Privacy Policy
Last updated September 13, 2026.
Who is responsible
AuraForma is a founder-led beauty and wellness practice operating in the Lower Mainland, British Columbia. Questions about this policy, or requests about your information, go to privacy@auraforma.ca.
What we collect, and why each field is there
When you submit an enquiry we collect only what we need to answer you and arrange a session: Name — so we can address you properly. Email — to reply, and to send booking confirmations. Phone — because a class time is often faster to settle by text than by email. City or area — to tell you which of our three studios is nearest. What you're interested in — so the reply is about the right thing. What you'd like support with (optional) — to prepare for a first conversation. Preferred contact method — so we reach you the way you asked. Your message (optional) — whatever you choose to tell us. Your consent — recorded with the time you gave it. We also record which page the enquiry came from and any campaign parameters in the link, so we know which parts of the site are useful. We do not collect this to build a profile of you.
Registering for classes
Before a first class we ask you to complete one form at auraforma.ca/register. It registers you, records an emergency contact, asks a short set of health questions, and carries the agreement we both sign. It collects: your name, date of birth, email, phone and home address; the name, phone and relationship of an emergency contact; your yes/no answers to the health questions and anything you choose to add in your own words; and your signatures, each stored with the date, the time and the exact text you were shown. The address is there because this is a signed agreement and an agreement needs a party with an address. Your signatures are stored with the text you signed because a signature that cannot be tied to a document is not evidence of anything. Anyone under nineteen is registered by a parent or guardian, who completes and signs the form themselves. We then contact that guardian once, by phone, to confirm it really was them.
Health information, and who can see it
The registration form asks whether you have a heart condition, chest pain, dizziness or fainting, an injury or joint problem, prescribed medication for an ongoing condition, a long-term condition, or a pregnancy — and whether there is any other reason activity might not be safe for you. We ask because an instructor who does not know cannot keep you safe, and because British Columbia's fitness practice expects a documented screening before participation. We do not ask for diagnoses, prescriptions, medical records or clinical nutrition information, and we do not want them. Yes or no is enough. Only the founder can see these answers. They are stored separately from the rest of your record, every time they are opened that is written to a log, and they are never copied into our calendar or our spreadsheets and never used for marketing. AuraForma is not a medical provider, does not assess your health, and cannot give medical advice. This website is not for medical emergencies.
Nourishment Intensive
If you join the Nourishment Intensive, we collect the answers you give in its questionnaire, food log and weekly check-ins (your food rhythm, preferences, a few wellbeing ratings, and your height and — only if you choose — your weight), plus yes/no answers that tell us whether the programme is right for you. We use them only to build and adjust your plan. Daily check-ins happen in WhatsApp or Telegram, whose servers are outside Canada; we don't copy those messages or photos into our system, and they are deleted 30 days after your final review. Programme answers are deleted one year after your final review. If the programme turns out not to be right for you, your answers are deleted within a year and we keep only the fact that we referred you and refunded you; if you complete the programme, a short record that you were screened is kept for two years.
Who else handles your information
We use a small number of service providers, and your enquiry passes through them: Resend — delivers your enquiry to us by email. Its servers are outside Canada. Google — stores enquiries in a private spreadsheet we use to follow up. Google's servers are outside Canada. Hetzner — hosts this website and our database on a server in Helsinki, Finland, and keeps short-lived technical logs. Telegram — delivers short booking notices to Anastasia: your first name, what you booked and when. Never health information. Telegram's servers are outside Canada. If you pay online, one more is involved. Square takes the payment on its own page, so your full card number and security code go to Square and never reach us. Square sends us back a record of the payment — the amount, whether it went through, the card type, its expiry date and part of the card number — and we keep that record with your booking. For a monthly membership, Square keeps your card on file so it can take each month's payment; the full card number stays with Square. Square's servers are outside Canada. British Columbia's Personal Information Protection Act does not require your information to stay in Canada, but it does require us to tell you when it leaves and to remain responsible for it. That is what this section is for. We do not sell your information, and we do not share it for advertising.
Cookies, and what your browser keeps
This website sets no cookies for visitors. There is one cookie on the whole site, and it is set only when the founder signs in to the studio's own records: it keeps her signed in, and it is never set for anyone else. Your browser keeps one small note for us: that the opening animation on the home page has already played, so it does not replay every time you come back to that page. The note is deleted when you close the tab. We run no analytics or advertising tools, no tracking pixels and nothing from social networks. Fonts, images and the maps are served from our own server, so until you follow a link away from this site, your browser talks only to us. That is also why there is no cookie banner: there is nothing to ask your consent for. Like most websites, ours keeps a record of each request it answers: the page, the time, the page that linked to it, and the technical details your browser sends with every request, such as its type. Your internet address is shortened before it is written down, and these records are deleted after 14 days. We use them to see which pages are useful and to keep the site secure. If you pay online, you do so on Square's own checkout page. That page belongs to Square, and Square's cookies and privacy policy apply there.
How long we keep it
If you become a client, we keep your contact details and booking history for as long as you are with us and for two years afterwards, so we can answer questions about past bookings. If you enquire and do not go ahead, we keep the enquiry for twelve months and then delete it. Records we are required to keep for tax purposes are kept for the period the law requires, and nothing longer. A signed registration form is different, and we keep it longer: the agreement, the exact text you signed and the health answers that belong to it are kept for seven years after your last class. Where a parent or guardian signed for someone under nineteen, we keep them until that person turns nineteen and then for a further seven years, because until then the law does not start counting time against a claim of theirs. If you ask us to delete your information, we empty your record: your contact details, your address, your emergency contact, and anything you wrote about your health in your own words. What we keep is the agreement itself — that it was signed, when, which version of the text, its fingerprint, and the name you typed as your signature, because a signature without a name is not a signature. We keep that only while it could still be needed to defend a claim.
Your rights
You can ask us what information we hold about you, ask us to correct it, withdraw your consent to being contacted, or ask us to delete it. Write to privacy@auraforma.ca and we will respond within 30 days. Withdrawing consent does not undo anything already done with your information, and we may need to keep financial records even after you ask us to delete the rest — we will tell you if that applies.
Security
Enquiries and registration forms are sent over an encrypted connection and are readable only by the founder. Access to the follow-up spreadsheet is limited to the AuraForma account. Health answers live in their own place, reachable only by a signed-in founder, and every time one is opened we record who opened it and when. Sign-in is by emailed link, so there are no passwords to lose. No system is perfect, and we will tell you promptly if something happens that puts your information at real risk.
Contact
Questions about this policy can be sent to privacy@auraforma.ca.