Privacy Policy

Last updated: September 16, 2026 · Version 1 for Canada

This policy explains what information the Ilan platform handles, how we protect it and what your rights are. Ilan is operated by Ilan Studio, LLC (Delaware, United States). It’s written for businesses in Canada and for their clients, with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) in mind — and written to be read, without fine print.

1. Two kinds of information, two different roles

• Information about the Business that subscribes to Ilan (account, contact details, billing): Ilan is responsible for it.
• Information the Business enters about its clients — appointments, client records, photos, consent forms, balances. This information belongs to the Business, which is accountable for it under PIPEDA. Ilan processes it only on the Business’s behalf and on its instructions, as its service provider. The Business is responsible for telling its clients how their information is used and for obtaining any consent required.

2. What we handle

• Account: business name, email, phone, logo and settings, and the names and emails of the staff who use the Service.
• The Business’s operations: appointments, clients and their records (which may include health-related information such as contraindications, skin type, treatment notes or photos), consent forms, memberships, payments recorded, balances and inventory.
• Subscription billing: handled by Stripe. Ilan doesn’t store card numbers.
• Website contact form: if you write to us through ilan.studio, we receive what you type (name, business, email or phone and your answers) and use it only to reply to you.
• Technical data: access and usage logs needed to run and protect the Service. On ilan.studio your language choice is saved in your browser; we don’t use advertising or analytics cookies on the website.

3. How we use it

• To provide the Service: booking, client records, payments, inventory and reports.
• To send the confirmations and notifications the Business turns on, on the Business’s behalf.
• To process the Business’s subscription (Stripe).
• For artificial intelligence features the Business chooses to use (for example, a skin assessment from a photo or dictated notes): the content is sent to our AI provider only to produce the result requested, and it isn’t used to train AI models.
• For security, support and improving the Service.

We never sell personal information — not the Business’s, and not its clients’.

4. Service providers we rely on

We use established infrastructure providers, each only for its own function, under contracts that require them to protect the information:

5. Where information is processed

Information in the Service is stored and processed outside Canada, mainly in the United States, and may also be processed in other countries where our providers operate. While it’s there, it may be accessible to courts, law enforcement and national security authorities under the laws of those countries. PIPEDA allows this kind of processing as long as the information stays protected by contract and people are told about it; section 10 has a notice businesses can give their clients.

6. How we protect it

• Encryption in transit (HTTPS/TLS) across the Service, and encryption at rest by our database provider.
• Separation between businesses: each Business can only reach its own data, enforced at the database level (row-level security).
• Credentials and keys handled as secrets, and internal access limited to what’s needed.
• Staff permissions inside each Business, so the owner decides who sees what.

7. If there’s a breach

If we become aware of a breach of security safeguards involving a Business’s client information, we’ll tell that Business without undue delay and share what we know, so it can decide whether there’s a real risk of significant harm and, if so, report it to the Office of the Privacy Commissioner of Canada and notify the people affected. We keep a record of every breach of security safeguards involving personal information for at least 24 months.

8. How long we keep it

For as long as the Business’s account is active (or suspended for a pending payment). If the account is cancelled, the Business can ask for an export of its data within the following 30 days; after that we may delete it permanently, except for what the law requires us to keep. A Business may have its own legal duty to keep client records for longer (for example, Ontario’s rules for personal service settings), so it should export what it needs before closing its account.

9. Your rights

If you’re a Business: you can access, correct, export or delete your information by writing to soporte@ilan.studio. We answer within 30 days.

If you’re a client of a business that uses Ilan: your information is controlled by that business, so contact it first to access or correct your information; we’ll help it respond. You can also write to us at soporte@ilan.studio. If you’re not satisfied with how your concern was handled, you can contact the Office of the Privacy Commissioner of Canada.

10. For businesses: a notice for your clients

Because your clients’ information is processed outside Canada, PIPEDA guidance says you should tell them when you collect it. You can use or adapt this text — for example, on your intake form, at the front desk or in your booking confirmations:

11. Changes to this policy

If we change this policy significantly, we’ll let Businesses know in the Service or by email reasonably in advance.

12. Contact

Questions about privacy, or requests about your information: Ilan Studio, LLC · soporte@ilan.studio. The person responsible for privacy at Ilan answers these messages.