Privacy Policy

When you sign up, accept an invitation or use the service, we collect:

• your name, your email address and the name of your pharmacy;
• your password, stored only as a one-way hash that we cannot read;
• your role in the pharmacy (owner or member) and whether your account is active;
• sign-in records: the date and time, IP address and browser of each session;
• a record of the changes you make inside the service, shown to your pharmacy as its history;
• your acceptance of our Terms of Service and this policy: the version, date and time, IP address and browser;
• subscription details: the plan, its status and renewal dates, and the identifiers Stripe gives us for the customer and subscription. Card details go directly to Stripe; we never receive or store your full card number;
• the messages you send us when you ask for support.

We use this information to create and secure your account, to provide the service, to bill the subscription, to send service emails (email confirmation, password reset, invitations, billing and legal notices), to keep the audit history your pharmacy relies on, to prevent abuse, and to meet legal obligations. We do not sell it, and we do not use it for advertising.

Pharmacies use the service to keep information about their patients: names, dates of birth, health card numbers, home and delivery addresses, phone numbers, the prescriber's name, packaging schedules, preparation and billing status, notes, and the reasons for frequent dispensing recorded on the signed consent form. This is personal health information.

We handle patient information only on behalf of the pharmacy that entered it, and only to provide the service to that pharmacy. The pharmacy is the health information custodian and decides what is collected and how it is used; we act as its agent and electronic service provider under our Terms of Service. We do not use patient information for any purpose of our own.

If you are a patient and want to see, correct or ask about your information, please contact your pharmacy. If you write to us, we will pass your request on to the pharmacy.

The service uses one cookie: a session cookie that keeps you signed in. It is strictly necessary, it is not readable by scripts, and it is not used to track you. We use no advertising cookies and no third-party analytics.

We share personal information only with the companies that help us run the service, under contracts that limit them to that purpose:

• our hosting and backup provider, which stores the database (servers in the United States);
• Stripe, which processes payments and receives the account owner's email, the pharmacy's name and the payment details the owner enters;
• Resend, which delivers our transactional emails and receives the recipient's name and email address and the content of the message;
• Google, through its Gemini API, which reads the photo of a signed consent form when someone at a pharmacy chooses to have one read. It receives the photo, including the patient information written on it, and returns its text. We use Google's paid service, under which Google does not use the content to improve its products, although it may keep it for a limited period to detect abuse of its service. We do not store the photo.

We may also disclose information where the law requires it, or to a successor if the business that operates the service is transferred — in which case this policy continues to apply to the information transferred.

The service's database and backups are located in the United States, and our service providers may process information in the United States and other countries. Information held outside Canada is subject to the laws of the country where it is held and may be accessible to that country's courts and authorities.

We protect personal information with safeguards appropriate to its sensitivity: encrypted connections, hashed passwords, session tokens stored only as hashes, database-level isolation between pharmacies, individual logins with roles, lockout after repeated failed sign-ins, an audit record of changes, and regular backups. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify the people and authorities the law requires us to notify.

We keep account information while the account exists. After a pharmacy's subscription ends, we keep its data for ninety (90) days and may delete it after that; the account owner can ask us to delete it sooner. Deleted data leaves our backups within a further thirty (30) days.

We keep billing records, and the record of acceptance of our Terms and this policy, for as long as the law requires or allows, because they are evidence of the agreement and of payments.

A member who leaves a pharmacy is deactivated rather than erased, so that the pharmacy's history still shows who did what. That history belongs to the pharmacy.

You can ask us what personal information we hold about you, ask for a copy, and ask us to correct it. You can withdraw consent to our handling of your information, subject to legal and contractual limits — in practice, this means closing your account. Write to juliana@pharmacying.com; we answer within thirty (30) days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

When we change this policy we change the "Version" date at the top, and the service asks each user to read and accept the new version before continuing.

Privacy questions and requests: Juliana de Oliveira Silva, operating BlisterFlow — juliana@pharmacying.com