PRIVACY POLICY
Last updated: 12 October 2026
1. About Karow Wellness
Karow Wellness provides non-medical companionship, scheduled check-ins, practical support, liaison and advocacy services.
Karow Wellness, with its business address at Calgary, Alberta, Canada.
This policy applies to personal information handled through our website, enquiries and services throughout Canada, including all provinces and territories, and the United Kingdom, including London, all London boroughs, the City of London and surrounding areas.
This geographic scope does not mean that services are available in every location. Service availability is confirmed during intake.
Karow Wellness is responsible for personal information under its control and, where UK data protection law applies, acts as a data controller for the purposes described in this policy.
Privacy contact: Privacy Lead, Karow Wellness
Email: wecare@karowwellness.com
Postal address: Calgary, Alberta, Canada.
UK representative, where legally required: appointed representative’s temporary representative Kayden Steel, UK email wecare@karowwellness.com
2. Applicable privacy laws
We handle personal information in accordance with applicable privacy laws.
In Canada, these may include the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act, Québec’s Act respecting the protection of personal information in the private sector, and other applicable legislation.
In the United Kingdom, these include the UK General Data Protection Regulation, the Data Protection Act 2018, and applicable rules on electronic communications, as amended.
The laws applying to a particular activity depend on its circumstances. This policy does not limit rights or protections provided by applicable law.
3. Information we collect
We collect information reasonably necessary for the purposes described below. Depending on your interaction with us, this may include:
- Names, contact details and service addresses.
- Enquiries, correspondence and communication preferences.
- Service preferences, schedules, access instructions and relevant accessibility needs.
- Details of nominated contacts, emergency contacts and authorised representatives.
- Agreements, consent records and evidence of a representative’s authority where necessary.
- Visit and contact records, including dates, activities, factual observations, concerns and follow-up actions.
- Billing information, payment status and transaction references.
- Relevant health or other sensitive information where necessary for an agreed service and legally permitted.
- Website information, such as IP address, browser and device details, pages accessed and cookie preferences, depending on the technologies enabled.
Please do not send detailed medical records, passwords, bank account access information or unnecessary identity documents through our general enquiry form. Contact us first to arrange an appropriate method for providing necessary sensitive information.
4. How we obtain information
We collect information through enquiries, intake forms, agreements, conversations, emails, service visits, contractor reports and website technologies.
We normally obtain information directly from the individual concerned. Where legally permitted, we may also receive it from an authorised representative, nominated contact, referring organisation, facility, assigned contractor or payment provider.
We do not assume that a relative or payer is authorised to provide or receive every type of information. We establish appropriate consent or another lawful authority.
When information comes from another source, we provide the required privacy information within the applicable legal timeframe, unless a lawful exception applies.
5. Why we use information
We use information to:
- Respond to enquiries and assess service suitability.
- Arrange, deliver and administer agreed support.
- Understand relevant preferences, access requirements and support needs.
- Maintain service, contact and consent records.
- Communicate with clients and appropriately authorised contacts.
- Process payments and maintain financial records.
- Investigate complaints, incidents and safety concerns.
- Protect our website and prevent fraud or misuse.
- Meet legal obligations and establish, exercise or defend legal claims.
We identify required and optional information during collection. If information necessary to arrange or safely provide a particular service is unavailable, we explain the effect on that service. We do not require consent to unrelated uses as a condition of receiving support.
6. Consent and lawful grounds
In Canada, we obtain meaningful consent where required, using a form appropriate to the sensitivity of the information and the circumstances. We rely on an exception only where applicable law permits it.
Where UK law applies, our grounds for processing may include:
- Contract: arranging and performing an agreement with you.
- Legitimate interests: responding to enquiries, coordinating authorised support, maintaining necessary operational records, managing complaints and protecting our business, subject to your rights and interests.
- Legal obligation: meeting applicable statutory requirements.
- Consent: optional marketing, technologies requiring consent and other specified activities.
- Vital interests: limited emergency circumstances meeting the legal requirements.
For UK health information and other special-category data, we also require a separate lawful condition. For routine support involving this information, we obtain explicit consent from the individual or a person legally authorised to give it. We use another condition only where legally available.
Browsing our website or accepting service terms does not, by itself, constitute consent to marketing, sensitive-information processing or disclosure to family members.
You may withdraw consent by contacting our Privacy Lead. Withdrawal does not invalidate earlier lawful processing. We will explain any effect on services and any information we must continue to retain or process under another lawful ground.
7. Family updates and confidentiality
Paying for someone’s services does not automatically entitle the payer to receive information about that person.
We establish who may receive updates, which information may be shared and any limits on that permission. We respect the service recipient’s lawful choices and any valid representative authority.
Assigned contractors receive only information needed for their responsibilities and are subject to confidentiality and information-handling requirements.
Confidentiality is subject to lawful exceptions. Necessary information may be disclosed where required or permitted by law, including in certain emergencies, safeguarding situations or legal proceedings.
8. Who receives information
Where necessary and legally permitted, relevant information may be shared with:
- Contractors providing or coordinating agreed services.
- Contacts and representatives authorised to receive it.
- Facilities and organisations involved in an authorised liaison or advocacy task.
- Providers supporting website hosting, communications, scheduling, storage, accounting and payment processing.
- Professional advisers, insurers, regulators and public authorities where necessary.
Our website is hosted through Shopify. Shopify’s privacy information is available at https://www.shopify.com/legal/privacy.
We use the following service providers:
-
Shopify for website hosting and website enquiry functions.
-
GoDaddy for domain management and business email services.
-
Square for payment processing and related transaction records.
These providers may process information necessary to deliver their services. Their privacy information is available at:
We remain responsible for information handled on our behalf and use appropriate contractual protections where required. Some providers also process information independently under their own privacy notices.
We do not sell client personal information or provide client contact lists to other businesses for their own marketing.
9. Processing outside your province or country
Our Canadian and UK operations may involve accessing or processing information across provincial and national borders, including outside Québec.
Relevant processing locations: Canada & United Kingdom with Karow Wellness and its providers.
Information processed abroad may be subject to foreign laws and lawful access by foreign courts or authorities.
Where applicable, we assess transfers and use legally required protections, including appropriate contractual arrangements, transfer assessments or recognised adequacy arrangements.
Where Québec law requires a privacy impact assessment before information is handled outside Québec, we undertake the required assessment and arrangements before proceeding.
For details of our practices concerning providers outside Canada, or applicable UK transfer safeguards, contact our Privacy Lead. You may request relevant written information and a copy or explanation of applicable safeguards, subject to lawful redactions.
10. Cookies and optional website technologies
Our website uses technologies needed for essential functions, security and remembering preferences.
Optional analytics, advertising and tracking technologies are activated only in accordance with applicable law, including obtaining consent where required.
Where available, you can accept, reject or change optional technologies through our website’s cookie controls. Browsing the website alone is not consent.
Where Québec law requires identification, location or profiling functions to remain inactive until you choose to activate them, we apply that requirement.
Details of enabled technologies, providers,
11. Marketing, photographs and testimonials
We obtain consent for promotional communications where required. You may unsubscribe using the instructions in a message or by contacting us.
Necessary service communications, such as scheduling and billing messages, are separate from marketing.
We obtain separate permission before using an identifiable client’s photograph, story or testimonial publicly. Agreeing to services does not grant that permission.
12. Security and retention
We use reasonable safeguards appropriate to the sensitivity of information, including restricted access, confidentiality requirements and appropriate protection of records.
No system can guarantee absolute security. We investigate privacy incidents, maintain required records and notify affected people and authorities when legally required.
Our retention schedule is:
- Enquiries that do not become clients: Kept for 90 days then destroyed appropriately
- Client agreements, consent records, visit logs and service correspondence: Kept for 90 days then destroyed appropriately after service ends.
- Financial records: Kept for 90 days then destroyed appropriately after service ends.
- Website and cookie records: the durations stated in our cookie information.
Retention takes account of the purpose, applicable recordkeeping duties, complaints and potential legal claims. A necessary legal hold may extend a period.
When information is no longer needed, we securely destroy it or anonymise it in accordance with applicable law.
13. Your rights
Depending on applicable law, you may request:
- Access to your information and details of its use and disclosure.
- Correction of inaccurate or incomplete information.
- Withdrawal of consent.
- Deletion, restriction or portability where the relevant legal conditions apply.
- Other rights available under applicable privacy legislation.
Right to object: Where UK law applies and we rely on legitimate interests, you may object based on your circumstances. You may object to direct marketing at any time.
Send requests to wecare@karowwellness.com. We may reasonably verify identity or representative authority. We respond within the applicable legal deadline and explain any lawful refusal, restriction, extension or permitted fee.
14. Privacy complaints
You can raise a privacy complaint by emailing our privacy lead. Please describe the concern and your preferred contact method.
Where UK law applies, we acknowledge privacy complaints within 30 days, investigate without undue delay, keep you appropriately informed and communicate the outcome.
You may also contact the relevant regulator:
- Canada, where PIPEDA applies: Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca.
- Alberta: Office of the Information and Privacy Commissioner — https://oipc.ab.ca.
- British Columbia: Office of the Information and Privacy Commissioner — https://www.oipc.bc.ca.
- Québec: Commission d’accès à l’information — https://www.cai.gouv.qc.ca.
- United Kingdom: Information Commissioner’s Office — https://ico.org.uk/make-a-complaint.
15. Changes
We may update this policy when our practices, services or legal obligations change. We identify the update date and provide additional notice or obtain new consent where required.