Ascent Privacy Policy
Effective date: August 26th, 2026
1. About this policy
Steven Murray, founder of the proposed Ascent clinic (“Ascent,” “we,” “us” or “our”), is responsible for the collection and use of personal data through this Website. We respect your privacy and is committed to handling personal data lawfully, fairly, transparently and securely.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal data through ascentbarbados.com and its related pre-launch contact, interest-list and membership-interest forms (collectively, the "Website"). It also explains the choices and rights available to you.
For the purposes of the Barbados Data Protection Act, 2019-29 (the "Data Protection Act"), the data controller is:
Data controller
Dr. Steven Murray
Founder, Ascent
145 1/2 Church St Unit 5, Toronto, ON M5C 2Z3
privacy@ascentbarbados.com
This is a pre-launch website policy. The Website is not currently used for clinical intake, diagnosis, treatment, appointment booking, payment processing or the maintenance of patient records. A separate or revised privacy notice will apply before Ascent begins collecting personal data for clinical services.
2. Important notice about clinical information
The Website's forms are intended for general inquiries, expressions of interest and non-clinical membership screening only. They are not a secure channel for medical records or urgent health concerns.
Please do not submit medical records, diagnostic information, detailed symptom histories, photographs of an injury, insurance information or other sensitive personal data through the Website. Submitting a form does not create a clinician-patient relationship and does not guarantee acceptance as an Ascent member or patient.
If you voluntarily submit clinical or other sensitive information that we did not request, we may delete it, ask you to communicate through a more appropriate channel, or retain it only where reasonably necessary and legally permitted. The Website is not monitored for emergencies. If you require urgent medical assistance, contact the appropriate emergency service or healthcare provider.
3. Personal data we collect
We collect only personal data that is reasonably necessary for the purposes described in this policy.
3.1 Information you provide directly
Depending on how you use the Website, this may include:
your name, email address and telephone number;
your country or place of residence and your general connection to, or anticipated time in, Barbados;
the type of Ascent service or membership in which you are interested;
general goals, interests and reasons for contacting Ascent;
general information about preferred timing, location or anticipated pricing;
how you heard about Ascent;
your communication and marketing preferences;
information contained in correspondence with us; and
any other non-clinical information you choose to provide in a form or message.
Required fields will be identified on the relevant form. If you do not provide information required to respond to an inquiry or assess a membership expression of interest, we may be unable to process that submission.
3.2 Information collected automatically
When you visit the Website, Ascent and Squarespace may automatically receive information such as:
your Internet Protocol (IP) address;
browser, network and device information;
operating system and general device settings;
the page or source that referred you to the Website;
pages viewed and actions taken on the Website;
approximate location derived from an IP address;
dates and times of access; and
cookie identifiers and related usage information.
Squarespace may process some of this information on our behalf to host, secure and operate the Website and provide analytics. Squarespace may also process certain site-usage information for its own purposes, as explained in the Squarespace Privacy Policy.
3.3 Email-list and campaign information
If you choose to receive Ascent updates, we may collect your name, email address, subscription status, consent record and communication preferences. Squarespace Email Campaigns may also provide information about delivery, opens, link clicks and unsubscribes so that we can operate and evaluate our communications.
4. How and why we use personal data
We process personal data only when we have a lawful basis for doing so.
Operating and securing the Website
We process technical and usage information to deliver the Website, maintain its functionality, prevent misuse, troubleshoot problems and protect the Website. We do this based on our legitimate interest in operating a secure and functional website.
Responding to inquiries
We use the information you provide to review and respond to your inquiry and communicate with you. We do this to take steps at your request before a possible service relationship and because we have a legitimate interest in responding to genuine inquiries.
Reviewing membership interest
We use the information submitted through our membership-interest forms to understand your general interests, assess potential fit, arrange a non-clinical introductory call and plan Ascent’s launch capacity. We do this to take steps at your request before a possible service relationship and because we have a legitimate interest in pre-launch planning.
Market validation and business planning
We may use information about demand, location, timing and service interests to help evaluate and plan Ascent. We do this based on our legitimate business interests. Wherever reasonably possible, we use aggregated or de-identified information for these purposes.
Email updates and educational communications
If you choose to receive communications from Ascent, we use your contact information to send clinic updates, educational content, event invitations, research-interview opportunities and related communications. We do this with your consent. You may withdraw that consent at any time.
Website analytics
With your permission, we use Squarespace analytics to understand Website traffic and improve its content and usability. Where required, we process this information based on your consent to non-essential analytics cookies.
Legal, regulatory and security matters
We may process relevant personal data to comply with applicable law, respond to lawful requests, establish or defend legal rights, and investigate suspected misuse or security incidents. We do this to comply with our legal obligations and because we have legitimate interests in protecting Ascent, the Website and others.
Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests should take priority. Where we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
5. Marketing communications
We will send promotional, educational or launch-related emails only where you have asked to receive them or another lawful basis applies. Consent to receive marketing is optional and will be requested separately from any acknowledgment needed to submit an inquiry or membership-interest form.
You can unsubscribe at any time by using the unsubscribe link in an email or contacting privacy@ascentbarbados.com. We will stop sending marketing communications as soon as reasonably practicable and within any period required by applicable law. We may retain a minimal suppression record so that we can honour your opt-out and demonstrate compliance.
Withdrawing marketing consent will not prevent us from sending a direct response to an inquiry you initiated or another non-promotional communication that is reasonably necessary.
6. Cookies and similar technologies
Cookies are small files stored on your device. The Website uses:
6.1 Necessary cookies
Necessary cookies support functions such as Website security, network management, accessibility and remembering privacy choices. Because these cookies are required for the Website to function, they cannot always be disabled through our cookie controls. You may be able to block them in your browser, but parts of the Website may not work correctly.
6.2 Analytics and performance cookies
With your permission, Squarespace uses analytics and performance cookies to help us understand matters such as visits, traffic sources and the pages visitors use. At the time this policy was prepared, Squarespace identified the following principal analytics cookies:
CookieTypical durationPurposess_cid2 yearsIdentifies unique visitors and tracks sessionsss_cpvisit2 yearsIdentifies unique visitors and tracks sessionsss_cvisit30 minutesIdentifies a visit or sessionss_cvr2 yearsIdentifies unique visitors and tracks sessionsss_cvt30 minutesIdentifies a visit or session
Squarespace may update its cookies from time to time. Its current list is available in The cookies Squarespace uses.
We configure the Website to restrict non-essential cookies until you make a choice through the cookie banner. You can accept, decline or manage non-essential cookies and can revisit your selection through the Website's cookie-preference control. We do not use Google Analytics, Meta Pixel, Google Ads conversion tracking or comparable advertising and retargeting pixels under this version of the policy.
6.3 Form security and fonts
Squarespace forms may use Google reCAPTCHA to reduce automated spam. When reCAPTCHA is active, Google may receive technical and usage information in accordance with the Google Privacy Policy.
Squarespace may also serve font files through Google Fonts or Adobe Fonts. When those services are used, the font provider may receive information such as your browser, device, the page being viewed and your IP address. Their handling of that information is governed by their own privacy notices.
7. When we disclose personal data
We may disclose personal data only where reasonably necessary for the purposes described above, including to:
Squarespace and its subprocessors, for Website hosting, security, forms, contact management, analytics and email campaigns;
technology and professional service providers acting on our instructions, such as business email, information-security, legal, accounting or compliance providers;
government, regulatory, law-enforcement or judicial authorities, where disclosure is required or permitted by law or is reasonably necessary to protect legal rights or safety; and
a successor or proposed successor to the business, in connection with a genuine financing, reorganisation, merger, sale or transfer, subject to appropriate confidentiality and data-protection safeguards.
We do not sell or rent personal data.
Identifiable form responses will not be shared with prospective lenders, investors or other financing parties for market-validation purposes without your permission. We may use or disclose statistics and reporting that have been aggregated or anonymised so that individuals are not reasonably identifiable.
If we engage a service provider to process personal data on our behalf, we require an appropriate written arrangement and expect the provider to use the information only for authorised purposes and to apply appropriate security and confidentiality measures.
8. International processing and transfers
Ascent is based in Barbados, but the Website is hosted by Squarespace. Squarespace and its service providers may process personal data in Ireland, the United States and other countries where they or their subprocessors operate. Those countries may have privacy laws that differ from the laws of Barbados.
Where personal data is transferred outside Barbados, we take reasonable steps to assess the transfer and to use contractual, organisational or other safeguards required by applicable law. You may contact privacy@ascentbarbados.com to request information about the safeguards relevant to your personal data.
9. How long we retain personal data
We retain identifiable personal data only for as long as reasonably necessary for the purpose for which it was collected. We may retain information longer where required for legal, regulatory, security or dispute-resolution purposes.
Our intended pre-launch retention periods are described below.
General inquiries and correspondence
We retain general inquiries and related correspondence for up to 12 months after the last substantive contact. We may retain them longer if the matter remains active, a service relationship begins, or continued retention is reasonably necessary for legal or security purposes.
Membership-interest and pre-launch application information
We retain membership-interest and pre-launch application information for up to 24 months after the last substantive interaction. We may retain it longer if you remain actively engaged with Ascent or a service relationship begins. You may request deletion of this information, subject to any lawful reason requiring or permitting us to retain it.
Marketing subscription information
We retain your subscription information for as long as you remain subscribed to Ascent communications. If you unsubscribe, we may retain a minimal record of your withdrawal and contact details for as long as reasonably necessary to honour your opt-out and demonstrate compliance.
Security and technical logs
We retain security and technical information for the period reasonably required to protect the Website, investigate potential misuse, troubleshoot problems and maintain Website functionality. Some retention periods are determined by Squarespace’s platform settings and practices.
Analytics information
Analytics information is retained according to the cookie durations and Squarespace analytics settings described in this policy. Aggregated or genuinely anonymised statistics may be retained for longer because they no longer identify an individual.
Privacy requests and complaints
We retain information relating to privacy requests and complaints for as long as reasonably necessary to respond to the matter, document our compliance and manage any related legal or regulatory requirements.
When continued retention is no longer justified, we will delete, anonymise or securely dispose of the personal data. Some information may remain temporarily in restricted backup systems until it is overwritten through the normal backup cycle or may be retained where required by applicable law.
10. Security
We use reasonable and proportionate administrative, technical and organisational measures intended to protect personal data against unauthorised or unlawful access, use, alteration, disclosure, loss or destruction. These measures include limiting access to people who require it for an authorised purpose, using reputable service providers, applying account and access controls, and reviewing our data-handling practices as the Website develops.
No website, transmission method or storage system can be guaranteed completely secure. You should therefore avoid sending information through the Website that the forms do not request, particularly medical records or other sensitive information.
If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable law, including any required notification to the Data Protection Commissioner and affected individuals.
11. Your rights
Subject to the Data Protection Act and any applicable limitations, you may have the right to:
ask whether we process personal data about you and request access to it;
request correction of inaccurate or incomplete personal data;
request erasure of personal data in applicable circumstances;
request restriction of processing in applicable circumstances;
object to processing, including processing for direct marketing;
receive certain personal data in a structured, commonly used and machine-readable format and request its transmission where applicable;
withdraw consent at any time where processing is based on consent;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to lawful exceptions; and
complain to the Barbados Data Protection Commissioner.
Ascent does not use solely automated decision-making to accept or reject membership-interest submissions. Submissions are reviewed by an authorised person.
To exercise a right, contact [PRIVACY EMAIL ADDRESS]. Please identify the right you wish to exercise and provide enough information for us to locate the relevant data. We may request proportionate information to verify your identity and protect personal data from unauthorised disclosure. We will respond without undue delay and within the period required by applicable law.
You may also contact the:
Data Protection Commission
Ministry of Industry, Innovation, Science & Technology
5th Floor, SSA Building
Vaucluse, St. Thomas, Barbados
Telephone: +1 246 536 1200 or +1 246 536 1212
Government of Barbados — Data Protection Commission
12. Children
The Website and its pre-launch forms are intended for adults and are not directed to children. Under the Data Protection Act, a child is a person under 18 years of age, and consent to process a child's personal data must be given or authorised by a parent or guardian.
We do not knowingly solicit personal data directly from children through the Website. If you believe that a child has submitted personal data without appropriate parental or guardian authorisation, contact [PRIVACY EMAIL ADDRESS] so that we can investigate and take appropriate action.
13. External websites and social media
The Website may contain links to third-party websites or social-media services. Following a link takes you to a service that is operated independently and governed by its own privacy practices. This policy does not control how those third parties process personal data.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in law, technology, our Website or our operations. The effective date at the top will identify the current version. If a change materially affects how we use personal data already collected, we will provide additional notice or seek consent where required.
This policy must be reviewed and replaced or materially revised before the Website begins collecting clinical information, accepting bookings or payments, offering patient or member accounts, using a clinical records platform, or deploying additional analytics, advertising pixels or third-party integrations.
15. Contact us
Questions, concerns, complaints and requests relating to this Privacy Policy or our handling of personal data should be directed to:
Data controller
Dr. Steven Murray
Founder, Ascent
145 1/2 Church St Unit 5, Toronto, ON M5C 2Z3
privacy@ascentbarbados.com