Privacy Policy

Prescription transfer requests: Your name, phone number, and current pharmacy name. No account required.

Patient portal accounts: Your email address, medication history (synced from our pharmacy system, WinRx), prescription records, delivery preferences, and appointment history.

Blister pack signups: Your name, phone number, email (optional), and approximate number of medications.

Live chat: If you start a chat with us, the messages you send and basic technical details about your visit are handled by our chat provider (Tawk.to). Please don’t send prescription details or personal health information through chat — call us instead.

Automatically collected: IP address (hashed for rate limiting — not stored in identifiable form), browser and device type, referring page, and the pages you visit. See section 3 for how analytics works and how to opt out.

We use Google Analytics 4 to understand how people find and use our public website — which pages are read, how visitors arrive, and which devices they use. Google Analytics sets cookies and records the pages you view, your browser and device type, the site or search that referred you, and an approximate location derived from your IP address. We do not receive your name, email, or any prescription information through analytics.

Analytics does not run in the patient portal. Pages under /portaland our staff administration pages are deliberately excluded, because those addresses describe an identifiable person’s medications, appointments, and payments. Health information you enter in the portal is never sent to Google.

Our public health-information pages have addresses that describe their subject — for example a page about a specific condition or medication. If you visit one of those pages, that page address is part of the analytics data Google receives. If you would rather read them without that happening, the opt-out options below apply.

We do not run advertising, remarketing, or ad-targeting tags, and we do not build advertising profiles or sell any information to data brokers.

How to opt out: install Google’s Analytics Opt-out Browser Add-on, block or clear cookies for this site in your browser settings, or use your browser’s private browsing or tracking-protection features. Blocking analytics does not affect your ability to use any part of this site, including the portal.

Separately from analytics, we use cookies that are necessary for the site to work — keeping you signed in to the patient portal and protecting forms from abuse. These cannot be turned off without breaking sign-in.

Supabase: Database and authentication — stores your portal account and records in ca-central-1 (Montreal)

WinRx (ARI Systems): Pharmacy management system — holds your prescription records

Clover: Payment processing — we never see or store your full card number; Clover is PCI-DSS compliant

Twilio: Sends an SMS alert to our pharmacy staff when you submit a request, so we can act on it quickly

Resend: Delivers email notifications to our pharmacy inbox and transactional email to you

OAT Clinic: Our partner for virtual opioid agonist treatment. They host and receive the intake form on our OAT page, and the clinical record from a virtual assessment is held by them under their own privacy practices

Avee Health: Operates the virtual clinic booking you access from our site. When you book a visit, your booking and any clinical record created belong to that service and its physicians, under their own privacy policy

Tawk.to: Live chat widget — receives chat messages and basic visit details

Google Analytics: Website analytics on our public pages only — see section 3

Vercel: Website hosting and delivery

Upstash: Rate limiting, to protect our forms from abuse (hashed IP addresses only)

Sanity: Content management for our health articles — no patient data

Your patient records are stored in Canada. However, some processing happens outside it, and PIPEDA requires us to say so plainly: our website application runs on servers located in the United States, which means requests you make to the site are processed there even when the underlying record is stored in Montreal. Our analytics, live chat, email, and SMS providers also operate outside Canada.

While information is in another country, it is subject to the laws of that country and may be accessible to its courts and law-enforcement agencies. We use providers that contractually commit to protecting the information they handle for us, and we give each one only what its purpose requires.