Privacy Policy

1. About this policy

This policy explains how Mafazi Aesthetic Ltd., which operates MAFAZI Academy ("we", "us", "our"), collects, uses, shares and protects your personal information.

It applies to:

1. our main website, mafazi.academy;
2. our learning platform, mafaziacademy.net;
3. our emails; and
4. in-person hands-on training.

We follow Canada's federal privacy law for businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA), and other privacy laws that apply to us.

2. Who is responsible

Our Privacy Officer is responsible for how we handle personal information.

Privacy Officer: Shahram Mafazi, Mafazi Aesthetic Ltd., Canada. Email: privacy@mafazi.academy

3. What we collect

Information you give us

1. Contact and account details: your name, email address and password.
2. Professional details: your profession and, if applicable, your professional licence or registration number. The licence or registration number is optional. This allows physicians, nurses, dentists and other regulated healthcare professionals to add it, while international learners and other eligible learners without a Canadian registration number can still enrol.
3. Purchase details: what you bought, when, the price and tax paid, and your billing address.
4. Messages: what you send us by email or through our contact form.
5. Hands-on training details: proof of licence and insurance, if we ask for it, and attendance records.

Payment information

Our checkout, orders and subscriptions run on WooCommerce. Card payments are processed by Stripe, our payment processor. The payment and billing information needed to complete a transaction is sent securely to Stripe. We do not see or store your full card number. We receive limited information, such as the last four digits of the card, the card type and whether the payment worked.

Information created when you learn

On mafaziacademy.net we record:

1. which lessons you open and complete, and your progress;
2. your quiz answers, scores and attempts;
3. certificates issued to you; and
4. login dates and times.

Information collected automatically

When you visit our websites, we and our service providers collect:

1. your device and browser type, and your IP address;
2. pages you visit, how long you stay, and how you arrived; and
3. cookies (see section 8).

We use Google Analytics 4, only with your consent, to understand how visitors use our websites.

Patient information

Our learning platform is an educational platform. It does not store clinical patient charts, and we do not ask learners to give us patient information. During hands-on training, trainees may bring their own patient models. Any patient records created during treatment in hands-on training are kept by the host clinic, under the clinic's own privacy, health-record and professional obligations. They do not become part of your learning records. Learners must not record or share patient information.

4. Why we use your information

We use your information to:

1. create and run your account;
2. give you access to the courses and programs you bought;
3. process payments, renewals and refunds;
4. send you receipts, renewal reminders and important service messages;
5. check that you are eligible for a course;
6. record your progress, mark quizzes and issue certificates;
7. organise hands-on training sessions;
8. verify your certificates when you ask us to (see section 7);
9. answer your questions and complaints;
10. protect our content and stop account sharing, fraud and misuse;
11. improve our courses and websites;
12. send you marketing emails, only if you agree (see section 6); and
13. meet our legal, tax and accounting duties.

We only collect what we need for these purposes.

5. Your consent

We ask for your consent before we collect, use or share your personal information, unless the law allows otherwise.

1. Some consent is express, for example when you tick a box to receive our newsletter.
2. Some consent is implied, for example when you give us your email to buy a course, you expect us to use it to send your receipt.

You can withdraw your consent at any time, with reasonable notice, by emailing privacy@mafazi.academy. If you withdraw consent we need to provide a service (for example, access to your course), we may not be able to continue that service. We will explain this to you.

6. Marketing emails

We follow Canada's Anti-Spam Legislation (CASL).

1. We send marketing emails (such as news about new courses) only to people who have agreed, or where the law allows us to, for example to recent customers.
2. Every marketing email shows who we are, our mailing address and contact details, and has a simple unsubscribe link.
3. We process unsubscribe requests within 10 business days.
4. Unsubscribing from marketing does not stop service emails, such as receipts, renewal reminders or account messages.

7. Who we share information with

We do not sell your personal information.

We share it only when needed, with:

1. Service providers who help us run our business (listed below). They and their subprocessors may process only the information reasonably needed to provide their services to us, and must protect it.
2. Hands-on training supervisors and the host clinic, only the details needed to organise and run your session.
3. Professional advisers, such as our accountant or lawyer.
4. Authorities, when the law requires it.
5. A buyer or successor, if our business is sold or merged, under a confidentiality agreement.

Our current service providers are:

1. Website hosting: WPX Hosting
2. Website and content management: WordPress
3. Learning platform: Tutor LMS
4. Checkout, orders and subscriptions: WooCommerce
5. Payment processing: Stripe
6. Email and marketing communications: ActiveCampaign
7. Clinic booking, where applicable: Jane
8. Video meetings and live online sessions: Zoom
9. Website analytics, with your consent: Google Analytics 4

Certificate verification

We may confirm your course completion or the authenticity of your certificate to an employer, regulator, credentialing organisation or similar third party. We normally do this only at your request or with your consent. When you ask someone to verify your certificate, for example through our certificate check page, we treat this as your consent to share the minimum information needed. We share only: your name, the course completed, the completion date, and the certificate status and ID. We do not share grades, profile information or other personal information unless you specifically allow it, or the law requires or permits it.

8. Cookies and analytics

Cookies are small files saved in your browser. Our cookie banner lets you choose which cookies we use.

1. Necessary cookies, so you can log in and your account works. These cannot be turned off.
2. Analytics cookies from Google Analytics 4, to count visits and see which pages are useful. We use them only if you accept them in our cookie banner.

You can change your choice at any time from the "Cookie settings" link in our website footer, or block cookies in your browser. Learn more about how Google uses data: https://policies.google.com/technologies/partner-sites

We do not use advertising or remarketing tags at this time. This means no Meta Pixel, Google Ads remarketing or conversion tags, TikTok Pixel, LinkedIn Insight Tag or similar trackers. If we add any of them later, we will update this policy and our cookie banner before or when they are switched on, and use them only with your consent.

9. Where your information is stored

We use third-party service providers, so your personal information may be stored or processed in Canada, the United States and other countries where our service providers or their subprocessors operate. For example:

1. our website and learning platform host may keep data and backups in data centres in different locations;
2. Stripe may transfer information about Canadian users to data centres in the United States;
3. ActiveCampaign is based in the United States and processes information through its own infrastructure and subprocessors;
4. Zoom operates internationally and may store or process some data in the United States or other countries; and
5. Jane stores booking information in the data-centre region selected for the clinic, although some features may involve temporary processing outside Canada.

When your information is outside Canada, it is protected by our providers' contracts and security measures, but it may be accessed by courts, law enforcement or national security authorities of that country under its laws.

10. How we protect your information

We use reasonable safeguards to protect your information, including:

1. secure (encrypted) connections on our websites;
2. password-protected accounts and limited staff access; and
3. trusted service providers with their own security controls.

No system is perfectly secure. If a privacy breach creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

1. Learning records: for 7 years after your account is closed or after your last course activity, whichever is later. We may keep them longer if the law or an accreditation body requires it, if they are needed for an active dispute, investigation or legal obligation, or for another legitimate reason.
2. Certificate verification record: a minimal record (your name, course, completion date and certificate ID) may be kept longer, so we can keep confirming that your certificate was genuinely issued.
3. Purchase and tax records: at least 6 years, as required by Canadian tax law.
4. Marketing consent records: as long as needed to show we had consent.

When we no longer need information, we securely delete it or make it anonymous.

12. Your rights

You have the right to:

1. ask what personal information we hold about you and how we use it;
2. get a copy of it;
3. ask us to correct information that is wrong; and
4. withdraw your consent, as explained in section 5.

To make a request, email privacy@mafazi.academy. We will reply within 30 days. We may ask you to confirm your identity.

If you are not happy with our answer, you can contact the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca

13. Children

Our courses are for adult healthcare professionals. We do not knowingly collect information from anyone under 18.

14. Changes to this policy

We may update this policy. The "Last updated" date shows when it last changed. If we make an important change, we will tell you by email or on our website before it takes effect.

15. Contact

Mafazi Aesthetic Ltd. (MAFAZI Academy), Canada. Privacy Officer: Shahram Mafazi. Email: privacy@mafazi.academy

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there.