KX Privacy Policy

KX Yorkville, operated by KX Health Inc. (“KX,” “we,” “our,” or “us”) recognizes the importance of protecting personal information. This Privacy Policy sets out how KX collects, uses, discloses, and safeguards personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial legislation including the Personal Health Information Protection Act, 2004 (Ontario) (PHIPA) where health-related information is concerned, and Canada’s Anti-Spam Legislation (CASL). For personal health information, KX Health Inc. is the health information custodian under PHIPA. KX Health Inc.’s Privacy Officer can be reached at info@kxhealth.ca.

This Privacy Policy explains what information we collect, how we use and share it (including with AI-Assisted Tools, see section 5A), and your choices and rights. Section 4 explains when we rely on your implied consent and when we ask for your express consent.

1. Definitions

“Personal Information” means information about an identifiable individual, including but not limited to name, address, telephone number, email address, billing information, health information, and any other data defined under PIPEDA or PHIPA.
“Personal Health Information” means identifying information about an individual relating to physical or mental health, healthcare services provided, or payment for healthcare, as defined under PHIPA.
“Processing” means any operation performed on personal information, including collection, use, disclosure, storage, and destruction.
“AI-Assisted Tools” means software that uses artificial intelligence, including large language models, that KX uses to help its team analyse information, draft documents and carry out administrative tasks.
“Service Provider” means an organization that stores or processes information on KX’s behalf, as KX’s agent or electronic service provider under PHIPA.

2. Collection of Personal Information

We collect personal information only as reasonably necessary for the purposes identified in this Privacy Policy or as otherwise permitted or required by law. Information collected may include:

Identification and contact information (e.g., name, address, email, phone number).
Health and wellness information necessary to deliver therapy, exercise, assessment, bloodwork, hyperbaric oxygen or IV nutrition services, including Health Assessment answers, assessment and test results, session and attendance history, programs and practitioner notes.
Financial and payment information, including credit card details, for billing purposes.
Technical information collected through our website, including IP addresses, browser type, and cookies.
Marketing and communication preferences, including SMS and email consent.

We will limit collection to what is reasonably required to fulfill the identified purposes.

3. Use of Personal Information

We use personal information strictly for the following purposes:

To provide, administer, and improve our services.
To analyse information and prepare programs, progress reports and administrative documents with the help of AI-Assisted Tools, as described in section 5A.
To manage bookings, payments, and client accounts.
To communicate with clients regarding appointments, programs, invoices, and updates.
To send marketing and promotional communications where consent has been obtained, in compliance with CASL.
To ensure the safety, security, and lawful operation of our facility.
To meet legal, regulatory, and professional obligations.

We will not use personal information for purposes other than those for which it was collected, except with consent or as required by law.

4. Consent and Marketing Communications

Consent may be express or implied, depending on the circumstances, the sensitivity of the information, and legal requirements.
When you give us your health information to receive care, we rely on your implied consent to collect and use it, and to share it within KX and with our Service Providers, for that care, as PHIPA permits. We ask for your express consent before we disclose your personal health information to anyone else outside KX, except where the law permits or requires disclosure, and before we feature you in an identifiable case study (section 5B). You can withdraw or limit your consent at any time, going forward (section 8).
Where required by law (e.g., for commercial electronic messages), we will obtain express consent.

SMS and Email Communications:

By opting in, you consent to receive recurring promotional and personalized messages from KX Yorkville.
Message frequency varies. Standard message and data rates may apply.
Reply STOP to cancel SMS communications, or click the unsubscribe link to withdraw email consent.
Consent for marketing is not a condition of service.

5. Disclosure of Personal Information

KX does not sell, rent, or trade personal information. Disclosure will occur only as reasonably necessary for the purposes described above, and only under appropriate confidentiality safeguards. We may disclose personal information:

To Service Providers that perform services on our behalf (e.g., payment processors, IT and cloud providers, scheduling and charting systems, form and e-signature tools, laboratories, marketing platforms and AI-Assisted Tool providers). We share only what each provider needs to provide its service.
To healthcare providers or contractors, where coordination of care requires disclosure, and only with client consent.
To legal or regulatory authorities where required by law, court order, or lawful request.

5A. Use of AI Tools

5A.1 Why we use them. We may use AI-Assisted Tools to help our practitioners and staff draft and summarise notes, draft and update your Program and progress reports, and handle scheduling, reminders and other administration.

5A.2 What information. Depending on the task, this may include: Health Assessment answers; assessment and test results; session and attendance history; your Program; practitioner note excerpts; bloodwork reports; and contact details needed for scheduling. We aim to use only the information the task needs.

5A.3 Human role. AI-Assisted Tools support, and do not replace, our practitioners and staff. AI-Assisted Tools can make mistakes; please tell us if anything looks wrong.

5A.4 Our providers and where data is stored. Our AI-Assisted Tool providers are software companies that provide AI services to KX. You can ask the Privacy Officer which providers we currently use. Some of our Service Providers, including AI-Assisted Tool providers, may store or process information outside Canada, including in the United States. Information stored outside Canada may be subject to the laws of those countries, including lawful access by their authorities.

5A.5 Retention. KX’s own records are kept as described in section 7.

5A.6 How to opt out. AI-Assisted Tools are part of how KX currently delivers and administers its services. You may ask us at any time not to use AI-Assisted Tools with your identifiable personal health information by emailing the Privacy Officer, KX Health Inc., at info@kxhealth.ca. We will flag your file within 2 business days, confirm to you in writing, and prepare your Program without AI-Assisted Tools from then on. It does not undo processing already done.

5A.7 Complaints. You may complain about our use of AI-Assisted Tools to the Privacy Officer or to the Information and Privacy Commissioner of Ontario (section 11).

5B. Case studies

We use de-identified information by default. We will feature a client’s identifiable story only if that client signs a separate opt-in form naming the case study, what is shared and where, and that they may withdraw.

6. Safeguards and Security

KX implements physical, administrative, and technological safeguards appropriate to the sensitivity of the information to protect against unauthorized access, disclosure, or misuse. These include:

Encrypted payment processing compliant with PCI-DSS standards.
Secure servers, firewalls, and access controls.
Staff training on privacy, confidentiality, and PHIPA/PIPEDA obligations.
Restricted access to personal health information on a “need-to-know” basis.

7. Retention and Destruction

We retain personal information only as long as necessary to fulfill the identified purposes or as required by law. When no longer required, information will be securely destroyed or anonymized. Retention of personal health information will comply with professional recordkeeping obligations under Ontario law.

8. Individual Rights

Subject to limited exceptions under law, individuals have the right to:

Request access to their personal information. We respond to access and correction requests within 30 days, or tell you in writing if we need up to 30 more days, as PHIPA allows.
Request correction of inaccurate or incomplete information.
Withdraw consent to the use of personal information, subject to contractual and legal restrictions.
Ask us not to use AI-Assisted Tools with their identifiable personal health information (section 5A).
Ask us to delete information we are not required to keep. Health records we must keep by law or professional standards cannot be deleted before the retention period in section 7 ends.

Requests must be made in writing to our privacy contact (section 11). If we refuse a request, we will tell you why and that you may complain to the Information and Privacy Commissioner of Ontario.

8A. Privacy breaches

If your personal health information is stolen, lost, or used or disclosed without authority, including by a Service Provider, we will notify you at the first reasonable opportunity and tell you that you may complain to the Information and Privacy Commissioner of Ontario.

9. Cookies and Online Tracking

Our website uses cookies and similar technologies to improve functionality, analyze traffic, and personalize content. Users may disable cookies in their browser settings, but this may affect website performance.

10. Third-Party Links

This Privacy Policy does not apply to third-party websites linked from our website. We are not responsible for their privacy practices.

11. Privacy Inquiries

All inquiries, complaints, or requests relating to this Privacy Policy, including a request not to use AI-Assisted Tools, should be directed to the Privacy Officer, KX Health Inc., info@kxhealth.ca, 263 Davenport Road, Toronto, ON M5R 1J9, (416) 926-9757.

We will respond to all privacy inquiries in accordance with applicable legislation. You may also complain to the Information and Privacy Commissioner of Ontario, 2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8; 416-326-3333 (Toronto area), 1-800-387-0073 (long distance), TDD/TTY 416-325-7539; https://www.ipc.on.ca/en/about-us/contact-us.

12. Updates to this Privacy Policy

We reserve the right to amend this Privacy Policy to ensure compliance with applicable laws or when our practices change. Updates will be posted to our website with a revised effective date. Where a change requires your consent, we will ask for it.

KX Yorkville

263 Davenport Road, Toronto, Ontario, M5R 1J9 416 926 9757

info@kxhealth.ca

This document was last updated on November 9, 2026. Version 2026-11-09.