Learn how the ShapeFX Method has turned solo practices into six-figure businesses

Watch Now
Free Masterclass

Privacy Policy

Effective date: June 10 2026 Last updated: June 10 2026

ShapeFX Academy (“ShapeFX,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights you have over it.

This policy applies to our website at shapefx.ca, our online courses and certification programs, our email communications, and our massage therapy clinic in Edmonton, Alberta.

We comply with:

  • The Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law;
  • Alberta’s Personal Information Protection Act (PIPA), which applies to our operations in Alberta; and
  • The EU and UK General Data Protection Regulation (GDPR), where we process the personal data of individuals in the European Economic Area (EEA) or United Kingdom.

If any provision of this policy conflicts with a legal requirement that applies to you, the stricter standard governs.

1. Who we are (the organization responsible for your information)

ShapeFX Academy is operated by Lena Fontaine, Registered Massage Therapist, based in Edmonton, Alberta, Canada.

For any privacy-related question, request, or complaint, you can reach our Privacy Officer at:

For the purposes of GDPR, ShapeFX is the data controller of the personal data described in this policy.

2. The information we collect

We only collect personal information that we need for the purposes described in this policy. Depending on how you interact with us, this may include:

Information you give us directly

  • Contact and identity details, your name, email address, and any details you include when you message us or fill in a form.
  • Account and course information, details you provide when you register for, purchase, or take one of our courses (for example, your professional credentials, course progress, and completion status).
  • Webinar and masterclass registrations, your name and email when you sign up for a free masterclass or live training.
  • Newsletter and lead-magnet sign-ups, your name and email when you request a free resource or subscribe to our emails.
  • Payment information, billing details needed to process a purchase. We do not store full card numbers ourselves; payments are handled by our payment processor (see Section 5).
  • Clinic intake and health information, if you are a client of our Edmonton clinic, the contact details, health history, treatment notes, and appointment records needed to provide massage therapy services. This is sensitive personal information and we treat it with heightened care (see Section 4).
  • Testimonials and media, if you provide a testimonial, review, photo, or video, we use it only with your consent and as agreed with you.

Information we collect automatically

  • Usage and device data, when you visit shapefx.ca, our website host and analytics tools may collect information such as your IP address, browser type, device, pages viewed, and referring website.
  • Cookies and similar technologies, see Section 7.

We do not knowingly collect more information than we need, and we do not collect sensitive information unless it is necessary for a service you have requested.

3. Why we use your information, and our legal basis

We use personal information for the following purposes. Where GDPR applies, our legal basis for each purpose is shown in brackets.

  • To provide our courses, certification, and clinic services, including delivering content, tracking course progress, and scheduling appointments. [Legal basis: performance of a contract.]
  • To process payments and keep financial and tax records. [Legal basis: contract; and legal obligation.]
  • To respond to your enquiries and provide customer support. [Legal basis: contract or our legitimate interest in helping you.]
  • To send you marketing emails, newsletters, and information about our programs, where you have asked to hear from us. You can unsubscribe at any time. [Legal basis: consent.]
  • To register and host you for webinars and masterclasses you sign up for. [Legal basis: consent or contract.]
  • To operate, secure, and improve our website and analyze how it is used. [Legal basis: consent for non-essential cookies; otherwise our legitimate interest in running a safe, functional site.]
  • To provide massage therapy services and maintain clinical records. [Legal basis: contract; and, for health information, your explicit consent. We also retain records as required for professional record-keeping.]
  • To comply with our legal, regulatory, and professional obligations, and to establish, exercise, or defend legal claims. [Legal basis: legal obligation; legitimate interest.]

Under PIPEDA and Alberta PIPA, we identify the purposes of collection at or before the time we collect your information, and we rely on your consent (express or implied, as appropriate to the sensitivity of the information). We will not use your information for a new, unrelated purpose without your consent.

4. Sensitive and health information

If you are a clinic client, the health information you share with us is sensitive personal information. We:

  • collect it only with your knowledge and consent, and only what we need to provide safe and effective treatment;
  • use it only to deliver your care, manage your appointments, and meet our professional and legal record-keeping obligations;
  • do not disclose it to third parties for marketing; and
  • retain it in accordance with applicable professional record-retention requirements, then securely dispose of it.

Where GDPR applies, we process health information only on the basis of your explicit consent or another lawful basis permitted for special-category data.

5. When we share your information

We do not sell your personal information, and we do not rent or trade it.

We share information only in these circumstances:

Service providers (processors) who help us operate. We use trusted third-party platforms to run our business. Each only receives the information needed for its function, and is bound to protect it and use it only on our instructions. These include:

  • Website hosting and forms, NETLIFY to host shapefx.ca and process our contact form (Netlify Forms). Sign-up forms are hosted by KIT.
  • Online course platform, TEACHABLE to host courses, manage enrollments, and process checkout.
  • Payment processing, STRIPE to securely process card payments. Your card details go directly to the payment processor and are not stored by us.
  • Email marketing platform, KIT to manage subscriptions and send you the emails you have requested.
  • Webinar platform, WEBINARJAM to register and host you for masterclasses and live trainings.
  • Analytics and advertising tools, GOOGLE and META to understand site traffic and, where applicable, deliver and measure advertising.

Legal and protective disclosures. We may disclose information if required by law, court order, or regulatory authority, or where necessary to protect our rights, your safety, or the safety of others, or to detect and prevent fraud.

Business transfers. If our business is reorganized, merged, or sold, personal information may be transferred as part of that transaction, subject to this policy.

With your consent. In any other case, we share information only with your consent, for example, publishing a testimonial you have approved.

6. International transfers of your information

We are based in Canada, and several of our service providers are located in the United States or other countries. This means your personal information may be stored or processed outside your home country, including outside Canada and the EEA/UK.

When we transfer personal data internationally, we take steps to ensure it remains protected, including relying on:

  • the European Commission’s adequacy decision for Canada, which recognizes Canadian privacy protections;
  • Standard Contractual Clauses or equivalent safeguards in our contracts with providers; and/or
  • certification under recognized transfer frameworks (such as the EU-U.S. Data Privacy Framework) where a provider participates.

While information is in another country, it may be accessible to that country’s courts, law-enforcement, and regulatory authorities under their laws. You can contact our Privacy Officer for more information about the safeguards we use.

7. Cookies and similar technologies

Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used.

  • Essential cookies are necessary for the site to function (for example, security and basic navigation).
  • Analytics and performance cookies help us see how visitors use the site so we can improve it.
  • Marketing cookies may be used to measure and deliver advertising where applicable.

Where required by law, we ask for your consent before placing non-essential cookies, and you can change your preferences at any time through our cookie banner or your browser settings. Disabling some cookies may affect how the site works.

8. How long we keep your information

We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires, after which we securely delete or anonymize it. In general:

  • Course and account records, for as long as your account is active and for a reasonable period afterward.
  • Financial and tax records, for the retention period required by Canadian tax law (generally six years).
  • Marketing contacts, until you unsubscribe or ask us to delete your information.
  • Clinic health records, for the period required by NHPC and Alberta record-retention standards.

9. How we protect your information

We use reasonable physical, organizational, and technical safeguards to protect your personal information against loss, theft, and unauthorized access, use, or disclosure. These include access controls, secure platforms, and limiting access to information to those who need it.

No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards. If a privacy breach occurs that creates a real risk of significant harm, we will notify affected individuals and the relevant authorities as required by law.

10. Your rights and choices

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you;
  • Correct information that is inaccurate or incomplete;
  • Withdraw consent at any time (for example, by unsubscribing from emails), subject to legal or contractual limits;
  • Ask us to delete your information where we are not required to keep it;
  • Object to or restrict certain processing; and
  • Request portability of information you provided to us, in a usable format, where applicable.

To exercise any of these rights, contact our Privacy Officer at lena@shapefx.ca. We will verify your identity and respond within the timeframe required by law (generally 30 days under PIPEDA and Alberta PIPA, and one month under GDPR). There is normally no charge, and we will tell you in advance if any limited fee applies.

You can unsubscribe from marketing emails at any time using the link at the bottom of any email.

11. Children’s privacy

Our programs are intended for licensed professionals and other adults. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the “Last updated” date above and, where appropriate, notify you. We encourage you to review this page periodically.

13. How to contact us or make a complaint

If you have a question, request, or concern about your privacy or this policy, please contact our Privacy Officer first:

We take privacy concerns seriously and will work with you to resolve them.

If you are not satisfied, you also have the right to contact a privacy regulator:

  • Office of the Privacy Commissioner of Canada (OPC), www.priv.gc.ca
  • Office of the Information and Privacy Commissioner of Alberta (OIPC), www.oipc.ab.ca
  • If you are in the EEA or UK, your local data protection authority, or the UK Information Commissioner’s Office (ICO) at ico.org.uk.

This Privacy Policy is provided for general informational purposes and does not constitute legal advice.