An esthetics, hair or massage therapy salon keeps more personal information than it seems: names, phone numbers, emails, dates of birth, and above all health information (allergies, medications, pregnancy, skin conditions). In Quebec, Law 25 governs all of it, and it applies to the independent professional working alone too.
Here, in plain language, is what it asks of a salon, and what software can do for you (and what it can't do in your place).
This article is a summary, not legal advice. The official reference is Quebec's Commission d'accès à l'information (CAI).
What Law 25 asks of a salon
1. A person in charge
Every business has a person in charge of the protection of personal information. By default, it's the person with the highest authority: in a small salon, that's you. Their title and contact information must be published, for example on your website.
2. Clear consent, especially for health
You must tell your client why you collect her information and get her consent. For health information, which is sensitive, consent must be express: a signature, not a pre-checked box.
3. The right of access and the right to erasure
A client can ask to see everything you have about her, to correct it, or to have it deleted once you no longer need it. You have 30 days to respond.
4. An incident register
A lost phone with your client files, an email sent to the wrong person: every confidentiality incident must be recorded in a register, and reported to the CAI and to the people affected if it presents a risk of serious injury.
5. Knowing where the data goes
If information leaves Quebec, the law asks you to assess whether it is adequately protected where it goes. Knowing where your software hosts your data is therefore part of your obligations.
What Clairgest does for you
- Consents signed on screen. The client fills in her health questionnaire and signs on a tablet at the salon. The signature and the version of the form she signed are kept.
- Access and erasure in a few clicks. A client's complete file prints in one go, and it can be deleted on request.
- Hosting in Canada. The software's data is hosted by OVH in Beauharnois, Quebec. A few subprocessors (payments, email, SMS) process some data outside Canada: they are named in our privacy policy, so you can tell your clients.
- Role-based access. The owner and employees don't have the same access, and sign-in can be protected by a second factor.
- Encrypted backups, every day.
What remains your responsibility
No software can be compliant in your place. It's still up to you to designate the person in charge (probably you) and publish their contact information, to keep the incident register, to answer your clients' requests on time, and not to keep information longer than necessary. The good news: with a paper binder, all of this is nearly impossible to do properly. With well-designed software, it takes a few minutes per request.
Clairgest was born in a Quebec esthetics salon, with these obligations in mind. See how it compares to Fresha, Vagaro and Booksy.
The Clairgest team