Plain language summary: Healos™ collects only the information needed to deliver your personalised H-Index™ report and cellular health programme. Your health data belongs to you — stored in an isolated Private Health Vault, never sold, never shared without your explicit consent. You can request deletion of your data at any time.
§ 1
Who We Are
Healos™ Canada is an integrative cellular health programme operated by Way Liu, one of the key founders, and the Healos™ Canada Team, headquartered in Ottawa, Ontario, Canada. Our service is accessible at noheartattack.com.
This Privacy Policy applies to all information collected through the Healos™ website, the H-Index™ Health Audit survey, payment processing, and related communications. By using our services, you agree to the practices described in this policy.
Data controller: Healos™ Canada Team · [email protected] · Ottawa, Ontario, Canada
§ 2
Information We Collect
2.1 Information You Provide Directly
- H-Index™ Health Audit responses: Your answers to the 32-question health assessment, including symptom data, lifestyle indicators, and (optionally) current medications. This is health-related personal information and is treated with the highest level of protection.
- Contact information: Full name, email address, phone number, and biological sex (for clinical calibration), collected on the final page of the H-Index™ survey.
- Payment information: Processed exclusively by Stripe, Inc. Healos™ does not store credit card numbers, CVV codes, or full card details on our systems at any time.
- Professional enquiry forms: For health professionals and LTC institution representatives, we collect your name, professional role, institution name, and the content of your enquiry.
- Communications: Emails and WhatsApp messages sent to Healos™ are retained to allow us to respond to your enquiries and deliver your programme.
2.2 Information Collected Automatically
- Usage data: Pages visited, time spent on pages, referral source, and browser/device type — collected via Google Analytics 4.
- Cookies: See Section 7 for full details.
2.3 Information We Do Not Collect
- We do not collect government-issued identification numbers (SIN, passport, etc.).
- We do not collect information from children under 18 (see Section 8).
- We do not purchase or obtain personal information from data brokers or third parties.
§ 3
How We Use Your Information
| Purpose |
Information used |
Legal basis (PIPEDA) |
| Generate your personalised H-Index™ report and cellular health baseline |
H-Index survey responses, name, email |
Performance of contract / consent |
| Deliver your Healos™ programme and monthly updates |
Contact information, programme tier, payment status |
Performance of contract |
| Drug-nutrient interaction screening |
Current medications (if provided), H-Index responses |
Consent (explicit, via survey authorization) |
| Process payments and manage subscriptions |
Stripe payment token, email, subscription status |
Performance of contract |
| Send programme communications (reports, reminders, updates) |
Email, phone (WhatsApp) |
Consent (CASL-compliant) |
| Send marketing communications (if you opted in) |
Email, phone |
Express consent (CASL checkbox) |
| Improve our service through analytics |
Anonymised usage data |
Legitimate interest |
| Alert the Healos™ care team if critical risk indicators are identified in your H-Index responses |
H-Index responses, contact information |
Consent (survey authorization) |
We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human review.
§ 4
Data Storage & Security
4.1 Your Private Health Vault
All health-related data from your H-Index™ survey is stored in an isolated Private Firestore Vault — a technically separate database document specific to your Healos™ account. This means your data is not stored in a shared pool with other patients' data.
Data sovereignty: Your health data belongs to you. Healos™ does not sell, rent, license, or aggregate your health data for commercial purposes — not now, and not in the future. Your H-Index™ report is shared with your chosen healthcare providers only when you explicitly request it.
4.2 Security Measures
- All data transmitted between your browser and Healos™ systems is encrypted using TLS 1.2 or higher.
- Health data is stored in Google Cloud Firestore with field-level access controls.
- Payment data is handled exclusively by Stripe, Inc., which maintains PCI DSS Level 1 compliance — the highest standard for payment security.
- Access to patient health records is restricted to authorised Healos™ care team members only.
4.3 Compliance Standards
- PIPEDA: Personal Information Protection and Electronic Documents Act (Canada) — our primary compliance framework.
- HIPAA: Health Insurance Portability and Accountability Act (USA) — we maintain HIPAA-compliant data handling practices for US-based clients.
- CASL: Canada's Anti-Spam Legislation — all marketing communications require express consent and include unsubscribe mechanisms.
4.4 Data Retention
- H-Index health data: retained for the duration of your programme plus 2 years, unless you request earlier deletion.
- Payment records: retained for 7 years as required by Canadian tax law.
- Marketing communications consent records: retained for 3 years after the last communication.
§ 5
Third-Party Services
Healos™ uses the following third-party services to deliver our programme. Each is bound by its own privacy policy and relevant data protection laws.
| Service |
Purpose |
Data shared |
Location |
| Stripe, Inc. |
Payment processing and subscription management |
Name, email, payment token (no card numbers) |
USA (GDPR/PIPEDA compliant) |
| GoHighLevel (GHL) |
CRM, automation, and communication platform |
Name, email, phone, programme status, H-Index tags |
USA (SOC 2 compliant) |
| Google Analytics 4 |
Website traffic and behaviour analytics |
Anonymised usage data, IP address (truncated) |
USA (PIPEDA-compatible with IP anonymisation) |
| Google Cloud Firestore |
Secure health data storage (Private Health Vault) |
H-Index data, programme history (encrypted) |
Canada/USA (Google Cloud) |
| WhatsApp (Meta) |
Care team communication (VIP and 91-Day clients) |
Phone number, care messages |
USA/Global (end-to-end encrypted) |
We do not sell your personal information to any third party for advertising or commercial purposes. The supplement manufacturer supplying the Healos™ cellular kit receives only the shipping information necessary to fulfil your order — no health data is shared with the manufacturer.
§ 6
Your Rights
Under PIPEDA and applicable Canadian privacy law, you have the following rights regarding your personal information:
- Right of access: You may request a copy of the personal information we hold about you.
- Right to correction: You may request that we correct inaccurate or incomplete information.
- Right to deletion: You may request deletion of your personal information, subject to our legal retention obligations (e.g. payment records required by tax law).
- Right to withdraw consent: You may withdraw consent for marketing communications at any time by replying STOP to any SMS or clicking "unsubscribe" in any email. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
- Right to data portability: You may request your H-Index™ data in a portable format (PDF or JSON).
- Right to complain: If you believe your privacy rights have been violated, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
To exercise any of these rights, contact us at [email protected]. We respond within 30 days. For urgent matters, our business line (SMS & voicemail): 365.909.2567.
§ 7
Cookies & Analytics
Healos™ uses cookies and similar tracking technologies to improve the functionality of our website and understand how visitors use our content.
Types of cookies we use:
- Essential cookies: Required for the website to function (session management, security). Cannot be disabled.
- Analytics cookies (Google Analytics 4): Used to understand page traffic, referral sources, and user behaviour in anonymised form. IP addresses are truncated before storage. You may opt out via Google's opt-out tool.
- Marketing cookies: Used only if you have consented to marketing communications and interact with our paid advertising. You may disable these in your browser settings.
By continuing to use this website, you consent to the use of essential cookies. Analytics and marketing cookies are used only with your consent as indicated at your first visit.
§ 8
Children's Privacy
Healos™ services are intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected] and we will delete such information promptly.
§ 9
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this page.
- Notify active programme clients by email at least 14 days before the changes take effect.
Continued use of Healos™ services after the effective date of any change constitutes acceptance of the updated policy. We encourage you to review this page periodically.