Privacy Policy

1. Introduction

2. Compliance Framework

• Personal Health Information Protection Act, 2004 (PHIPA), S.O. 2004, c. 3, Sched. A — Ontario-based pharmacies;
• Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5 — user account and commercial information nationwide;
• Canadian Anti-Spam Legislation (CASL), S.C. 2010, c. 23 — commercial electronic messages;
• Ontario College of Pharmacists (OCP) Standards of Practice.
• Where Ontario Pharmacy Finder processes personal health information on behalf of a subscribing pharmacy, it does so in the role of agent (PHIPA s. 17(3)).

3. Information We Collect

• Pharmacy name,
• Phone number,
• Fax number,
• Email address,
• Street address,
• City;
• Postal code;
• Computer system,
• Website,
• Manager full name,
• OCP number,
• Professional email address,
• Manager phone number,
• Regulatory license number issued by your provincial or territorial pharmacy regulator (e.g., OCP),
• Pharmacy services,
• Languages spoken,
• Hours of operation.
• This information is necessary to provide the Service and verify professional eligibility.
• Incident Report Data: When a user submits an incident report, we collect the following:
• Incident date and time,
• Incident type classification,
• Patient demographics (age range and gender only -- we do not collect patient names, health card numbers, or other direct identifiers),
• Medication details,
• Severity assessment,
• Contributing and background factors,
• Free-text descriptions, and actions taken.
• Billing Information: When you subscribe to a paid plan, payment information (credit card number, billing address) is collected and processed directly by Stripe Payments Canada Ltd. Ontario Pharmacy Finder does not receive or store your full credit card number.
• Usage Data: We collect technical information necessary for Service operation, including login timestamps and feature usage metrics. IP addresses are recorded for security monitoring;

4. User Attestation prior to NIDR Reporting

5. How We Use Your Information

• Providing the Service: Processing incident reports, generating analytics, managing user accounts, and facilitating pharmacy operations.
• NIDR Submission: Transmitting anonymized incident data to the ISMP Canada National Incident Data Repository, as authorized by the subscribing pharmacy.
• Billing: Processing subscription payments and managing account billing.
• Communication: Sending transactional emails (account verification, password reset, trial reminders), and marketing communications if consent was provided.
• Security: Monitoring for unauthorized access, detecting fraud, and maintaining the integrity of the Service.
• Legal Compliance: Fulfilling our obligations under applicable laws and responding to lawful requests from regulatory authorities.

6. Data Storage Location

7. Data Retention

8. Data Security

• Encryption: All data at rest is encrypted.
• Access Control: Role-based access control (admin and staff roles). Multi-tenant data isolation ensures pharmacies can only access their own data.
• Audit Logging: All data access and modification events are logged with timestamps, user identity, and action type.

8.1 Cookies and Tracking Technologies

9. Third-Party Services

• Data Storage and Infrastructure (Supabase & AWS): Ontario Pharmacy Finder utilizes Supabase, a managed cloud database platform, as our primary data repository. The data is housed exclusively in Canada. Both Supabase and AWS maintain strict SOC 2 Type II security certifications. No personal information or incident report data is transferred to or replicated in data centres outside of Canada.
• Stripe Payments Canada Ltd. (and Stripe Inc.): Payment processing for subscription billing. Your Canadian merchant relationship is with Stripe Payments Canada Ltd. (Canadian corporation, Toronto), which contracts with its US parent Stripe Inc. to operate the underlying payment infrastructure. Billing data (cardholder name, billing address, card last-4, tax identification number if supplied) may accordingly be processed on Stripe servers in the United States.
• ISMP Canada: Ontario Pharmacy Finder submits de-identified incident data to the ISMP Canada National Incident Data Repository (NIDR) as authorized by the subscribing pharmacy and pursuant to the pharmacy's Data Sharing and Participation Agreement with ISMP Canada.

10. Breach Notification

• Contain the breach and take immediate steps to mitigate harm;
• Notify the affected pharmacy (Health Information Custodian) within one week of becoming aware of the breach;
• Provide details of the breach, including the nature and scope of the information involved, the cause of the breach, and the remedial measures taken;
• Cooperate with the pharmacy in fulfilling its notification obligations under PHIPA s.12(2) (notification to affected individuals) and s.12(3) read with O. Reg. 224/17 (notification to the Information and Privacy Commissioner of Ontario where prescribed circumstances apply);
• Maintain records of the breach and the response measures taken. For personal information breaches not involving PHI, Ontario Pharmacy Finder will comply with the breach notification requirements under PIPEDA section 10.1 and the Breach of Security Safeguards Regulations (SOR/2018-64), notifying the Office of the Privacy Commissioner of Canada.

11. Your Rights

• Right of Access: You may request access to the personal information we hold about you. Incident data is available for export from the Service in CSV format at any time.
• Right of Correction: You may request the correction of inaccurate or incomplete personal information. Contact us at info@ontariopharmacyfinder.ca with your correction request.
• Right of Deletion: You may delete your account and all associated data at any time. Account deletion is immediate and irreversible.
• Right to Withdraw Consent: You may withdraw your consent for marketing communications or optional cookies at any time. You can adjust non-essential cookie preferences directly via your browser settings. Transactional communications and strictly necessary session cookies essential for Service operation cannot be opted out of while maintaining an active account.

13. Children's Privacy

14. Changes to This Policy

15. Automated Processing

16. No generative AI

17. Contact Information