ROOM38 Privacy Policy
Last updated: September 2026
This Privacy Policy explains how ROOM38 Pilates Studio Inc. (“ROOM38,” “we,” “us” or “our”) collects, uses, discloses, retains and protects personal information when you interact with us, including through our website, mobile application, booking and reservation systems, studio, events and other products and services (collectively, the “Services”).
For purposes of this Privacy Policy, “you” and “your” refer to any individual whose personal information we collect in connection with the Services, including customers, members, prospective customers, website or application users, event participants and other individuals who interact with ROOM38.
By providing personal information to ROOM38, you acknowledge that it will be handled in accordance with this Privacy Policy. We obtain consent where required by applicable law and identify the purposes for collection at or before collection. Choosing not to provide information needed for a particular feature may limit our ability to provide that feature.
Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as those set out in our Terms and Conditions, available at room38.ca/terms. The Terms and Conditions separately govern purchases and bookings, including the product-specific Purchase Summary displayed before payment. This Privacy Policy does not require you to consent to optional marketing or waive any privacy rights.
1. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to our practices or legal requirements. We will post the revised policy and give any notice or obtain any consent required by applicable law.
2. How We Collect and Use Your Personal Information
We collect personal information in several ways depending on how you interact with ROOM38. This may include information you provide directly to us when you create an account, book or attend a class, purchase a membership or other product or service, review or accept a Purchase Summary or recurring-payment authorization, complete a participation acknowledgement, intake form or other safety process, communicate with us, attend a ROOM38 event, use our website or mobile application, or otherwise interact with our Services. We may also collect certain information automatically when you use our digital Services, including through cookies and similar technologies, and may receive information from third-party service providers that support our operations, such as booking platforms, payment processors, technology providers, analytics providers and marketing platforms.
We use personal information for purposes that include:
providing, administering and improving our Services;
creating and managing your account, memberships, purchases and class reservations;
processing payments and transactions;
administering memberships, recurring billing, renewals, cancellations, refunds, credits and disputes, and maintaining related legal, accounting and record-keeping records
communicating with you about bookings, memberships, events, account activity and other service-related matters;
providing customer support and responding to questions or requests;
supporting the safe delivery of our classes and Services, including where you choose to provide health or physical information relevant to your participation;
understanding how our website, mobile application and Services are used, conducting research and analysis, and improving our Services, customer experience and marketing efforts;
sending marketing and promotional communications by email, text message or mail, where permitted by law;
protecting the security and integrity of our Services, preventing fraud and managing risk;
complying with legal, regulatory, insurance and contractual obligations; and
establishing, exercising or defending our legal rights and protecting ROOM38, our customers, staff and others.
We limit the personal information we collect to what is reasonably necessary for the purposes identified in this Privacy Policy or otherwise communicated to you at the time of collection.
3. What Personal Information We Collect
The types of personal information we obtain about you depend on how you interact with our website and use our Services. Personal information means information about an identifiable individual under applicable privacy law.
A. Personal Information
Basic contact details including your name, address, phone number, email;
Payment and billing information, such as billing address, payment status, transaction information and limited payment-card details made available to us by our payment processor;
Transaction and booking information, including the Purchase Summary displayed before payment, accepted Terms, recurring-payment authorizations, class bookings, membership purchases, class packs, payments, cancellations, attendance history and other transactions with ROOM38, together with relevant acceptance and consent timestamps;
Account information or other unique identifiers, such as your username and account identifier. We do not ask you to disclose your password to studio staff.
Health and physical information you choose to disclose to us or our instructors, such as through a participation acknowledgement, intake form, safety process or the Participant Waiver, or through verbal disclosures before or during class, including injuries, physical limitations, pregnancy or other health conditions relevant to your safe participation; and
Customer support information including the information you choose to include in communications with us.
Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.
B. Information Collected Automatically
When you use our digital Services, we may automatically collect certain information about your device and how you interact with our Services. This may include your IP address, browser type, device information, operating system, referring and exit pages, pages viewed, links clicked, date and time of access, and other usage information.
We may use cookies, pixels, web beacons and similar technologies to operate and maintain our digital Services, remember preferences, understand usage, measure campaigns, detect security issues and, where permitted by law and supported by the applicable consent controls, support advertising. Optional analytics or advertising technologies will not be activated before any required consent.
If you enable location services for the ROOM38 mobile application, we may access your device’s location information to determine whether you are within or near a ROOM38 studio for features such as mobile check-in.
ROOM38 uses location information only to enable or verify the applicable location-based feature. We retain it only for as long as reasonably necessary for that feature and as otherwise required by law.
You can manage location permissions through your device settings. Disabling location access may prevent certain features, such as mobile check-in, from functioning.
We may use third-party service providers and platforms to assist with website functionality, booking, payment processing, communications, analytics and advertising. These providers may collect or receive information through cookies and similar technologies in accordance with applicable consent requirements, their own privacy practices and our arrangements with them.
4. Third Party Websites and Services
Our website or application may contain links to independent third-party websites, social networks and services. Their own privacy policies govern information you provide directly to them for their independent purposes. We do not control those independent practices. This does not remove ROOM38’s responsibility for personal information under our control, including information processed by service providers on our behalf.
Information you deliberately post publicly may be accessible to others. A link does not imply endorsement. Our own collection, use and disclosure of personal information remain subject to this Policy and applicable law.
We may use analytics and advertising technologies, including pixels and similar tools, to understand use of our Services and measure campaigns. Where permitted by law and supported by applicable consent controls, these technologies may also support interest-based advertising. The information involved may include device, browser, IP address, cookie and usage information.
You can manage cookies through your browser and any privacy controls provided on our website or application. Blocking essential cookies may affect booking or account functions. You may change optional technology choices using the available controls or by contacting us.
5. Consent and Marketing Communications
We collect, use and disclose personal information with meaningful consent unless applicable law permits or requires otherwise. We identify purposes at or before collection and do not require consent to unrelated optional uses as a condition of receiving core Services.
A. Express Consent
We seek express consent where appropriate, including for sensitive health information and optional uses that would not reasonably be expected. When health or physical information is requested or voluntarily disclosed, we explain the purpose for collection and use it only for safe participation, accommodation and related incident management, in accordance with applicable law. Acceptance of the Terms or completion of a participation acknowledgement or intake form does not authorize unrelated use of health information. Optional marketing and promotional-image consent are collected separately.
B. Implied Consent
We may rely on implied consent where the information is not sensitive and the purpose is reasonably apparent, such as using contact information supplied for a booking to send its confirmation. We do not assume that silence alone authorizes sensitive or unexpected uses. Privacy consent and consent to commercial electronic messages are assessed separately.
C. Withdrawing Your consent
You may withdraw consent by contacting info@room38.ca, subject to lawful restrictions and reasonable notice. We will explain any consequences for the Services, such as an inability to safely provide a particular activity without necessary information. Withdrawal does not require deletion of records we must or may lawfully retain. Refusal of optional marketing does not prevent access to core Services.
D. Canada Anti-Spam Legislation (CASL)
We send commercial electronic messages only with express consent or where Canada’s Anti-Spam Legislation (CASL) permits implied consent for a limited period. Each marketing message identifies ROOM38, includes our contact information and provides a no-cost unsubscribe mechanism. We give effect to unsubscribe requests within 10 business days, or sooner where required by law. Service or transactional messages may be sent where permitted by law, but promotional content may make a message commercial.
E. SMS / Text Messaging
If you opt in to promotional text messages, we may use your mobile number for those messages in accordance with your consent and CASL. Service-related texts are sent only where authorized or otherwise permitted by law. You may unsubscribe using the instructions in the text message or by contacting info@room38.ca.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
6. How We Disclose Personal Information
We disclose personal information only for identified purposes, with appropriate consent or other lawful authority, including:
To service providers supporting website hosting, booking and account services, intake and safety-acknowledgement management where applicable, payment processing, communications, technical support, cloud storage and analytics. We remain accountable for information processed on our behalf and use contractual or other appropriate measures to require comparable protection and restrict its use.
With service providers and business partners that support booking, payment processing, communications, analytics, advertising, website functionality and other ROOM38 operations. The applicable provider and its privacy notice will be identified where required by law or at the time of collection.
Independent providers may use information for their own purposes only as described in their privacy notices and the applicable disclosure or consent choice.
When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations, with your consent.
Within our corporate group only for the identified purposes in this Privacy Policy, with appropriate access restrictions and other safeguards.
In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
With our booking and waiver management platform, and with our insurer in the event of an injury or incident, as necessary to operate the Services and manage risk.
Our providers may store or process personal information outside Ontario, including in the United States. Information processed abroad may be subject to lawful access by authorities in that jurisdiction. ROOM38 remains accountable for information processed on our behalf and takes appropriate contractual and other protective measures.
In addition to the above, we may disclose your personal information:
As required by law such as to comply with a subpoena, or similar legal process,
When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request, or
To any other third party with your prior consent to do so.
7. User Generated Content
The Services may enable you to post product reviews and other user-generated content. If you choose to submit user generated content to any public area of the Services, this content will be public and accessible by anyone.
We do not control who will have access to the information that you choose to make available to others, and cannot ensure that parties who have access to such information will respect your privacy or keep it secure. We are not responsible for the privacy or security of any information that you make publicly available, or for the accuracy, use or misuse of any information that you disclose or receive from third parties.
8. Children's Data
ROOM38 does not offer participation in its Services to anyone under 18. We do not knowingly collect personal information from a child in connection with participation. If you believe a child has provided personal information to ROOM38 without appropriate authority, please contact us and we will take reasonable steps to address the request in accordance with applicable law.
9. Security, Breach Notification and Retention of Your Information
We use administrative, technical and physical safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use or modification. The safeguards we use are appropriate to the sensitivity of the information and may include access controls, secure systems and confidentiality requirements for personnel and service providers.
While we take reasonable steps to protect personal information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Data Breach Notification. If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada, as required by applicable law. We maintain records of breaches of security safeguards in accordance with our legal obligations.
Retention. We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide the Services, maintain appropriate business and transaction records, comply with legal, regulatory, accounting or insurance obligations, resolve disputes and enforce our agreements. When personal information is no longer required, we will securely delete, destroy or anonymize it, as appropriate and in accordance with applicable law.
10. Your Privacy Rights and Choices
Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.
Access and accountability. You may request access to personal information we hold about you, including information about how it has been used and disclosed, subject to lawful exceptions.
Deletion. You may ask us to close your account or delete information no longer needed. This is not an unrestricted right to erase transaction, consent, participation, incident or other records that we must or may lawfully retain.
Correction. You may ask us to correct incomplete or inaccurate personal information.
Withdrawal of consent. You may change or withdraw consent as described above. We will explain any resulting limitation on Services and applicable retention requirements.
Communication preferences. Unsubscribe from marketing using the mechanism provided or by contacting us. We may continue to send non-promotional booking, billing, safety and account messages where permitted by law.
You may exercise these rights by contacting us using the contact details below. We will respond in accordance with applicable law.
If you wish to access personal information beyond that available in your account, make a written request using the contact details below. We may seek proportionate proof of identity or authority. Access is provided at minimal or no cost, subject to any charge permitted by law, which we will explain in advance. If we refuse access in whole or part, we will give reasons and complaint information to the extent legally permitted.
We will not penalize you for exercising privacy rights. An authorized representative may contact us on your behalf, subject to reasonable verification of authority and identity.
11. Contact information
Privacy Officer, ROOM38 Pilates Studio Inc.
Email: info@room38.ca
Mail: Retail 5, 4225 Confederation Parkway, Mississauga, Ontario L5B 0P9