PRIVACY POLICY

Effective date: August 1st, 2018 Last updated: August 14, 2026

1. About this policy

BOWO Creative Inc. (“BOWO Creative”, “we”, “us”, “our”) is a marketing agency serving the medical aesthetics industry. We are registered in Canada.

This policy explains how we collect, use, disclose and protect personal information when you:

• visit bowocreative.com, go.bowocreative.com, or any of our landing pages or funnels;
• submit an enquiry, book a call, or complete a form;
• subscribe to our emails, text messages, or podcast list;
• purchase or use our services, programs or materials; or
• interact with us on social media or by email.

This policy does not apply to personal information we process on behalf of our clients. See §16.

2. Our two roles

As a controller. For our own marketing, sales and business operations, we determine why and how personal information is used. This policy governs that.

As a service provider. When delivering services to a client, we process personal information, which may include the client’s patient or customer data, at the client’s instruction and on the client’s behalf. In those cases, the client is the controller, their privacy policy applies, and our handling is governed by our written client agreement, a Data Processing Agreement, and where applicable a HIPAA Business Associate Agreement. See §16.

3. Personal information we collect

We do not knowingly collect government identification numbers, financial account numbers, or health information about you through our website. Please do not include patient information or any health information in a form or email to us. If you need to share that with us, we will provide a secure channel under the appropriate agreement.

4. How we collect it

• Directly from you — forms, calls, emails, texts, contracts, events.
• Automatically — cookies, pixels, server logs, and analytics tools when you use our sites, subject to your consent choices.
• From third parties — advertising platforms, our CRM, referral partners, publicly available business sources, and social media platforms where you engage with us.

5. Why we use it, and our lawful basis

We limit collection to what is necessary for these purposes. We do not collect personal information indiscriminately.

6. Marketing communications

Email. We send marketing email only with your consent, consistent with Canada’s Anti-Spam Legislation (CASL) and the US CAN-SPAM Act. Every message includes an unsubscribe link and our mailing address. Unsubscribing is honoured promptly.

Text messages. Where you provide a mobile number and give express written consent, we may send marketing and service messages, including messages sent using automated systems.

• Consent to receive texts is not a condition of purchasing anything.
• Message frequency varies. Message and data rates may apply.
• Reply STOP to unsubscribe or HELP for assistance.
• We do not sell, rent or share mobile numbers or SMS consent with third parties for their own marketing.

Service communications. Even if you opt out of marketing, we may still send messages necessary to administer a service you have purchased.

7. Cookies, pixels and tracking

We use cookies and similar technologies, including third-party advertising and analytics tools such as the Meta Pixel.

Strictly necessary cookies — required for the site to function — are set automatically.

Analytics and advertising cookies and pixels are set only after you give consent through our cookie banner. You can change or withdraw consent at any time via Cookie Settings, or by using your browser controls.

We honour recognized opt-out signals, including Global Privacy Control (GPC), where applicable law requires it.

Disabling cookies may affect how parts of the site work.

Note on health-related advertising. We do not use tracking technologies on our own site to infer health conditions or treatment interest about you. Where we operate advertising for clinic clients, tracking is configured under that client’s instructions and their own compliance obligations — see §16.

8. Artificial intelligence and automated processing

We use AI and automated systems in our marketing and client delivery, including automated replies to enquiries, message drafting, lead routing and scheduling.

• Automated systems may process your contact details and the content of your messages in order to respond and schedule.
• We do not make decisions producing legal or similarly significant effects about you solely by automated means. A person reviews any decision about whether to work with you.
• You may ask for a human review of any automated interaction, and for information about the principal factors involved, by contacting our Privacy Officer.
• We do not use your personal information to train publicly available AI models.

9. Who we share information with

We do not sell or rent personal information. We do not share personal information, including phone numbers or SMS consent, with third-party marketers or data brokers for their own purposes.

We also disclose personal information where required by law, to comply with legal process, to protect our rights or property, to protect the safety of any person, or in connection with a merger, acquisition or sale of assets (in which case we will notify you).

10. Cross-border transfers

We are based in Canada. Several of our service providers store and process data in the United States and other countries. Personal information transferred outside Canada may be accessible to courts, law enforcement and national security authorities in those jurisdictions under their laws.

Before engaging a provider, we assess the privacy risk of the transfer and use contractual protections requiring a comparable level of protection. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

By using our services, you acknowledge this cross-border processing.

11. Retention

We keep personal information only as long as necessary:

When no longer needed, we securely delete or irreversibly de-identify it.

12. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, multi-factor authentication on business systems, vendor due diligence, and confidentiality obligations for team members and contractors.

Access is limited to those who need it to do their job.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and you share information with us at your own risk.

13. Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, and will keep records of breaches as required by law. Where other privacy laws apply, we will meet those notification requirements as well.

14. Your rights

Subject to applicable law, you may:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your personal information
• Withdraw consent at any time, including for marketing
• Port your information in a structured, commonly used technical format
• Object to or restrict certain processing
• Not be discriminated against for exercising your rights
• Opt out of targeted advertising, sale, or sharing of personal information
• Appeal a refusal of your request
• Request human review of automated processing

How to exercise them. Email tracey@bowocreative.com with “Privacy Request” in the subject line. We will verify your identity and respond within 30 days (or such shorter period as your local law requires). If we refuse a request, we will explain why and how to appeal or complain.

Region-specific notes:

• Canada (PIPEDA): you may complain to the Office of the Privacy Commissioner of Canada.
• Quebec (Law 25): you have rights to data portability, to be informed of automated decision-making, and to complain to the Commission d’accès à l’information.
• US states: residents of states with comprehensive privacy laws — including California, Colorado, Connecticut, Virginia, Texas, Oregon, Indiana, Kentucky, Rhode Island and others — have rights to know, delete, correct, opt out of targeted advertising and sale/sharing, and to appeal. We do not sell personal information as that term is defined under these laws.
• Washington and Nevada: these states regulate “consumer health data” broadly. We do not collect consumer health data about you through our website. Where such data is processed in client work, see §16.
• EU/UK: where GDPR or UK GDPR applies, you also have the right to lodge a complaint with your supervisory authority.

15. Children

Our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact our Privacy Officer and we will delete it.

16. Information we process for clients

When we deliver services to a clinic or other client, we may process personal information about that client’s patients, customers or prospects.

In those circumstances:

• Our client is the controller. We act on their documented instructions.
• Their privacy policy governs, not this one. Direct requests about that data to them.
• Our handling is governed by our written client agreement and a Data Processing Agreement.
• Where a client is a HIPAA covered entity and we handle Protected Health Information, our handling is additionally governed by a Business Associate Agreement. We do not accept PHI without one in place.
• We do not use client data for our own marketing purposes, and we do not combine it with our own marketing databases.
• We return or securely delete client data at the end of an engagement, subject to legal retention requirements.

17. Third-party sites and platforms

Our sites and materials may link to third-party websites and platforms. We do not control their privacy practices and are not responsible for them. Review their policies before providing information.

Where you make information publicly visible — for example in a review, comment or social post — it can be seen, collected and used by others. We cannot control or be responsible for that.

18. Changes to this policy

We may update this policy. The “Last updated” date will change, and material changes will be notified by email or a prominent notice on our site. Where required, we will seek your consent again.

19. Privacy Officer

We have designated a Privacy Officer responsible for compliance with this policy and applicable privacy law.

Privacy Officer — BOWO Creative Inc. Email: tracey@bowocreative.com General enquiries: hello@bowocreative.com Mailing address:  4711 Yonge St 10th Floor, North York, ON M2N 7E4