-free 1-800-282-1376; https://www.priv.gc.ca/en/report-a-concern/).
Email marketing & CASL
We separate transactional messages (booking confirmations, reminders, and changes) from marketing. We send marketing emails only to people who sign up, for example through our New Client Offer form, and only with your express consent under Canada's Anti-Spam Legislation (CASL). We build our recipient list only from people who have clearly agreed, not automatically from every Wix contact.
Every marketing email will identify Align & Flow Pilates Inc., our mailing address, and a phone number, email address, or website that remains valid for at least 60 days. It will also include a working unsubscribe link that takes effect without delay and no later than 10 business days.
Cookies & analytics
Our website, hosted on Wix, uses Wix's own platform cookies for things like keeping you logged in, site security, and basic traffic analytics. If you see our New Client Offer popup, the site saves a small note in your browser so the popup does not appear again for 30 days, or at all after you sign up. This note is not used for tracking. As of the effective date of this policy, we do not use third-party advertising or analytics trackers such as Google Analytics, Meta Pixel, or TikTok Pixel. If this changes, we will update this policy first. Our embedded Instagram feed may set its own cookies from Instagram/Meta when it loads.
Children and minors
If you are under 18, please have a parent or legal guardian contact us before booking, so we can arrange for the Booking Form and the Pilates Training Consent Form to be completed and signed on your behalf.
Photos & social media
We ask for your separate written consent before we post photos, videos, testimonials, or before-and-after images of you. You can withdraw that consent at any time, and we will promptly remove the posts we control.
Job applicants
If you apply to work or teach with us, our application form collects:
• your name, email, and phone number;
• your certifications and years of teaching experience;
• your availability;
• your résumé; and
• any message you include.
We use this only to evaluate your application.
We also maintain a separate instructor hiring form that asks for your city, the class types you teach, your days and times available, your desired hourly rate, whether you carry liability insurance, the equipment you're qualified on, a note about your teaching philosophy, and a website or social media link.
If we engage you as an instructor, our Independent Contractor Agreement also collects:
• your emergency contact details;
• your certification body, certification number, and expiry date, plus certification documents;
• your specializations and equipment qualifications;
• your payment method, billing cycle, and agreed rates; and
• your full legal name and signature.
This is so we can manage the contract and pay you. Our agreement form does not ask for your bank account details or Social Insurance Number. If we ever need payment or tax-reporting details (for example, for a T4A slip), we collect them separately and protect them like other sensitive records.
Confidentiality and retention for these records are described in "Who we share your information with" and "How long we keep your information" above.
We handle applicant and instructor information in accordance with PIPEDA to the extent it applies to our business.
Breaches of security safeguards
If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report it to the Office of the Privacy Commissioner of Canada as soon as feasible. We keep a record of every confirmed breach, regardless of severity, for at least 24 months.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. Before we make a material change that affects how we collect or use your information, we will post notice on our website in advance of the change taking effect, along with a brief summary of what changed. Where a change involves a new purpose for your information, we will ask for your consent. We will post the updated version with a new effective date.
Effective date: September 29, 2026
Last updated: October 2, 2026