What we do with what you tell us.

The short version

• We collect what you type into a form here, and almost nothing else about you.
• We do not sell your details, we run no advertising, and we let nobody follow you around the web from this site.
• You can ask us to correct or remove anything you have sent us, and we will do it.
• The practitioners here are independent. Anything you share with one of them directly is theirs to hold, under their own professional rules, not ours.

What each form collects, and why

Nothing on this site asks for more than it needs. Every field below is one you filled in yourself.

• The contact form. Your name, your email, a subject if you write one, and your message. It reaches us so a real person can read it and reply, and we send you a short note back confirming it arrived.
• The founding list. Your email, your name if you give it, the kinds of practice you tick, and anything else you add. It is how we tell you what is happening as the Center comes into being. There is no payment and no obligation.
• Event reservations. Your email, your name if you give it, how many people you are bringing, and any note. It holds your place and lets us send you the details, and it tells us how many to expect.
• Session requests. Your name, your email, your phone number if you give it, the times that tend to suit you, and whatever you write. It goes to the practitioner you asked for and to us, so we can help the two of you find a time.
• Session bookings. Your name, your email, your phone number if you give it, and any note for your practitioner, alongside the session and the time you chose. It holds the appointment, sends you a confirmation with a calendar invitation, tells your practitioner, and sends you one reminder the day before.
• The hidden field. Every form carries one field that is invisible to people and to screen readers. Only an automated script fills it in. When it is filled in, we quietly ignore the submission. It collects nothing about you.

Where it lives, and who else touches it

• Supabase. The database and the file storage. Every table holding your details has row-level security on with no public policies, which means the key your browser holds cannot read those rows at all. Only our server can, using a key that never leaves it.
• Resend. Sends the email: confirmations, notices to your practitioner, and reminders. They handle the message in order to deliver it.
• Vercel. Hosts the site and runs the code. Vercel Analytics and Speed Insights count page views and measure how quickly pages load. Both work without cookies, neither follows you to other sites, and no advertising profile is built from either.

That is the whole list. No data broker, no advertising network, no marketing platform, no third-party chat widget, no social pixel. Those three providers store and process data on servers that may sit outside Canada, mostly in the United States, which means the law of another country can apply to it while it is there. We are telling you that because Canadian privacy law asks us to and because you should know.

Cookies, and how we count things

• Cookies. The public site sets none of its own. Signing in to the practitioner area sets a session cookie, which is the thing that keeps somebody signed in, and only practitioners and admins ever get one.
• Booking interest. When somebody opens a booking action, sends a session request, books a time, or reserves a place at an event, we write one row of our own: which practitioner, which session, what kind, and a short token. The token is a one-way hash of the network address and browser string on the request, salted and rotated every day, so it cannot be turned back into you and cannot be matched from one day to the next. The address itself is never stored on that row.
• Rate limiting. We do use your network address for one thing. It becomes the key that limits how often a form can be submitted from one place, which is what keeps the forms from being flooded. It lives in a rate-limit table on its own, expires on its own, and is never attached to what you submitted.

The calendars practitioners connect

A practitioner can paste a private calendar address so that their own commitments block times here. We read that calendar only to find out when they are busy: start times and end times, and nothing else. Titles, guests, and notes are not read and not stored. The address is held where only our server can reach it, it is never shown anywhere on the site, and a practitioner can unlink it whenever they like. None of this is about you. None of it is ever public.

How long we keep things

A booking record that is a year old has stopped being useful and has started being a liability. So once a year has passed we strip the person out of it. A job runs once a month and does this on its own.

• Session requests. Twelve months after a request is closed, we blank the name, email, phone number, message, and preferred times. The record that a request happened stays.
• Session bookings. Twelve months after a cancelled or completed session, we blank the name, email, phone number, and note the same way. The time and the practitioner stay.
• Event reservations. Twelve months after the event, we blank the name, email, and note.
• Contact messages and the founding list. These we keep until you ask us to remove them, because they exist to hold a conversation open rather than to record a transaction. Ask us any time and we will remove yours.

We blank rather than delete on purpose. Deleting a row would quietly change the counts an earlier month was reported on, and we would rather keep honest numbers than tidy ones. What is removed is the part that points at a person.

Your practitioner keeps their own records

The practitioners listed here are independent. They are not our employees, we do not supervise their practice, and we are not part of their clinical relationship with you. When you go on to work with one of them, the health information you share with them is theirs to hold, under their own college or association rules, and it is theirs to answer for. If you want to know what a practitioner keeps about you, or you want it corrected, ask them directly. The same goes for insurance receipts: those come from the regulated practitioner who did the work, with their own registration number on them, and never from us.

We take no payment for a session. There is no checkout on this site, so we never see a card number.

The practitioner area

Practitioners and admins sign in with a link we email, so there is no password to store. For them we keep an email address, whatever they put on their own profile, and a log of the administrative actions they take, meaning who changed what and when. That log exists so a change to a live profile can be traced back to the person who made it. It records actions, not reading.

Practitioners we are hoping to work with

Building the center means keeping track of the practitioners we would like on the roster, so we hold a working list of people we have met, been introduced to, or found through their own public listing. If you are on it, we may have your name, your practice, how to reach you, where we came across you, and notes from any conversation we have had.

Those notes include our own opinion. What we think you would be good at, whether we think you are a fit, what we plan to do next, and how confident we are about any of it. None of it is published anywhere and none of it goes to another practitioner. It is working judgment, and being honest that we keep it matters more than it being flattering.

You did not sign up for this list, and you can leave it. Ask us and we will tell you everything we hold about you, and that means the notes and the assessments too, not only your contact details. Ask us to remove you and we will remove the record rather than mark it inactive. If you would rather we simply never contact you again while keeping nothing else, we can do that too.

Asking to see, correct, or remove something

Write to us through the Connect page and say what you would like. You can ask what we hold about you, ask for something to be corrected, or ask us to remove it. We will do it and tell you when it is done, and if there is some reason we cannot, we will tell you that instead of going quiet.

Those are your rights under PIPEDA, the federal law that covers this. If you are not satisfied with how we handled your request, you can take it to the Office of the Privacy Commissioner of Canada.

Changes, and the law that applies

If we change how any of this works, we change this page and the date at the top of it. We will not quietly start doing something this page says we do not do.

The Diamond Sunrise Center operates from Ontario, Canada. Ontario law and the federal laws of Canada apply to this page and to how we handle what you send us.