Legal · Sleep Ready

Privacy policy and CASL compliance

Plain-language explanation of what information Sleep Ready collects, how we use it, how we protect it, and what your rights are.

Last updated: October 24, 2026

The short version

Sleep Ready is a single-proprietor practice owned by Milos, based in Ontario. We collect the minimum information needed to do our work — your name, your email, your child’s basic information, and what you’re hoping we can help with. We never sell or share your data with anyone outside the third-party tools we use to run the business (our website hosting, content delivery and security services, and our analytics tool). We comply with PIPEDA (Canada’s federal privacy law) and CASL (Canada’s anti-spam law). If you want to see what we have on you, change it, or have it deleted, email [email protected] and we’ll handle it within 30 days.

1. Who we are

Sleep Ready is a paediatric sleep and potty training consultancy owned and operated by Milos (“we,” “us,” or “Sleep Ready”) as a sole proprietorship registered in Ontario, Canada. Sleep Ready operates two closely-linked practices:

Sleep Ready (sleepready.ca) — paediatric sleep and potty training consulting
Life Safe (lifesafe.ca) — paediatric-specific First Aid and CPR training

This privacy policy applies to Sleep Ready (sleepready.ca). Life Safe has its own privacy policy at lifesafe.ca/privacy. When you purchase a bundled programme combining Sleep Ready and Life Safe, both policies apply to the relevant portions of that engagement.

Primary contact for privacy matters: Milos, at [email protected]

Mailing address: a valid mailing address is included in every commercial email Sleep Ready sends.

2. What information we collect

We collect only what we need to do the work. The categories are:

2.1 Information you provide directly

From lead magnet opt-ins: your first name and email address. Nothing else is required to download a free resource.

From discovery call bookings: your first and last name, email address, phone number (optional), your child’s approximate age or stage, and a short description of what you’re hoping to discuss.

From contact form submissions: your name, email, a subject category, your message, and (optionally) how you found Sleep Ready.

From active client engagements: more detailed information necessary to deliver the service, including your child’s first name, approximate date of birth, relevant medical or developmental information you choose to share, your home address (for in-home visits), your household structure, and any other information relevant to building an effective sleep or potty-training plan.

From payment: name, email, and billing information necessary to process payment. Payments are processed by Stripe, and payment card data is never stored by Sleep Ready (see Section 4.3).

From testimonials and reviews: if you provide a testimonial or review, we collect the content you submit plus whatever identifying information you agree to display publicly (typically first name and city).

2.2 Information collected automatically

From your visits to sleepready.ca: standard web analytics including pages visited, time on page, referring site, approximate geographic location (city-level only), device type, and browser. This is collected through Jetpack Stats (Automattic, United States), which processes data in the United States.

From cookies and similar technologies: see Section 9 for the full cookie breakdown.

2.3 Information about your child

Because paediatric sleep and potty training consulting is by definition work concerning children, we necessarily collect information about children during the course of an active engagement. This includes the child’s first name, approximate date of birth, developmental stage, sleep and feeding patterns, and any medical, developmental, or behavioural information you choose to share as relevant to the engagement.

We treat children’s information with particular care:

We collect only what’s necessary to deliver the service.
We never collect a child’s full legal name, full date of birth, health-card number, or other identifiers beyond what’s functionally required.
We never market to children, and no marketing communications are ever directed at the children in our clients’ households.
Information about a child is provided by the parent or legal guardian as the consenting party, in line with PIPEDA’s consent framework.
Information about children is held to the same security and retention standards as all other personal information (see Sections 6 and 7), and is deleted at the end of the standard retention period.

3. How we use your information

We use the information we collect for these specific purposes:

To deliver services you’ve purchased or requested. Consultation calls, written plans, follow-up support, and anything else that’s part of an active engagement.

To communicate with you. Booking confirmations, session reminders, follow-up emails after discovery calls, and direct replies to your inquiries.

To send you the email content you signed up for. Lead magnet delivery, nurture sequences, and the monthly newsletter — each sent only with your express consent (see Section 5 and Section 10).

To improve how we work. Analytics helps us understand which pages are useful, which blog posts are being read, and where visitors leave the site. We use this information to improve the site, not to target advertising at you.

To comply with legal obligations. Including tax record-keeping, CASL consent record-keeping, and responding to legal requests when validly compelled.

We do NOT use your information:

to target advertising at you;
to sell, rent, or lease to third parties;
to train AI models;
to enrich third-party data sets;
for any purpose beyond those listed above without asking you first.

4. Who we share information with

We share your information only with the specific third-party service providers we use to run the business. Each is selected on the basis that their handling of your data meets or exceeds PIPEDA requirements. The current list:

4.1 Forms and email

We do not currently use an email service provider. The contact, newsletter, and free-guide signup forms on sleepready.ca are handled by the SureForms plugin: submissions are stored in the site’s WordPress database and emailed to Milos. Milos adds subscribers to the mailing list by hand, and you can reply “unsubscribe” to any email at any time. If we adopt an email service provider later, we’ll update this policy to name it.

4.2 Scheduling tool

We do not use a scheduling tool. Discovery calls are booked by replying to a contact-form message or email, so the details you share when booking are handled as described in Section 4.1.

4.3 Payment processor

Payments are processed by Stripe, Inc. (United States). When you pay, you enter your card details directly on Stripe’s secure checkout; Sleep Ready receives confirmation of the payment and your name and email, but never your full card number. Stripe handles card data under PCI-DSS. See Stripe’s privacy policy.

4.4 Analytics provider

Jetpack Stats (Automattic, United States), which processes site usage data and reports it to us in aggregate. See Section 9 for more detail. See Automattic’s privacy policy.

4.5 Website hosting

sleepready.ca runs on WordPress through our WordPress hosting provider, which necessarily has server-level access to data transmitted to and from the site. The site is served through Cloudflare (United States), which provides content delivery and security and processes data transmitted to and from the site. Jetpack (Automattic, United States) also provides the site’s image CDN and brute-force login protection, and the Wordfence plugin provides site security. See Cloudflare’s privacy policy.

4.6 When we would share with others

We would share your information with third parties outside the list above only:

with your explicit consent;
when legally compelled (valid subpoena, court order, or equivalent legal process);
to protect against fraud, unauthorized access to our systems, or imminent harm to a person;
if Sleep Ready were ever sold or merged, in which case your information would transfer to the new owner subject to the same terms, and you would be notified in advance with the ability to delete your account before the transfer.

We do not sell, rent, lease, or otherwise share your information for anyone else’s commercial purposes.

4.7 Cross-border data transfers

Some of our service providers, including Cloudflare, Automattic, Stripe, and Google (Gmail, which we use for email), are based in the United States. When your information is processed outside Canada, it may be subject to the laws of that jurisdiction, including the possibility of lawful access by local government authorities. We select providers who meet or exceed Canadian privacy standards, but you should be aware of this cross-border reality when using Sleep Ready’s services. If you have concerns about cross-border data processing, contact us at [email protected] and we’ll discuss options.

6. How long we keep your information

We keep your information only as long as necessary. Specific retention periods:

Lead magnet subscribers (never converted to clients): 3 years from last engagement with our emails (opens or clicks), then deleted.
Unsubscribed contacts: suppression list kept indefinitely to honour unsubscribe requests; all other data deleted within 30 days of unsubscribe.
Active clients and recent clients: full record retained during the engagement and for 7 years after the final session (for tax and professional record-keeping purposes), then deleted.
Children’s information (within client engagements): subject to the same 7-year retention as the parent account, then deleted.
Contact form submissions (no subsequent engagement): 12 months, then deleted.
CASL consent records: retained for at least 3 years per CRTC guidance, longer if the business relationship continues.
Financial records (invoices, receipts, payment records): 7 years per Canada Revenue Agency requirements.
Website analytics data: aggregated and anonymized; no individually-identifying retention beyond 26 months.

If you want your data deleted earlier than these standard retention periods, email [email protected]. We’ll honour the request within 30 days, subject only to information we’re legally required to retain (financial records, for example).

7. How we protect your information

We take the following measures to protect your information:

Client records are stored in access-restricted, password-protected storage.
Email and messaging tools are accessed only by Milos, with multi-factor authentication enabled.
The website uses HTTPS for all connections.
Payment card information is never stored by Sleep Ready; Stripe processes all card payments.
Written plans, observation logs, and other engagement artifacts are delivered via secure means (encrypted email, secure file-sharing link, or in-person delivery) as appropriate.
In-person visits do not involve any on-device data collection beyond what’s shared verbally and captured in written notes.
Professional development and certifications are maintained to ensure we’re following current best practices in both clinical work and data handling.

No security system is perfect. If you ever believe your information has been compromised in connection with Sleep Ready, contact us immediately at [email protected] so we can investigate and respond appropriately.

8. Your rights under PIPEDA

Under Canadian privacy law, you have the following rights concerning your personal information:

Right to know what we have about you. You can request a copy of the personal information we hold on you. We’ll respond within 30 days.

Right to correction. If the information we have is inaccurate, incomplete, or out of date, you can ask us to correct it.

Right to deletion. You can ask us to delete your information, subject only to information we’re legally required to retain (financial records for 7 years, for example). We’ll honour deletion requests within 30 days.

Right to withdraw consent. You can withdraw consent at any time. This may affect our ability to continue providing certain services (for example, if you withdraw consent to email communication during an active engagement, we’ll need to arrange an alternative way to stay in touch).

Right to complain. If you believe we’ve handled your information incorrectly, you can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or by calling 1-800-282-1376. We’d appreciate the chance to address your concern directly first by emailing [email protected], but the OPC is always available as an independent oversight body.

To exercise any of these rights, email [email protected]. For identity verification, we may ask for information that confirms you are who you say you are, particularly for deletion requests. We do not charge for privacy requests.

9. Cookies and similar technologies

Sleep Ready uses a minimal cookie setup. The current cookies in use are:

Essential cookies: cookies required for the site to function (session management, form security, preference storage). These cannot be disabled without breaking the site.

Analytics: our analytics provider may use cookies or similar technologies to measure site usage. We use Jetpack Stats (Automattic, United States), which reports site usage to us in aggregate. We use it to understand how the site is used, not to identify individual visitors.

No advertising or tracking cookies. We do not use Facebook Pixel, Google Ads conversion tracking, or other third-party advertising trackers. The site does not participate in cross-site tracking.

Your choices: most browsers let you block or delete cookies through browser settings. If you block essential cookies, some parts of the site may stop working.

10. CASL compliance specifics

Canada’s Anti-Spam Legislation (CASL) applies to all Commercial Electronic Messages (CEMs) sent from Sleep Ready. Our CASL practices:

Every CEM identifies the sender. Every email includes Sleep Ready’s name, a valid physical mailing address, and Milos’s name as the single sender.

Every CEM includes an unsubscribe mechanism. Every email tells you how to unsubscribe: reply “unsubscribe” at any time. Unsubscribes are processed within 10 business days, usually immediately.

We require express consent to send marketing emails. Signing up for a lead magnet, booking a discovery call, or purchasing a package constitutes express consent for Sleep Ready’s marketing communications. The consent is logged with timestamp, consent wording, and landing-page URL as a CASL record.

We respect the 2-year existing business relationship window. After a purchase or inquiry, CASL permits us to send commercial emails for 2 years based on the existing business relationship. We honour this window, but we also always make unsubscribing easy and never rely on it as a substitute for ongoing consent.

We maintain CASL consent records for at least 3 years. This is longer than the strict minimum in most cases, and matches current CRTC guidance.

We do not use pre-checked consent boxes, buried consent language, or bundled consent. Each opt-in is a clear, specific action requesting a specific type of communication.

If you ever receive an email from Sleep Ready that you believe violates CASL, please reply directly or forward it to [email protected] so we can investigate and correct.

11. Children and special-category information

Sleep Ready’s services are sold exclusively to adults (parents and legal guardians). We do not market to, collect information directly from, or knowingly interact with children under the age of 13 on this website. Any information about children we do hold is provided by the parent or legal guardian as part of an active engagement and is subject to the handling practices described throughout this policy.

Health-adjacent information: during active engagements, parents sometimes share information about their child’s diagnoses, medications, medical history, and developmental assessments. This information is clinically-sensitive and handled accordingly — we do not store it in any system accessible to third parties beyond the specific tools listed in Section 4, and we do not share it with anyone without the parent’s explicit consent. Note that Sleep Ready is not a regulated health information custodian under Ontario’s Personal Health Information Protection Act (PHIPA), but we apply similar care standards to clinically-sensitive information provided during engagements.

If you want us not to retain any information about your child after the engagement ends: email [email protected] at the end of the engagement. We’ll delete the child’s information immediately, retaining only the parent account data required for CRA tax record-keeping.

12. Changes to this policy

We’ll update this policy when our practices change, when the tools we use change, or when the law changes. When we make a material change:

We’ll update the “Last updated” date at the top of this page.
We’ll notify active clients and email subscribers by email at least 14 days before a material change takes effect.
Minor, non-material changes (such as correcting a typo or updating a service provider’s name after a rebrand) may be made without notification.

The current version of this policy is always the version posted at sleepready.ca/privacy.

13. Questions or concerns about this policy

Email [email protected] with “Privacy” in the subject line. Replies typically within 2 business days.

For formal privacy complaints, you can also contact:

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3
Telephone: 1-800-282-1376
Website: priv.gc.ca

14. Effective date

This privacy policy is effective as of October 24, 2026 and was last updated on October 24, 2026.

Sleep Ready, owned and operated by Milos, in Ontario, Canada.

Pair this with our Terms of Service. The Terms cover scope, payment, cancellations, liability, and dispute resolution.

Read the Terms of Service →

↑ Back to top