Last updated: October 25, 2026
Who we are
Clinique Face MD, 3451 Saint-Jacques Street, Montréal, QC H4C 1H2. Phone: 514-447-9435.
This policy explains, in plain language, what personal information we collect, why, who we share it with, how long we keep it and how to exercise your rights. It complies with Québec's Act respecting the protection of personal information in the private sector (Law 25) and with our ethical obligations to the Collège des médecins du Québec.
Privacy officer
Dr. Sami Moubayed
Person in charge of the protection of personal information
Email: confidentialite@cliniquefacemd.com
Address: 3451 Saint-Jacques Street, Montréal, QC H4C 1H2
Contact him with any question, access request or complaint about your personal information.
What we collect and why
| Information | How | Why |
|---|---|---|
| Name, contact details, date of birth | When you book a discovery call or consultation, or write or call us | To schedule appointments and communicate with you |
| Medical record: history, clinical notes, consents, treatments | During consultations and treatments | To care for you safely and meet our legal obligations |
| Medical photos | Taken at the clinic, or sent by you for a virtual assessment | To assess, plan and follow your treatment |
| Payment information | At the clinic or at checkout | To bill our services |
| Browsing data: IP address, pages viewed, device, cookies | On our website, only if you accept them | To measure website traffic and the effectiveness of our ads |
We collect only the information needed for these purposes.
Booking a discovery call on our website
When you book a discovery call directly on our website, we ask for your title (Ms., Mr. or “I prefer not to say”, required by our appointment software to open a file), first name, last name, mobile number and email and, for a call about surgery, your preferred surgeon. This information is used only to schedule and confirm your call and to reach you at the scheduled time. It is sent directly to our appointment software, Zenoti, and is not kept by our website. If you already have a file with us, the call is added to it without changing your information. You give your consent by ticking the box on the form; you may withdraw it at any time by contacting us.
Thomas, our virtual assistant
Thomas is a virtual assistant (artificial intelligence), not a person. On a computer, you can chat with him on our website; on a mobile phone, the “Text Thomas” button opens a text message to our dedicated number. If you write to or call Thomas, he receives the content of the conversation and, if you provide them, your first name, last name, mobile number, email and the title required to open a file. This information is used only to answer your questions, to book, move or cancel your discovery call in Zenoti, or to ask our team to call you back. Thomas asks for your consent before booking. He never asks for medical information, your health insurance number or payment. The service is provided by Retell AI; on computers, Google reCAPTCHA protects the chat against bots. Thomas and reCAPTCHA load only after you make a choice in the cookie banner.
Published before-and-after photos
We publish a before-and-after photo on our website or social media only with your written consent, which is separate from your consent to treatment. Published photos never show your name or contact details. To make the gallery easier to search, a published case may be classified by skin tone, hair colour, eye colour and sex as seen in the photos. Ethnicity is shown only with your consent. You may withdraw your consent at any time, and we will remove the photos from our website as soon as possible.
Who we share it with
We never sell your personal information. We share it only with the providers we need in order to serve you. They are contractually bound to protect it and to use it only on our behalf:
- Zenoti: appointment booking, patient records and billing.
- RxPhoto: medical photos.
- Retell AI: Thomas virtual assistant (chat, text messages and calls), and Google reCAPTCHA for bot protection.
- Hosting of our website and its gallery of published photos (Vercel, and Supabase in Canada).
- Google (Analytics and Google Ads) and Meta (Facebook and Instagram): browsing statistics and ad measurement. Google Analytics and Google Ads only set cookies if you accept them; without your consent, Google receives only anonymous, cookieless signals (see below). Meta is only activated if you accept advertising cookies. These companies never receive your medical record or photos.
We may also disclose information when the law requires or allows it, for example to another health professional with your consent, or under a court order.
Information stored outside Québec
Some of our providers may store information outside Québec, including in the United States. Before entrusting information to them, we assess whether it will be adequately protected, and our agreements require them to apply equivalent safeguards.
Cookies and tracking tools
Our website uses:
- essential cookies, needed for the site to work (for example, your language choice);
- audience measurement cookies (Google Analytics);
- advertising cookies (Google Ads, Meta).
Measurement and advertising cookies stay off until you accept them in the banner shown on your first visit. You can change your choice at any time with the "Cookie preferences" link at the bottom of every page, or delete cookies in your browser settings.
Google consent mode: even if you refuse cookies, Google's tools may send anonymous signals with no cookies or advertising identifiers (for example, that a page was viewed or a booking link was clicked). These signals cannot recognize you from one visit to the next; Google uses them in aggregate to estimate traffic and ad effectiveness. IP addresses are processed by Google to deliver these signals and are not used to identify you.
How long we keep it
- Medical record, medical photos and consents: 10 years after your last appointment, then securely destroyed.
- Billing information: as long as tax laws require.
- Browsing data: the retention period set in Google Analytics and in our advertising tools.
How we protect it
Access is limited to team members who need it for their work. They are bound by confidentiality, and we train them in privacy protection. Our systems are password-protected, with two-factor authentication where available, and connections to our website are encrypted (HTTPS). No Internet transmission is 100% secure, however; please avoid sending medical information by regular email.
Confidentiality incidents
We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we promptly notify the people concerned and the Commission d'accès à l'information.
Your rights
You may:
- access your personal information and get a copy, including in a structured, commonly used technological format;
- have inaccurate or incomplete information corrected;
- withdraw your consent to a use or disclosure of your information;
- ask us to stop disseminating information about you, or to de-index any hyperlink attached to your name, where the law allows;
- find out what information we hold, who within the clinic can access it and how long we keep it.
Email confidentialite@cliniquefacemd.com. We reply within 30 days. We may ask you to confirm your identity.
Minors
Information about a person under 14 is collected only with the consent of the person having parental authority or the tutor.
Complaints
To make a complaint, write to the privacy officer. We will acknowledge it, review it and reply in writing within 30 days. If you are not satisfied with our answer, you may contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
Changes
We will post any significant change to this policy on this page, with its update date, and mention it on our website.