Privacy Policy
IziraFlow · Ontario Business Registry No. 1001635101
Last updated: October 10, 2026
IziraFlow ("IziraFlow", "we", "us" or "our") is a business registered in Ontario, Canada (Ontario Business Registry No. 1001635101). This Privacy Policy explains how we collect, use, share and protect personal information when you visit www.iziraflow.com (the "Site"), contact us, book an audit, or use our services. We serve healthcare clinics and fitness businesses in Canada, India and the United Arab Emirates, and we aim to handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario's Personal Health Information Protection Act (PHIPA) where it applies, Canada's Anti-Spam Legislation (CASL), India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
1. Who this policy covers
This policy applies to: • Visitors to our Site; • Prospects who contact us, fill in a form, book an audit or message us on WhatsApp, email or phone; • Clients (the clinics and fitness businesses we work with) and their staff. Our clients' patients, members and customers. When we build and run automations for a client, we may process personal information about that client's patients, members or customers (for example, a name, phone number and appointment time). In that case our client decides why and how that information is used, and we process it only on our client's behalf and instructions, under a written agreement. Section 8 explains how we handle that information. If you are a patient or member of one of our clients, please contact that business first about your information; we will help them respond.
2. Information we collect
Information you give us • Contact details: name, business name, business type, email, phone or WhatsApp number, city and country. • Details about your needs: what you want help with, and anything you choose to tell us in a form, call, email or message. • Booking details: the date and time you choose for an audit. • Calculator inputs: if you use our savings calculator, the numbers you enter. Information collected automatically • Device and usage data: IP address, approximate location (country), browser type, pages viewed, time on page and referring website. • Campaign data: if you arrive from an ad or link, the campaign tags in that link (for example, utm_source or utm_campaign ). • Cookies and similar technologies: see Section 6. Information from others • Advertising and social platforms (such as Meta, LinkedIn and Google) may share aggregated or limited information about how our ads perform. • Scheduling, messaging and email tools we use may record when messages are delivered, opened or answered. We do not ask website visitors for health information. Please do not include medical details about yourself or anyone else in our forms or messages.
3. How we use information
We use personal information to: 1. Respond to your enquiries and provide the free audit you request; 2. Schedule, confirm and remind you about meetings; 3. Prepare proposals and provide, maintain and support our services; 4. Send service messages and, where you have agreed, marketing messages; 5. Measure and improve our Site, ads and services; 6. Keep our Site and systems secure and prevent spam, fraud or misuse; 7. Meet legal, tax, accounting and regulatory obligations. We do not sell personal information, and we do not use our clients' patient or member data for our own marketing.
4. Consent
We collect, use and share personal information with your consent, except where the law allows or requires otherwise. You give consent, for example, when you submit a form, tick a consent box, book a meeting or accept cookies. You may withdraw consent at any time by contacting us (Section 15), by using the unsubscribe link in our emails, or by replying STOP to our text or WhatsApp messages. Withdrawing consent may limit what we can do for you, and we will explain this when you ask.
5. Communications (CASL)
We send commercial electronic messages only with your consent or where the law otherwise allows. Every marketing email includes our identity, contact details and an easy unsubscribe option. We process unsubscribe requests within 10 business days.
6. Cookies and analytics
We use: • Essential cookies, needed for the Site to work. Examples: remembering your region (Canada, India or UAE) and remembering your cookie choice. • Campaign cookies, which remember which ad or link brought you to the Site, for up to 30 days. • Analytics and advertising cookies, such as Google Analytics, the Meta Pixel and the LinkedIn Insight Tag. These help us understand Site use and measure our ads. Analytics and advertising cookies load only after you click "Accept" in our cookie banner. You can change your choice at any time by clearing cookies in your browser or by contacting us. You can also limit ad tracking through your browser, device and ad-platform settings.
7. Sharing information
We share personal information only as needed, with: • Service providers that help us run our business. These include website hosting, scheduling, automation, email, SMS and WhatsApp messaging, customer records, analytics, spam protection (for example, Cloudflare Turnstile) and payment processing. They may use the information only to provide services to us, and must protect it. • Advertising and analytics partners, limited to the cookie data described in Section 6 and only with your consent. • Professional advisers, such as lawyers and accountants, under a duty of confidentiality. • Authorities, when required by law or to protect rights, safety or property. • A buyer or successor, if our business is reorganised, sold or merged. Your information would remain protected by terms at least as protective as this policy.
8. Data we process for our clients
When we run automations for a clinic or fitness business: • They are in control. The client is responsible for its own patients' or members' information. In Ontario, a clinic may be a health information custodian under PHIPA. We act as the client's service provider, agent or processor, and follow its documented instructions. • Minimum data. We design workflows to use only what is needed, for example a name, contact details and appointment details. We avoid collecting clinical information. • No medical advice. Our automations do not provide medical, diagnostic or treatment advice. Conversations that need a professional are handed to the client's team. • Opt-outs are honoured. Patients and members can reply STOP to automated messages, and we pass opt-out requests to our client. • Confidentiality and security. Access is limited to people who need it. We use the safeguards described in Section 11. Return and deletion. When a client engagement ends, we return or delete client data as the agreement requires, unless the law requires us to keep it. • Breaches. We notify the client promptly if we become aware of a privacy breach affecting their data, so they can meet their own notification duties.
9. Where information is stored and transferred
We are based in Canada. Our service providers may store or process information in Canada, the United States, India, the UAE or other countries. Information processed outside your country may be accessible to authorities there under local law. We use contractual and technical safeguards so that it stays protected as described in this policy. Where a client contract or local law requires data to stay in a particular country, we will agree on that with the client in writing.
10. How long we keep information
We keep personal information only as long as needed for the purposes in this policy: • Prospect enquiries and audit bookings: up to 24 months after our last contact, unless you become a client. • Client records: for the length of the engagement, plus up to 7 years for legal, tax and accounting purposes. • Client-controlled data (patients and members): as instructed by the client and set out in our agreement. • Analytics data: according to the retention settings of the analytics tool, normally no more than 26 months. After that, we securely delete or anonymise the information.
11. Security
We use reasonable administrative, technical and physical safeguards suited to the sensitivity of the information. These include encrypted connections (HTTPS), access controls, secured webhooks and API keys, limited staff access, and reputable service providers. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards regularly. If a breach creates a real risk of significant harm, we will notify affected individuals and the relevant regulators as the law requires.
12. Your rights
Depending on where you live, you may have the right to: • access the personal information we hold about you; • correct inaccurate or incomplete information; • withdraw consent or object to certain uses, including marketing; • ask us to delete your information, subject to legal exceptions; • restrict processing or receive a copy of your information in a portable format (UAE); • nominate someone to exercise your rights if you die or become unable to (India); • complain to a regulator (Section 15). To make a request, contact us (Section 15). We may need to verify your identity. We aim to respond within 30 days. If your request concerns information we process for one of our clients, we will forward it to that client and help them respond.
13. Children
Our Site and services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 through our Site. If you believe a child has given us information, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. For significant changes, we will post a notice on the Site and, where appropriate, contact clients directly.
15. Contact us and complaints
Privacy Officer / Grievance Contact IziraFlow Toronto, Ontario, Canada Email: support@iziraflow.com Phone / WhatsApp: +1 (437) 580-5758 Please contact us first so we can try to resolve your concern. You also have the right to complain to the privacy regulator where you live: • Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca • Ontario (health information): Information and Privacy Commissioner of Ontario — www.ipc.on.ca India: Data Protection Board of India, once you have used our grievance process above UAE: UAE Data Office