Privacy Policy

London & Glow is a trade name of Sundeep Varma Professional Corporation.

The legal operator is Sundeep Varma Professional Corporation. It operates this website and London & Glow at Unit 240, Circle Square, 11808 St. Albert Trail NW, Edmonton, AB T5L 4G4. The Privacy Officer for Sundeep Varma Professional Corporation is responsible for general privacy compliance and can be contacted at hello@londonandglow.ca.

General business information—such as a general enquiry, booking correspondence or customer-service request—is handled principally under Alberta’s private-sector Personal Information Protection Act (PIPA).

Individually identifying health information collected by Dr Varma as part of his medical practice is handled under Alberta’s Health Information Act (HIA) and applicable professional requirements. Health information is collected through the secured clinic workflow or directly during care, not through the public contact form.

Hemel Mandalia provides non-prescription aesthetic skincare consultations and suitable hands-on skin treatments. General enquiries and business records relating to those non-medical services are not presented as physician medical records.

Medical menopause assessment and HRT provided through Capilano Medical Centre & Walk-in are separate from London & Glow, with separate booking, records, fees and privacy responsibilities.

• Public contact form: name, email address, optional telephone number, general message and limited security/request data.
• Newsletter: email address, dated subscription and confirmation evidence, unsubscribe preferences and limited submission-security data. Newsletter signup does not create a waiting-list entry or patient record.
• Opening waiting list: first and last name, email address, optional telephone number, separate email/SMS marketing choices, dated consent evidence and limited submission-security data.
• Booking and clinic workflow: details needed to request and manage an appointment, plus information specifically collected for assessment, consent, treatment, payment and follow-up.
• Clinical photographs: before-and-after or progress images collected for care, documentation or an additional use that you have separately authorized.
• Payments: transaction amount, status, method and payment-provider reference. Stripe handles complete card numbers and card verification codes.
• Website operation: standard request data such as IP address, browser or device information, requested page, security signals and consent choices.

We collect, use and disclose information with consent or where permitted or required by applicable law. We limit it to what is reasonable for the identified purpose.

• responding to general enquiries and customer-service requests;
• contacting people on the opening waiting list when bookings become available;
• sending clinic news, treatment information and offers by email or SMS only where the person separately chose that marketing channel;
• requesting, arranging and administering appointments;
• assessing suitability, obtaining informed consent, providing care and maintaining required records;
• documenting a clinical baseline and treatment progress, and using photographs for education or promotion only with the applicable separate consent;
• processing deposits, payments, refunds and financial records;
• protecting the website and clinic systems, preventing abuse and investigating incidents;
• meeting legal, regulatory and professional obligations.

Email and SMS marketing choices are optional and initially unchecked. Declining them does not affect waiting-list signup. Providing an email address or phone number alone does not authorize marketing. We record each choice, date, source and the wording shown. Existing waiting-list entries are not automatically opted in. SMS updates await business messaging readiness. You can withdraw either channel at any time by emailing hello@londonandglow.ca; marketing emails also include an unsubscribe link. Repeat waiting-list signup preserves existing preferences and withdrawals.

You may withdraw consent for future optional uses, subject to legal, professional or contractual limits. Withdrawal does not undo a lawful earlier use and may limit a service that depends on the information.

Consent to promotional use of a photograph is voluntary and is not a condition of receiving care. You may ask us to stop future promotional use, although we may not be able to recall material already lawfully published or distributed.

Strictly necessary storage may be used to deliver and protect the website, preserve security and remember a privacy choice. Optional Google Analytics measurement remains off unless you choose “Accept analytics.” Advertising storage, advertising user data and advertising personalization remain off.

Consent-controlled measurement is limited to approved website events and campaign fields. IP anonymization is enabled. Google Analytics must not receive names, email addresses, telephone numbers, form content, appointment details, treatment selections, patient identifiers or other free text. London & Glow does not use a Meta Pixel or Conversions API at launch. Marketing emails may measure opens and link clicks to help us understand which updates are useful. Sender receives subscribed email addresses and subscription status; clinical records are not shared with Sender.

We use service providers only for defined operational purposes. Material categories include website hosting and delivery (Cloudflare), consent-controlled website analytics (Google Analytics), location maps (Google Maps), general-enquiry and waiting-list acknowledgement delivery (Resend and the monitored staff mailbox), opted-in newsletter and marketing-email delivery and reporting (Sender), security and abuse prevention (Upstash rate limiting), secured clinic infrastructure (Supabase), and payments (Stripe). Twilio is intended for future business messaging; SMS sending remains disabled pending readiness checks.

The Google Maps frame is loaded lazily. A request to Google occurs when a visitor reaches a map section, and Google may receive standard request data such as the visitor's IP address and browser information.

Some providers may process personal information outside Canada, including in the United States, to provide hosting, security, communications, clinic-system or payment services. Information processed elsewhere may be accessible under the laws of that jurisdiction. Contact the Privacy Officer to ask about current provider locations, purposes or policies.

Before real patient information is handled through a new or materially changed system, the applicable privacy impact assessment, information-manager or vendor agreement, region, access and deletion evidence must be completed and recorded.

We use proportionate administrative, technical and physical safeguards, including role-based access, secure transport, access-controlled systems, staff responsibilities, provider review and secure disposal processes. We do not publish security configuration that could weaken those safeguards.

No system can be guaranteed completely secure. Suspected loss, unauthorized access or disclosure is assessed, contained, documented and reported to affected people and regulators when required by law.

• General unanswered enquiries: no longer than 12 months.
• Opening waiting-list details: until the person has been contacted after bookings open and for no longer than 12 months afterwards, unless they ask for earlier removal or another lawful requirement applies.
• Customer-service and booking correspondence: for the documented operational and legal period that applies to the record.
• Financial and tax records: seven years, unless professional advice requires a longer period.
• Optional marketing: contact details and consent evidence while that purpose remains authorized and needed. After withdrawal, we retain minimal consent/withdrawal evidence and suppression information needed to honour the request and meet applicable obligations. Removing a waiting-list entry does not remove the suppression record or recall delivered email. Provider and mailbox copies are addressed separately in the removal workflow.
• Medical records: at least 10 years after the last record entry for an adult; for a minor, 10 years after the last record entry or two years after the patient reaches or would have reached 18, whichever is longer.
• Shared abuse-control records: short-lived and limited to the rate-limiting purpose.

When information is no longer required, it is securely deleted, destroyed or made non-identifying as appropriate.

You may ask for access to or correction of your personal information, withdraw eligible consent, or raise a concern. Different procedures and lawful exceptions may apply to general business information and health information.

Start by emailing hello@londonandglow.ca with “Privacy request” in the subject. Do not attach clinical records to ordinary email. If a concern is not resolved, you may contact the Office of the Information and Privacy Commissioner of Alberta.

Ordinary email, including ordinary Gmail, is for general administrative communication only. Clinical information must use the secured clinic workflow or another method specifically arranged by the responsible practitioner.

We may update this policy as services, providers or legal requirements change. The date at the top identifies the published version.