Privacy Policy

Merba (“Merba”, “we”, “our”, or “us”) is a business platform operated from Ontario, Canada by Merba Corp. Merba provides scheduling, booking, client management, payments routing, discovery, intelligence, marketing, and related operational tools for independent clinics, salons, trades, mobile service operators, and service businesses.

This policy explains how we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Ontario privacy law, and other privacy rules that may apply depending on how you use Merba. Merba provides privacy and security controls that customers can use as part of PIPEDA, PHIPA, or HIPAA-oriented workflows when the required signed terms, operational controls, and tenant-side obligations are in place. This policy is not legal advice and does not certify any specific customer's use of Merba.

Merba processes some information for our own business operations, such as account registration, security, billing for Merba subscriptions and credits, support, fraud prevention, and platform improvement. We also process information on behalf of tenant businesses that use Merba to run their own operations.

When a tenant business enters client records, appointment details, chart notes, quotes, invoices, job logs, material serial numbers, photos, attachments, or similar records into Merba, that business remains responsible for its own collection, consent, notices, staff permissions, retention, access, correction, and professional obligations. Merba acts as a service provider supporting that business. If the tenant is a regulated health provider or health information custodian, it must determine and manage its own PHIPA or other health privacy obligations.

For sensitive operational records, Merba's role is deterministic platform processing: authenticated storage, tenant scoping, booking logic, charting workflows, approvals, quotes, invoices, job logs, exports, notifications, and payment-metadata routing. These workflows are not AI decision systems and are kept separate from Merba's intelligence, ad, and media-generation features.

• Account information, including name, email address, password hash, phone number, session data, verification codes, and security settings.
• Business information, including business name, address, phone number, website, service list, prices, staff profiles, booking settings, discovery listing details, and uploaded branding.
• Client and booking information entered by a tenant business or its clients, including names, contact details, appointments, appointment notes, preferences, opt-outs, and booking history.
• Quote and invoice information, including line items, catalog categories, selectable options, quote acceptance status, deposits, balances, taxes, business or tax numbers, customer-facing notes, terms and conditions, payment status, and document delivery records.
• Job-log information, including job notes, photos, attachments, service history, material details, serial numbers, warranty-support records, and exported job documents where a tenant business chooses to use those features.
• Charting information, if a business chooses to use charting, including chart notes, treatment records, linked appointments, approval records, approver names/emails, signatures, and exported chart PDFs.
• Payment and billing metadata, including Merba subscription status, included and purchased member allowances, workspace membership used to enforce those allowances, billing-change confirmations and payment reconciliation records, credit purchases, tenant invoice and quote payment records, connected payment account identifiers, checkout/payment identifiers, refund/dispute metadata, payout metadata, and limited card metadata supplied by the payment processor. Supported business gift-card checkout also uses the purchaser's email, purchase amount, payment/refund references and status to confirm payment, issue a receipt and maintain gift balances. Necessary checkout information is shared with the business's connected Stripe or Square processor; raw card details are entered with the processor rather than stored in Merba.
• Commercial enrollment and electronic-signature evidence, including agreement versions and hashes, signer names, titles and emails, authority and consent confirmations, signature timestamps, IP addresses, user agents, invoice references, approval status, and withdrawal history.
• Communications information, including transactional emails, SMS and portal message content, sender and recipient details, delivery status, opt-outs, support messages, and approval or booking notifications. SMS billing records include confirmed segments, quoted rates, reservations, charges, payment references, and the version, time and account associated with usage-term acceptance.
• Client-access records, including business-specific invitations, verified account and phone relationships, access revocations and photo-sharing choices. Gift-card records include the issuing business, code, recipient details, value, balance, recorded payment references, redemptions and refunds.
• Intelligence and ad-generation inputs, including business context, website content you ask us to use, service and pricing data, minimized or derived calendar, capacity, demand, quote, invoice, return-window and outcome signals, owner constraints and corrections, prompts, recommendations, decisions, execution records, generated media, and ad-production job records.
• Technical and security data, including IP addresses, user agents, rate-limit records, logs, error reports, audit logs, cookies, and device/browser information.

Merba can store PHI-capable records when a tenant business uses charting, approval, appointment, invoice, or note fields for health-related services. Merba does not decide whether a record is personal health information under PHIPA; the tenant business must assess its own use case.

Charting records are tenant-scoped and access-controlled through authenticated memberships, plan gates, and role/permission checks. Chart notes are stored in Merba's database and transmitted over TLS. Chart PDFs are generated through authenticated routes. Merba maintains privacy audit logs for selected chart and client-profile access, creation, update, deletion, and denied attempts, with audit metadata designed not to duplicate note content, signatures, or contact details.

Chart notes, chart approvals, chart PDFs, clinical records, client notes, payment card details, and broad client lists are prohibited inputs to ad creation, market intelligence, and ad AI prompts. Host provider calls use a sensitive-data boundary that blocks high-confidence PHI-labeled payloads before they reach AI providers. Because user-entered free text can contain sensitive information, customers should not type health information into ad, marketing, or public prompt fields.

Client access is scoped to a verified account and its individual relationship with the selected business. Clients can see their permitted appointments, linked active gift cards, photos explicitly shared by that business and internal portal messages. The portal does not disclose other clients' records, staff-only chart notes or the business workspace. Internal messaging requires no SMS activation or phone verification. Access to optional text conversations additionally verifies the phone on file and checks that it belongs to one client relationship within that business; matching an unverified email or phone alone does not grant access.

Business-client emails sent through Merba, their delivery status and replies to the designated conversation address may appear in the business inbox and the verified client's portal. Email history is bound to the individual client record and its email address. Email delivery uses our email provider; it does not connect or read the business's existing Google or other mailbox. An email reply does not verify identity or grant portal access. Keep sensitive treatment details in the secure client record.

Businesses control staff access, client invitations and the choice to share or withdraw individual photos. Before-and-after and other sensitive photos require appropriate consent and purpose limits. Portal sharing does not grant permission to use the image in an advertisement or a public portfolio. Revocation blocks future access through Merba but cannot recall downloaded copies.

Twilio and communications carriers process phone numbers, message content and delivery information when SMS is used. SMS does not provide the same access controls as the authenticated portal; do not send confidential clinical details or sensitive photos by SMS. Portal-only messages are stored in Merba and do not create an SMS charge or automatically send a carrier text. Phone verification and opting into business texting do not authorize unrelated marketing.

• To provide, secure, support, and improve the Merba platform.
• To authenticate users, enforce tenant membership, and protect accounts.
• To run scheduling, booking, client, charting, quote, invoice, job-log, payment, discovery, and communication features.
• To route tenant customer payments by invoice/e-transfer or, when the business connects a supported payment processor, by card through its connected payment account, and to process Merba-owned subscriptions, credits, and add-ons through Merba's payment account.
• To generate ads, market intelligence, and business recommendations when you choose to use those features.
• To send transactional email and SMS messages, such as booking notices, account notices, reminders, approval requests, and support responses.
• To detect abuse, troubleshoot failures, maintain audit records, and comply with legal obligations.
• To evidence signed commercial addenda, deliver electronic copies, administer optional paid features, resolve billing disputes, and preserve proof of authorization.
• To use de-identified, aggregated, or derived operational and quality signals to improve Merba's product, taxonomies, prompts, QA systems, and market/category knowledge.

We do not sell personal information. We do not use client records, chart notes, health records, payment card data, or tenant customer contact lists for third-party advertising.

Merba uses AI and model providers for selected intelligence features, including Guardian Pro decision support, ad creation, market analysis and generated media. These features use user-directed or user-approved prompts, business context such as service lists, pricing, website content, public market context, and minimized or derived tenant-scoped operational signals. Merba may compute those signals from protected booking, quote, invoice, job-log, payment, or client-record workflows inside the application. External model providers do not receive broad client lists, raw chart or clinical records, payment card details, or unnecessary direct client identifiers for Guardian, ad, or market analysis.

Merba does not use personal data, client records, chart notes, health records, payment card data, or chart approvals to train third-party foundation models. Merba may use de-identified, aggregated, or derived operational and quality signals to improve Merba-owned systems. More detail is available in the Intelligence Policy.

Guardian Pro may prepare recommendations, forecasts, segments, and draft actions, but Merba does not rely on a model output alone to automatically contact a client, change a price, publish content, spend money, reschedule an appointment, issue a refund, or complete another material external action. Enabled execution remains subject to tenant permissions, deterministic controls, and authorized-user review. Owners may inspect evidence, correct business context, dismiss a recommendation, or discontinue the add-on.

Merba relies on service providers for hosting, database storage, object storage, payments, SMS, email, error monitoring, maps, integrations, AI/model processing, generated media, and similar functions. These providers may process information outside Canada, including in the United States, Europe, or other jurisdictions where local authorities may have lawful access rights. We review cross-border processing in light of guidance from the Office of the Privacy Commissioner of Canada.

Current provider names, use cases, and data boundaries are summarized in the Subprocessor Register. Agreement details, security documentation, and region-specific terms are available upon request where appropriate.

We keep personal information for as long as needed to provide the service, maintain security and audit records, resolve disputes, comply with legal obligations, support tax/payment, quote, invoice, warranty, and job-log records, and operate requested features. Retention periods vary by data type.

Inbox email, SMS and portal message bodies become unavailable in Merba after 72 hours and are removed through scheduled cleanup. Related billing, delivery, consent, fraud-prevention and audit metadata may remain longer for reconciliation and legal obligations without retaining message bodies in the SMS financial ledger. Communications providers and external mailboxes have their own retention practices. This short inbox window does not delete appointment histories, chart notes, shared job photos, gift-card balances or financial records; those follow their respective retention rules. Clients and businesses should preserve necessary service or clinical records in the appropriate workflow.

Account export features do not necessarily include every specialized record in one file. For example, chart-note PDFs, quote PDFs, invoice PDFs, and job exports can be exported through their related workflows and may be separate from general account exports. Retention and deletion handling depends on the record type, legal obligations, backup lifecycle, audit requirements, and tenant-controlled workflows.

You can request access, correction, or deletion by contacting privacy@merba.app. End clients of a tenant business should usually contact that business first, because the business controls the client relationship and may have legal or professional retention duties.

Merba uses technical and organizational safeguards for personal information, including:

• TLS encryption in transit.
• Password hashing with bcrypt.
• Secure, HTTP-only session cookies.
• Tenant membership checks and role/permission checks for workspace routes.
• Rate limiting and abuse controls for sensitive endpoints.
• Audit logging for selected sensitive actions, including chart and client-profile access.
• Private server-side handling for chart PDF exports and authenticated routes for sensitive tenant media.

No electronic system is perfectly secure. If we discover a privacy or security incident, we will investigate, contain it, keep appropriate records, and notify affected businesses, individuals, service providers, or regulators where required. Our breach-response approach is informed by OPC guidance on PIPEDA breach reporting and Ontario IPC guidance for health privacy breaches.

Merba uses cookies and similar technologies required for authentication, security, preferences, and limited analytics or referral measurement. You can manage cookies in your browser, but disabling required cookies can break sign-in and core platform functionality.

If you accept optional cookies, Merba may use Google tag, Google Analytics, or Google Ads conversion measurement to understand how visitors find Merba and whether ads lead to useful actions such as signups, bookings, or purchases. We do not use tenant client records, chart notes, payment card data, or tenant customer contact lists for third-party advertising.

Merba accounts are intended for adults and businesses. Tenant businesses may serve minors in their own operations. Those businesses are responsible for obtaining any required parent, guardian, client, or patient authority before entering information into Merba.

We may update this Privacy Policy as Merba evolves. We will provide notice of material changes where required or appropriate. Continued use of Merba after an update means you accept the updated policy.

Regulated or enterprise customers may need additional written terms beyond this Privacy Policy. Merba publishes customer-review versions of the Data Processing Addendum, PHIPA Addendum, and HIPAA Business Associate Agreement. These documents are not effective unless executed or incorporated into a signed agreement.

Merba references the following official sources when designing its PIPEDA, PHIPA, and HIPAA compliance posture, policy language, breach-response process, and privacy/security controls. These references are provided so customers and counsel can map Merba's commitments to the source frameworks.

• Office of the Privacy Commissioner of Canada: PIPEDA fair information principles.
• Office of the Privacy Commissioner of Canada: mandatory reporting of breaches of security safeguards.
• Office of the Privacy Commissioner of Canada: processing personal data across borders.
• Ontario Personal Health Information Protection Act, 2004.
• Information and Privacy Commissioner of Ontario: health privacy breach guidelines.
• U.S. Department of Health and Human Services: HIPAA Privacy Rule summary.
• U.S. Department of Health and Human Services: covered entities and business associates.