SABI Health Inc.

Privacy Policy

www.sabi.health

Effective Date: April 1, 2026

Last Reviewed: April 1, 2026

Please note: This Privacy Policy applies to SABI Health Inc. and its affiliated entities including SABI Mind Inc. (collectively, "SABI Health", "we", "us", or "our"). We are committed to protecting your personal and health information in compliance with applicable Canadian privacy legislation.

1. Introduction and Scope

SABI Health Inc. is a private health clinic operating in Alberta, Canada, offering integrative and functional health services including the Reset, Renew, Renew+, and Reclaim programs, as well as SABI Skin and SABI Mind wellness services. We are dedicated to delivering personalized, preventive, and restorative care grounded in a whole-person philosophy.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information — including health information — about our clients, website visitors, and prospective clients. It applies to:

  • Our website at www.sabi.health and any associated subdomains

  • All client intake, assessment, and care delivery processes

  • Our corporate wellness program (Beyond Benefits) and related employer outreach

  • Communications by email, phone, SMS, or any digital platform

  • SABI Mind and SABI Skin affiliated services

2. Applicable Privacy Laws

We operate under and comply with the following Canadian privacy legislation:

  • Alberta's Health Information Act (HIA) — governs the collection, use, and disclosure of health information by custodians in Alberta. SABI Health acts as a health information custodian under the HIA.

  • Alberta's Personal Information Protection Act (PIPA) — governs the collection, use, and disclosure of personal information by private-sector organizations in Alberta.

  • Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) — applies to interprovincial and international transfers of personal information in the course of commercial activity.

  • Canada's Anti-Spam Legislation (CASL) — governs commercial electronic messages and consent requirements.

Where the HIA and PIPA overlap with respect to health information, the HIA takes precedence.

3. Information We Collect

3.1 Personal Information

When you visit our website, register for services, or communicate with us, we may collect:

  • Full name, date of birth, and contact information (address, email, phone number)

  • Billing information, including payment method details processed through secure third-party payment processors

  • Employer name and benefits plan details (for Beyond Benefits corporate clients)

  • Communication preferences and marketing consent records

  • Device, browser, and usage data collected through cookies and analytics tools

3.2 Health Information

As a health services provider, we collect health information as defined under Alberta's HIA, including:

  • Medical history, diagnoses, medications, and treatment records

  • Lifestyle, nutritional, and wellness assessment data

  • Laboratory and diagnostic test results

  • Mental health information collected through SABI Mind services

  • Aesthetic and dermatological records collected through SABI Skin services

  • Information provided during consultations with our physicians, nurse practitioners, or other regulated health professionals

3.3 Website and Technical Data

When you visit www.sabi.health, we automatically collect certain technical information, including:

  • IP address and approximate geographic location

  • Browser type, operating system, and device identifiers

  • Pages visited, time spent on pages, and referring URLs

  • Cookie and tracking data (see Section 9 for our full Cookie Policy)

4. How We Use Your Information

4.1 Health and Clinical Purposes

We use your health information to:

  • Provide, coordinate, and document health care services

  • Communicate with other regulated health professionals involved in your care, with your consent or as permitted by law

  • Process referrals, lab requisitions, and diagnostic orders

  • Conduct health assessments, program enrollment, and program renewals

  • Manage cancellations, add-ons, and program modifications under your service agreement

4.2 Administrative and Business Purposes

We use your personal information to:

  • Process payments, issue receipts, and administer client accounts

  • Send appointment reminders, care updates, and program information

  • Respond to inquiries and provide customer support

  • Administer corporate wellness programs and employer-sponsored benefits

  • Maintain records as required by law or applicable professional standards

4.3 Marketing and Communications (With Consent)

With your express consent obtained in accordance with CASL, we may:

  • Send newsletters, health tips, and information about SABI Health programs or services

  • Notify you of promotions, events, or new clinic offerings

  • Communicate information relevant to your wellness journey

You may withdraw marketing consent at any time by clicking the unsubscribe link in any email, or by contacting our Privacy Officer. Withdrawal of marketing consent does not affect our ability to send transactional or care-related communications.

4.4 Research and Quality Improvement

We may use de-identified or anonymized information for internal quality assurance, service improvement, and aggregate analysis. Individually identifiable health information is not used for research purposes without your express written consent.

5. Disclosure of Your Information

5.1 Within the Care Team

We may share your health information with other regulated health professionals at SABI Health who are directly involved in your care, as necessary to deliver integrated services.

5.2 To Third-Party Service Providers

We engage trusted third-party vendors to support our operations. These providers are contractually bound to protect your information and may not use it for any other purpose. Categories include:

  • Electronic medical record (EMR) and health information platform vendors

  • Payment processors (billing and subscription management)

  • Cloud computing and data storage providers

  • Email, scheduling, and client communication platforms

  • Analytics and website performance tools

5.3 Legal and Regulatory Disclosure

We may disclose your information without consent where required or permitted by law, including:

  • In response to a court order, subpoena, or other legal process

  • To report a communicable disease or serious threat to public health as required by the Public Health Act (Alberta)

  • To regulatory bodies overseeing health professionals (e.g., the College of Physicians and Surgeons of Alberta)

  • Where necessary to prevent, detect, or investigate fraud or illegal activity

5.4 Corporate Transactions

In the event of a merger, acquisition, or sale of assets involving SABI Health, personal information may be transferred to the acquiring party as part of the transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

5.5 No Sale of Personal Information

SABI Health does not sell, rent, or trade personal information or health information to any third party for commercial gain.

6. Consent

SABI Health relies on your consent as the primary basis for collecting, using, and disclosing your personal information. Consent may be express (obtained explicitly in writing or electronically through our intake forms, program agreements, or digital sign-up flows) or implied (inferred from your actions, such as providing your contact information to book an appointment).

You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawal of consent for the collection or use of health information necessary to provide care may limit our ability to deliver health services to you.

Clients under the age of 18 require consent from a parent or legal guardian, unless they qualify as a mature minor capable of consenting to their own health care under applicable Alberta law.

7. Retention of Information

We retain health information in accordance with the minimum retention periods required under Alberta's HIA and applicable regulatory college standards:

  • Adult client health records: a minimum of 10 years from the last entry, or from the date the client was last seen

  • Pediatric client health records: a minimum of 10 years from the last entry, or until the client turns 18, whichever is later

Personal information no longer required for any identified purpose is securely destroyed or de-identified in accordance with our records retention schedule. Backup copies may be retained for a reasonable additional period as required for disaster recovery purposes.

8. Protection of Your Information

SABI Health implements administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including:

  • Encrypted data transmission (TLS/SSL) across all web-based interfaces

  • Role-based access controls limiting information access to authorized personnel on a need-to-know basis

  • Secure, password-protected electronic health record systems

  • Staff training on privacy obligations under the HIA and PIPA

  • Physical security controls at all clinic locations

  • Privacy and security assessments of material third-party vendors

No method of electronic transmission or storage is completely secure. While we take all commercially reasonable steps to protect your information, we cannot guarantee absolute security. In the event of a breach of security safeguards that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta (OIPC) as required by law.

9. Cookies and Website Tracking

Our website uses cookies and similar tracking technologies to enhance your browsing experience and gather aggregate analytics. Types of cookies we use include:

  • Essential cookies — required for the website to function properly (e.g., session management, security tokens)

  • Analytics cookies — help us understand how visitors interact with the website (e.g., Google Analytics)

  • Marketing and preference cookies — used to remember your preferences and, with your consent, deliver relevant content

You can manage your cookie preferences through your browser settings or our cookie consent banner. Disabling essential cookies may affect the functionality of certain pages. We do not currently respond to Do Not Track browser signals.

10. Your Rights

Subject to limited exceptions under applicable law, you have the right to:

  • Access — request a copy of the personal or health information we hold about you

  • Correction — request correction of inaccurate, incomplete, or outdated information

  • Withdrawal of consent — withdraw consent for non-essential collection and use of your information at any time

  • Complaint — file a complaint with our Privacy Officer or with the OIPC if you believe your privacy rights have been violated

To exercise these rights, please submit a written request to our Privacy Officer (see Section 12). We will respond within 30 days of receiving a complete request, and may extend this deadline by an additional 30 days where required by the complexity of the request. Access requests for health records may be subject to a reasonable administrative fee in accordance with the HIA.

11. Cross-Border Transfers

Some of our third-party service providers may store or process your information outside of Canada, including in the United States. Where information is transferred internationally, it may be subject to the laws of the jurisdiction in which it is processed, which may differ from Canadian privacy law.

We take steps to ensure that any international transfers are protected by appropriate contractual safeguards. Where required, we will obtain your consent prior to cross-border transfers of health information.

12. Contact Our Privacy Officer

If you have questions, concerns, or requests relating to this Privacy Policy or our privacy practices, please contact our designated Privacy Officer:

Privacy Officer — SABI Health Inc.

Email:  privacy@sabi.health

Website:  www.sabi.health

Jurisdiction:  Alberta, Canada

You may also file a complaint directly with the Office of the Information and Privacy Commissioner of Alberta (OIPC):

13. Changes to This Privacy Policy

SABI Health reserves the right to amend this Privacy Policy at any time. Material changes will be communicated through a notice on our website at www.sabi.health and, where appropriate, by direct communication to affected individuals. The revised policy will take effect on the date posted unless otherwise stated.

We encourage you to review this Privacy Policy periodically. Your continued use of our website or services following the posting of changes constitutes your acceptance of such changes.

14. Governing Law

This Privacy Policy and our privacy practices are governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein. Any disputes arising from or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Alberta.

SABI Health Inc.  |  www.sabi.health  |  privacy@sabi.health

© 2026 SABI Health Inc. All rights reserved.  Effective April 1, 2026.