Privacy Policy

Last Updated: August 21, 2026

Xsanté ("Xsanté," "we," "us," or "our") is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us.

This Privacy Policy explains how Xsanté and the services and brands operating within the Xsanté health, wellness and fitness centre collect, use, disclose, retain and protect personal information when you visit our websites or facilities, create an account, become a member, purchase or use our services, communicate with us, or otherwise interact with Xsanté.

1. Xsanté and Our Brands

Xsanté is an integrated health, wellness and fitness centre in Montréal, Quebec. Xsanté brings together several specialized services and brands within a common wellness environment.

For the purposes of this Privacy Policy, references to "Xsanté," "we," "us," "our," or "our services" may include Xsanté and the following brands, services and operating areas, as applicable:

• PilatesX, a reformer Pilates studio offering Pilates classes, instruction and related services;
• MedX, a medical clinic providing medical consultations, assessments, therapies and other health-related services;
• CoreX, a fitness and training centre offering exercise, training and related fitness services;
• CryoX, a cryotherapy and recovery service offering cryogenic and related wellness or recovery services; and
• Other health, wellness, fitness, recovery, nutrition, supplement or related products and services offered by Xsanté from time to time.

Some services, particularly those provided through MedX or by regulated healthcare professionals, may be subject to additional privacy, confidentiality, record-keeping and professional requirements. Where those requirements provide greater protection than this Privacy Policy, those requirements will apply.

Our privacy practices are designed to comply with applicable Canadian and Quebec privacy legislation, including Quebec's Act respecting the protection of personal information in the private sector, as amended, including by Law 25, and other applicable privacy and health-information requirements.

2. Personal Information We Collect

The personal information we collect depends on how you interact with Xsanté and which Xsanté brands and services you use.

Contact and Identification Information

We may collect information such as:

• Name
• Email address
• Telephone number
• Mailing address
• Date of birth or age, where required
• Preferred language
• Emergency contact information
• Other information you provide when communicating with us

Account and Membership Information

Xsanté may provide a common account, membership or sign-in experience for some or all Xsanté services.

If you create an account, become a member or register for a service, we may collect:

• Username and account credentials
• Membership type and status
• Xsanté brands, programs or services associated with your account
• Class, appointment and session bookings
• Attendance and participation history
• Membership start, renewal and cancellation dates
• Account preferences
• Communications and support history

Depending on the services offered, your Xsanté account may allow you to interact with multiple Xsanté brands using a common account or profile.

Passwords are intended to be stored using appropriate security measures and should not be accessible to Xsanté personnel in plain text.

Transaction and Payment Information

When you purchase a membership, service, session, treatment, supplement, product or other offering from Xsanté, PilatesX, MedX, CoreX or CryoX, we may collect information relating to the transaction, including:

• Billing information
• Transaction history
• Products and services purchased
• Payment status
• Refunds, credits or adjustments
• Membership or package information

Payments may be processed by third-party payment processors. Depending on the payment method used, Xsanté may not directly receive or store complete credit or debit card information.

Fitness and Pilates Information

When necessary to provide services through PilatesX, CoreX or other Xsanté fitness and wellness programs, we may collect information such as:

• Fitness goals
• Training history
• Physical measurements
• Exercise preferences
• Performance information
• Pilates or fitness experience
• Injuries, mobility issues or physical limitations you choose to disclose
• Information relevant to safely participating in a program or service

Cryotherapy and Recovery Information

When you use CryoX or other recovery services, we may collect information necessary to determine your eligibility for, safely administer and maintain records concerning the requested service.

This may include:

• Information about relevant health conditions
• Contraindications
• Injuries
• Previous experience with cryotherapy or recovery treatments
• Information you provide through screening or waiver forms
• Treatment or session history

Where information collected in connection with CryoX constitutes sensitive health information, we apply safeguards appropriate to its sensitivity.

Health and Medical Information

MedX provides medical and health-related services.

Where necessary to provide these services, MedX or healthcare professionals practising through MedX may collect sensitive health and medical information such as:

• Medical history
• Current health conditions
• Symptoms
• Medications
• Allergies
• Laboratory or diagnostic information
• Hormone levels and related health information
• Information concerning testosterone or other hormone-related assessments or therapies
• Treatment history
• Information relevant to determining eligibility for a medical treatment or service
• Clinical notes
• Assessments
• Prescriptions
• Treatment plans
• Referrals
• Other information provided to or generated by a healthcare professional

Health and medical information is particularly sensitive and will be subject to safeguards and access restrictions appropriate to its sensitivity and as required by applicable law and professional obligations.

Healthcare professionals providing services through MedX may also have independent legal and professional obligations concerning patient records, confidentiality, consent and the protection of health information.

Where applicable, the collection, use, disclosure and retention of information by those professionals may also be governed by professional standards, regulatory requirements or additional consent documentation.

Product and Supplement Purchases

If Xsanté offers supplements, nutrition products or other retail products, we may collect information relating to:

• Products purchased
• Order and transaction history
• Delivery information, where applicable
• Product preferences
• Communications concerning an order or product

If information about supplement use is collected by a healthcare professional as part of medical care, that information may form part of the individual's medical record and will be treated accordingly.

Communications

If you contact Xsanté, PilatesX, MedX, CoreX or CryoX by email, telephone, web form, social media, chat or another method, we may collect the information contained in your communication and information necessary to respond to your request.

Website and Device Information

When you use an Xsanté website or other digital service, certain information may be collected automatically, including:

• IP address
• Browser type
• Device type
• Operating system
• Pages visited
• Date and time of visits
• Referring website or source
• Links or features used
• General interaction with our websites
• Approximate geographic location derived from an IP address
• Cookie and similar technology identifiers

Some of this information may constitute personal information under applicable law.

3. How We Use Personal Information

Xsanté collects and uses personal information only for legitimate purposes related to our activities and services.

Depending on your relationship with Xsanté and the brands or services you use, these purposes may include:

• Creating and managing Xsanté accounts
• Creating and managing memberships
• Managing access to PilatesX, CoreX, CryoX, MedX or other Xsanté services
• Processing membership applications and renewals
• Scheduling classes, appointments and services
• Providing Pilates, fitness, training, wellness and recovery services
• Providing medical or health-related services
• Assessing suitability or eligibility for particular programs, treatments or services
• Processing purchases, payments and refunds
• Managing purchases of supplements and other products
• Communicating about appointments, classes, memberships, transactions or services
• Sending service notifications and administrative communications
• Responding to questions, requests and customer service inquiries
• Personalizing services and the member experience
• Maintaining records required for business, medical, regulatory or legal purposes
• Improving our facilities, services, websites and digital experiences
• Conducting internal reporting, analytics and business planning
• Maintaining the safety and security of our members, patients, customers, staff, facilities and technology
• Detecting or preventing fraud, misuse or security incidents
• Meeting legal, regulatory and professional obligations
• Obtaining feedback and measuring member or customer satisfaction
• Sending marketing communications where permitted by law
• Advertising and measuring the effectiveness of marketing campaigns, subject to applicable consent requirements

We will not use sensitive personal information for materially different purposes without obtaining appropriate consent unless otherwise permitted or required by law.

4. Information Shared Across Xsanté Services

Because Xsanté operates an integrated health, wellness and fitness environment, certain administrative information may be used across Xsanté and its brands where necessary to provide an integrated member or customer experience.

For example, common information may include:

• Your name and contact information
• Your Xsanté account
• Membership status
• Billing information
• Account preferences
• Services or memberships you have purchased
• Scheduling information
• Customer service history

Access to information within Xsanté is limited according to an individual's responsibilities and legitimate need to access that information.

Medical and Clinical Information

Medical and clinical information receives additional protection.

Information contained in a MedX medical or clinical record will not automatically become part of a general Xsanté, PilatesX, CoreX or CryoX customer profile simply because those services operate within the same facility or Xsanté environment.

Access to medical information will be restricted to authorized healthcare professionals and other individuals who require access for legitimate clinical, administrative, legal or regulatory purposes.

For example, a PilatesX instructor or CoreX trainer will not receive access to a member's MedX medical record merely because the person also uses PilatesX or CoreX.

Where sharing information between a healthcare professional and another Xsanté service would assist in providing a requested service, we will obtain appropriate consent or establish another lawful basis for the disclosure where required.

5. Consent

Where consent is required, Xsanté seeks consent appropriate to the nature and sensitivity of the information and the purposes for which it will be used.

For particularly sensitive information, including certain medical or health information, express consent may be requested.

By voluntarily providing personal information for an identified purpose, you may consent to its collection, use and disclosure for that purpose where permitted by law.

You may withdraw your consent to certain uses of your personal information, subject to legal, regulatory, professional or contractual restrictions and reasonable notice.

Withdrawal of consent may affect our ability to provide certain services. For example, MedX may be unable to provide a medical service if you do not consent to the collection and use of information necessary to safely provide that service.

6. Accounts, Memberships and Sign-In

Certain Xsanté services may require you to create an account or sign in.

Where available, an Xsanté account may provide access to services offered by more than one Xsanté brand.

You are responsible for maintaining the confidentiality of your account credentials and should not share your password with others.

Information associated with your account may be used to:

• Authenticate your identity
• Manage your membership
• Identify services associated with your account
• Display classes, bookings and appointments
• Maintain your preferences
• Process transactions
• Provide personalized services
• Maintain records of your interactions with Xsanté

Where appropriate, we may use additional authentication or security measures to protect accounts containing or providing access to sensitive information.

If you believe your account has been accessed without authorization, please contact us promptly.

7. Cookies and Similar Technologies

Xsanté websites and digital services may use cookies, pixels, tags, local storage and similar technologies.

These technologies may be used for purposes including:

• Operating essential website functionality
• Maintaining sessions and sign-in status
• Remembering user preferences
• Maintaining website security
• Understanding how visitors use our websites
• Measuring website performance
• Identifying technical problems
• Measuring marketing and advertising performance
• Delivering or measuring relevant advertising, where permitted

Essential Cookies

Some cookies and technologies are necessary for our websites or services to function properly. These may be used for security, authentication, account management, load balancing and similar essential purposes.

Analytics Cookies

With appropriate consent where required, we may use analytics technologies to understand how visitors interact with our websites and improve their performance.

Advertising and Marketing Technologies

With appropriate consent where required, we may use technologies provided by advertising and marketing platforms to measure advertising effectiveness or understand whether someone who interacted with an advertisement subsequently visited an Xsanté website or completed an action.

These providers may include Google, Meta and other advertising, analytics and marketing technology providers.

Where required by applicable law, non-essential cookies and similar technologies will not be activated until you have made the applicable privacy choice or provided the required consent.

You may manage non-essential cookies through our cookie consent tool and through your browser settings. Disabling certain technologies may affect some website functionality.

8. Marketing Communications

If you choose to receive promotional communications from Xsanté, we may use your contact information to send information about Xsanté and its brands, including PilatesX, MedX, CoreX and CryoX.

Communications may include information about:

• Xsanté services and memberships
• PilatesX classes and programs
• CoreX fitness programs and memberships
• CryoX services
• MedX services, subject to applicable legal and professional restrictions
• New services
• Special offers and promotions
• Events
• Health, fitness and wellness content
• Products and supplements
• Other Xsanté news

We will obtain consent to send commercial electronic messages where required by Canada's Anti-Spam Legislation ("CASL") or other applicable law.

You may unsubscribe from promotional emails using the unsubscribe mechanism provided in those communications or by contacting us.

Unsubscribing from marketing communications will not prevent us from sending transactional, clinical or service-related communications necessary to administer your account, membership, appointments, purchases or other relationship with Xsanté.

We will not use sensitive medical or clinical information to target marketing communications unless such use is specifically permitted by applicable law and supported by appropriate consent.

9. How We Share Personal Information

We do not sell personal information.

We may disclose personal information to third parties where necessary to operate our business, provide requested services, comply with legal obligations or where you have provided appropriate consent.

These third parties may include:

• Payment processors
• Membership and facility management platforms
• Scheduling and appointment systems
• Website hosting and technology providers
• Cloud storage and data hosting providers
• Email, SMS and communications providers
• Customer relationship management providers
• Analytics providers
• Advertising and marketing technology providers
• Professional advisors such as accountants, auditors, lawyers and insurers
• Healthcare professionals involved in providing your care
• Laboratories, pharmacies and other healthcare providers where necessary and authorized
• Regulatory authorities, professional bodies or government agencies where required by law

We seek to limit information disclosed to service providers to what is reasonably necessary for them to perform their services.

Service providers handling personal information on our behalf are expected to maintain appropriate safeguards and use the information only for authorized purposes.

10. Information Processed Outside Quebec or Canada

Some of Xsanté's technology and service providers may process or store personal information outside Quebec or outside Canada.

As a result, personal information may be subject to the laws of another jurisdiction and may, where legally permitted, be accessible to courts, law enforcement or government authorities in that jurisdiction.

Before communicating personal information outside Quebec, Xsanté will take the measures required by applicable Quebec privacy legislation, including conducting a privacy impact assessment where required and implementing appropriate contractual or other safeguards.

11. Retention of Personal Information

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected and to satisfy applicable legal, regulatory, contractual, accounting and professional requirements.

Different categories of information may have different retention periods.

Medical records maintained by MedX or healthcare professionals may be subject to specific retention requirements established by legislation, professional orders or standards governing healthcare professionals.

When personal information is no longer required, we will securely destroy it, delete it or anonymize it in accordance with applicable law and our retention practices.

12. Security

Xsanté uses administrative, technical and physical safeguards designed to protect personal information against unauthorized access, loss, theft, misuse, disclosure, alteration or destruction.

Depending on the nature and sensitivity of the information, safeguards may include:

• Access controls
• Authentication controls
• Encryption where appropriate
• Secure technology infrastructure
• Restricted employee access
• Staff confidentiality obligations
• Security monitoring
• Vendor security requirements
• Backup and recovery procedures
• Policies and procedures governing personal information

Access to personal information is limited to individuals who require the information to perform their duties or provide services.

Medical and other sensitive health information may be subject to additional access controls and safeguards.

No electronic system or method of storage or transmission can be guaranteed to be completely secure. We therefore continually assess and improve safeguards appropriate to the sensitivity of the information we maintain.

13. Privacy and Medical Information

Information relating to an individual's health can be highly sensitive.

Xsanté and healthcare professionals providing services through MedX will take appropriate steps to ensure that medical information is accessible only to individuals who require access for authorized purposes.

Medical information will not be made available to PilatesX instructors, CoreX trainers, marketing personnel or other individuals merely because they work within Xsanté.

Where information needs to be shared between different Xsanté services or healthcare professionals, appropriate consent or another lawful basis will be obtained or established as required.

Information collected through CryoX, PilatesX or CoreX that constitutes sensitive health information will also be protected according to its sensitivity and applicable legal requirements.

14. Automated Technologies and Profiling

Xsanté may use technology to personalize digital experiences, analyze service usage or make recommendations.

If we use technology that includes functions allowing an individual to be identified, located or profiled, we will provide the notices and choices required under applicable Quebec privacy legislation.

Where applicable, privacy settings will be configured in accordance with Quebec's privacy-by-default requirements.

We will provide additional information where required if a decision about an individual is made exclusively through automated processing of personal information.

15. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Withdraw consent to certain uses or disclosures
• Request information about how your personal information is used
• Request information about categories of individuals who have access to your information within our organization
• Ask about the length of time information will be retained
• Request that dissemination of certain personal information cease where applicable
• Request de-indexing or re-indexing in circumstances provided by law
• Request portability of certain computerized personal information in circumstances provided by law
• Submit a complaint concerning our privacy practices

Certain rights may be subject to exceptions under applicable law, including requirements relating to medical, legal, regulatory or business records.

We may take reasonable steps to verify your identity before responding to a privacy request.

16. Privacy of Minors

Some Xsanté services may be intended primarily for adults, particularly certain medical services.

Where we collect personal information from minors, we will comply with applicable requirements regarding consent.

For individuals under 14 years of age in Quebec, consent to the collection, use or disclosure of personal information will be obtained from a parent or person exercising parental authority where required by law.

Additional age restrictions may apply to particular Xsanté, PilatesX, MedX, CoreX or CryoX services.

17. Confidentiality Incidents and Data Breaches

Xsanté maintains procedures for responding to confidentiality and security incidents involving personal information.

Where an incident presents a risk of serious injury as defined under applicable Quebec privacy legislation, we will notify affected individuals and the Commission d'accès à l'information du Québec as required by law.

We maintain records of confidentiality incidents as required by applicable legislation.

18. Third-Party Websites and Services

Xsanté websites may contain links to third-party websites, applications or services.

Those third parties operate independently from Xsanté and may have their own privacy policies and practices. Xsanté is not responsible for the privacy practices of third-party websites or services that are not under our control.

We encourage you to review their privacy policies before providing personal information.

19. Business Transactions

If Xsanté undergoes or considers a business transaction such as a merger, acquisition, financing, reorganization or sale of some or all of its assets, personal information may be disclosed or transferred as permitted by applicable law and subject to appropriate confidentiality and privacy protections.

20. Privacy Governance

Xsanté maintains policies and practices governing the protection of personal information throughout its lifecycle, including its collection, use, disclosure, retention and destruction.

These practices include measures addressing:

• Employee roles and responsibilities
• Access to personal information
• Information security
• Retention and destruction
• Service providers
• Confidentiality incidents
• Privacy complaints and requests
• Privacy impact assessments where required

21. Person Responsible for the Protection of Personal Information

Xsanté has designated a person responsible for overseeing compliance with applicable privacy requirements and responding to privacy-related questions, requests and complaints.

Privacy Officer / Person Responsible for the Protection of Personal Information

Xsanté
5329 Ferrier Street
Town of Mount Royal, Quebec
Canada

Email: Pilatesx@xsante.ca

Individuals wishing to exercise their privacy rights should submit their request to the Privacy Officer using the contact information above.

22. Questions and Complaints

If you have questions about this Privacy Policy, our handling of personal information or wish to make a privacy-related complaint, please contact our Privacy Officer.

We will investigate privacy complaints and respond in accordance with applicable law.

You may also have the right to contact the Commission d'accès à l'information du Québec regarding a privacy concern.

23. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our brands, services, technologies, business practices or legal obligations.

When material changes are made, we will provide notice as required by applicable law.

The date at the top of this Privacy Policy indicates when it was most recently updated.

We encourage you to review this Privacy Policy periodically.