Alberta PIPA · Last updated October 6, 2026
Privacy Policy
We collect the least we can, keep it locked away, never sell it, and tell you plainly where it goes. This page explains how we handle your personal and health information under Alberta’s Personal Information Protection Act (PIPA).
Who we are
Khalil Hijama & Cupping Therapy (sole proprietorship), Saddle Ridge, NE Calgary, Alberta. We are a small, family-run hijama and cupping practice. The person responsible for privacy is Muhammad — (403) 971-4039, Niaz.Muhammad47@gmail.com.
What we collect
- When you book online (through Cal.com): your name, email address, mobile number, the treatment and time you chose, and your answers to the short booking questions (first visit or not, how you heard about us, whether you’d like a call first, and the tick-boxes for the 18+ / policy acknowledgement and the optional reminders).
- When you message us (WhatsApp, text, phone or email): your number or address and whatever you tell us.
- At your first session, on a paper intake and consent form: your contact details, date of birth, an emergency contact, health-screening answers (for example medications, pregnancy, diabetes, recent surgery, allergies), and a short record of each session (date, service, areas worked on, how you felt on leaving). Health information is only ever collected on this paper form — never over WhatsApp, never in a spreadsheet.
- When you pay: the service, the amount and the payment method, recorded in Square for your receipt and our sales records. If you pay by e-Transfer, your bank shares your name and the amount with us.
- Photographs: none, unless you tick the optional photo box on the consent form. Sister Maryam is never photographed and no photos are taken in the room by default.
- On this website: no cookies, no accounts and no forms. See Website & analytics.
Why we collect it
- To screen you safely before a session and to decline or adjust a session where we should.
- To book, confirm, remind and — if needed — reschedule your appointments, and to send you the address.
- To provide your session, keep a record of it, and check in with you afterwards.
- To issue receipts and keep the sales and tax records the law requires.
- To run prepaid packs, gift certificates, the referral thank-you and the loyalty card (name, visit dates and counts only).
- Only with your separate, optional consent: to send Sunnah-day reminders and occasional offers by WhatsApp or text. You can say no and still book; you can stop at any time by replying STOP.
We don’t use your information for anything else, and we never sell it.
Where it’s stored
Your paper consent form lives in a locked box in the treatment room. A scanned copy is kept in a private, password-protected Google Drive folder with two-step verification, shared with no one. The other services we use are run by companies whose servers are, or may be, outside Canada — which means your information there is subject to the laws of those countries and could be accessed by their authorities:
| Service | What it holds | Where |
|---|---|---|
| Cal.com | Online booking: your name, email, mobile number, the treatment and time you chose, and your answers to the booking questions. | United States — outside Canada |
| Google (Calendar, Gmail, Drive) | Our appointment calendar, email confirmations and receipts, and a private, two-step-verified folder for scanned consent forms. | United States and other countries — may be outside Canada |
| WhatsApp (Meta) | Messages you send us and any reminders you've asked for — your phone number and the message contents. | United States and other countries — may be outside Canada |
| Square | Receipts and our record of sales: the service, the amount paid, and your name or email if you ask for an emailed receipt. | United States — outside Canada |
| Cloudflare | Hosts this website and gives us cookie-less, aggregated visitor statistics (page views, country, browser type). No personal identifiers. | Global network, including Canada and the United States |
Health-screening answers are never entered into any of these services — they stay on the paper form and its private scan.
How long we keep it
- Consent forms and session records: 7 years after your last visit, then the paper is shredded and the scan deleted.
- Receipts and sales records: as long as Canadian tax rules require (generally six years after the tax year they relate to).
- Booking records and messages: kept while you are a client and deleted from our side within a year of your last visit, except where a booking record is part of a receipt.
- Reminder consent: until you withdraw it. We stop as soon as you ask.
How we protect it
- Locked storage for paper forms; scans in a two-step-verified account, shared with nobody.
- Only Muhammad and Sister Maryam handle client information, and each sees only what they need for their own clients.
- Phones and accounts are passcode-protected; we don’t forward or screenshot client conversations.
- The website itself stores nothing about you and sets no cookies.
- If a privacy breach ever happens that could cause you real harm, we will tell you and report it to the Information and Privacy Commissioner as PIPA requires.
Who we share it with
Nobody, other than the service providers in the table above (who process it only to provide their service to us) — unless you ask us to, or the law requires it. We don’t share information with your employer, insurer, family members or anyone else without your say-so. If a public-health authority ever needs to contact you in connection with a session, we would ask your permission first wherever the law allows.
Your rights
- Access: ask to see the personal information we hold about you. We’ll respond within 45 days (usually much sooner) and provide a copy free of charge.
- Correction: ask us to fix anything that is wrong or out of date.
- Explanation: ask how we’ve used your information and who we’ve shared it with.
Contact Muhammad on (403) 971-4039 or at Niaz.Muhammad47@gmail.com. We may ask you to confirm who you are before sharing anything.
Withdrawing consent
- Reminders and offers: reply STOP to any message, or tell us any other way. It takes effect immediately.
- Photographs: message us and any photo is deleted from the website or social media within 30 days.
- Everything else: you can withdraw consent to us holding your information at any time. We’ll explain what that means — for example, we can’t provide a session without a completed health screen, and tax law requires us to keep receipts.
Website & analytics
khalilhijama.ca is a static website hosted on Cloudflare. It sets no cookies, has no login and no contact form. We use Cloudflare Web Analytics, a cookie-less service that gives us only aggregated counts — how many people visited which page, from which country, on which kind of browser. It doesn’t identify you or follow you to other websites.
The booking calendar is embedded from Cal.com, and links marked WhatsApp open WhatsApp. Those services have their own privacy policies, which apply once you use them.
Contact & complaints
Questions or concerns about your privacy: Muhammad, (403) 971-4039, Niaz.Muhammad47@gmail.com. We’d always rather hear about a concern directly and fix it.
If you’re not satisfied with our answer, you have the right to complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca), which oversees PIPA.
Last updated October 6, 2026. We’ll update this page whenever the way we handle information changes; the date at the top tells you when. Our booking and offer terms are on the policies page.
Any question, any time.
Privacy questions go straight to Muhammad. Booking takes under a minute.
Prefer to ask first? WhatsApp us or call (403) 971-4039.