Privacy Policy and Personal Health Information

1 Applicable privacy laws and accountability

We operate in Oshawa, Ontario, and serve patients across Canada. Our handling of personal health information is governed by Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and its regulations. Our information practices are also governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, including applicable commercial information handling across provincial or national borders, and by other federal, provincial and territorial privacy requirements applicable to our services and information practices. This policy sets out our responsibilities and your rights under that framework.

The requirements that apply may depend on the information, service, parties involved and location of the activity. Nothing in this policy limits your rights under applicable law. For privacy questions, access or correction requests, or complaints, contact our pharmacy using the details in section 13 and ask for the person responsible for privacy.

2 Information we collect and its sources

We limit collection to information reasonably necessary for an identified, lawful purpose. Depending on the service, this may include:

• Identification and contact information, such as your name, date of birth, address, telephone number and email address.
• Prescription and health information, such as prescription numbers, medication names, allergies, relevant medical history, prescriber details, assessments and pharmacy care records.
• Insurance, benefits, billing and payment information, and health-card information only where legally permitted and necessary.
• Delivery instructions, service preferences, communications, consent instructions, and information about an authorized representative.
• Website technical information, such as an internet protocol address, browser and device details, pages accessed and interaction information, depending on the website features and settings in use.

We may receive information directly from you or an authorized representative, or from prescribers, other pharmacies, health-care providers, insurers and other authorized sources, with consent or other lawful authority. We also create records while providing care.

3 Why we use your information

We use information for the purposes explained when it is collected and as permitted by law. These purposes include assessing and providing pharmacy care; preparing, compounding and dispensing medications; reviewing medication safety; coordinating care with authorized providers; processing refill and transfer requests; contacting you about your care; arranging delivery; verifying coverage and processing payments; keeping required records; and responding to questions or complaints.

Information may also be used for legally permitted quality, safety, security and administrative activities. We do not require information beyond what is reasonably necessary for a service as a condition of providing it.

We take reasonable steps to keep information accurate, complete and current for the purposes for which we use or disclose it. Please tell us when your contact, medication, allergy or other relevant information changes.

4 Consent and your choices

We obtain knowledgeable consent where required. Consent may be implied for legally permitted health-care activities and must be express when the law requires it. Visiting this website or reading this policy does not constitute blanket consent to unrelated uses or disclosures.

You may ask questions, refuse consent, or withdraw or restrict consent by contacting our pharmacy’s privacy contact, subject to legal exceptions. We will explain any effect on our ability to provide safe care or complete a requested service. Withdrawal does not reverse previous lawful activity or remove legal recordkeeping duties.

We respect the rights of capable patients and verify the authority of a substitute decision-maker or other representative where applicable. Optional promotional communications are separate from care. We obtain the consent required for them, and you may withdraw that consent without losing access to pharmacy care.

5 When we share information

We disclose information only with appropriate consent or other lawful authority, and limit disclosure to what is reasonably necessary. Depending on your care or request, recipients may include:

• Your prescriber, other treating providers, or another authorized pharmacy involved in care, compounding, dispensing or a requested prescription transfer.
• Insurers, benefit administrators and payment providers, for authorized coverage, claims or payment purposes.
• Delivery providers, limited to information needed to arrange and complete delivery and meet applicable verification requirements.
• Technology, hosting, records-management and other service providers acting on our behalf under appropriate privacy and confidentiality requirements.
• An authorized representative, or regulators, public authorities and other persons where disclosure is permitted or required by law.

Separate consent or authorization is obtained when required for an optional patient-support program or a disclosure outside the purposes permitted for your care. You may ask our pharmacy’s privacy contact about disclosures relevant to your information.

6 Privacy safeguards and responsibilities

This policy establishes the privacy requirements for our pharmacy’s handling of personal information and personal health information. Our staff and agents are required to handle information only for authorized purposes and within their duties.

The safeguards required under this policy include:

• Restricting access to people who need information to perform authorized duties.
• Providing staff and agents with appropriate privacy instruction and confidentiality requirements.
• Protecting paper records, electronic accounts and devices against unauthorized access, loss and misuse.
• Using safeguards appropriate to the sensitivity of information when it is transmitted, stored, transferred or destroyed. Online transmission of sensitive information requires appropriate encryption, such as HTTPS with TLS, commonly referred to as SSL.
• Applying appropriate privacy and security requirements to service providers that handle information on our behalf.
• Maintaining procedures for access and correction requests, complaints and privacy incidents, and reviewing safeguards when services, technology or legal requirements change.

The pharmacy is responsible for implementing these requirements and addressing privacy concerns. No system can eliminate every security risk. If you are unsure how to send sensitive information, please call the pharmacy to arrange an appropriate method.

7 Website forms, cookies and external services

Our website is hosted on Squarespace. Our refill and transfer forms request contact details, prescription numbers or medication names, service preferences and any comments you choose to provide. Submissions are processed through Squarespace and stored in its form-submission platform. An email notification is also sent to the pharmacy at service@customcarepharmacy.ca. We use the information to review and process your request and communicate with you. Please provide only the information needed for that purpose.

Our website uses Squarespace cookies for essential functions, security and preferences. We use Squarespace analytics and Google Analytics to understand website use, including pages visited, interactions, and browser and device information, and to improve the website. Optional analytics cookies supported by the Squarespace cookie controls are restricted until you consent. You can accept or decline optional cookies, manage your choices in the cookie banner, and use the Cookie Preferences control to change those choices later. You can also control cookies through your browser settings; blocking essential cookies may affect some functions. These preferences apply to technologies supported by the Squarespace cookie controls and do not necessarily control every technology used by external or embedded services, such as the Google map.

Squarespace also independently collects certain technical visit information for security and service integrity, as described in the Squarespace Privacy Policy. Google’s information practices are described in the Google Privacy Policy.

The website also includes external booking links, including BookMyShot and BookMyTest, and an embedded Google map. When you use an external service, its privacy notice explains its own information handling. We remain responsible for information under our custody or control and for obligations that apply when a provider acts on our behalf.

Ordinary email is not guaranteed to be secure. Please do not email health-card numbers, identity documents or detailed clinical records unless we have arranged an appropriate method with you. Call us if your request involves sensitive documents or information beyond the fields requested by a form.

8 Service providers and information outside your province

Squarespace stores website data in the United States. Information handled through our Squarespace website is therefore processed outside Canada. Depending on the provider and service, information may also be processed in other countries. Information processed outside your province or outside Canada can be subject to the laws of that jurisdiction and lawful access by courts or public authorities. We remain accountable for meeting the privacy duties that apply to information under our control.

Our policy requires an assessment of a provider’s relevant information handling and protections, appropriate contractual or other safeguards, and any assessment, notice or consent required by applicable law before information is entrusted to that provider. You may contact our pharmacy’s privacy contact for details about the providers and processing locations relevant to your information.

9 Retention and secure disposal

We retain information for the period needed for its lawful purpose and for legal, professional and regulatory obligations. Ontario patient-care records are kept at least until the later of: ten years after the last recorded professional pharmacy service; or ten years after the date the patient’s eighteenth birthday occurred or would have occurred.

An access request, inspection, investigation, legal proceeding or other applicable requirement may require longer retention. Other records follow the retention requirements applicable to their purpose. Once information no longer needs to be kept, it is securely destroyed or otherwise disposed of as permitted by law. A consent withdrawal or deletion request does not override mandatory retention.

10 Access, correction and other privacy rights

You or an authorized representative may contact our pharmacy’s privacy contact to request access to your records, corrections to inaccurate or incomplete information, information about our practices, or an explanation of applicable privacy rights. Formal requests should be in writing. We verify identity and authority before releasing information.

We respond within the time required by the applicable law. Formal PHIPA requests ordinarily require a response within 30 calendar days; a lawful extension may apply, in which case we provide the required notice. We explain any permitted fee in advance. If access or a correction is refused, we provide the reasons and information about review or complaint rights as required by law. Where applicable, you may ask to have a statement of disagreement attached to a record.

Other provincial laws may provide additional rights, such as portability of certain electronic information or limits on particular uses. We will explain and honour additional rights that apply to your request, subject to lawful exceptions.

11 Privacy incidents

If we become aware of a privacy incident, we take steps to contain it, assess what happened, protect affected information and reduce the risk of recurrence. We keep required incident records and notify affected people, regulators and other parties as required by the law that applies.

For information governed by PHIPA, notification to the affected individual is required at the first reasonable opportunity following theft, loss, or unauthorized use or disclosure, and certain incidents must also be reported to Ontario’s Information and Privacy Commissioner. Where PIPEDA applies, its breach reporting, notification and recordkeeping rules are also followed.

12 Questions and complaints

You may raise a privacy concern with our pharmacy’s privacy contact. You may also contact the privacy regulator with jurisdiction over your concern without first completing our internal complaint process.

• Ontario health information: Information and Privacy Commissioner of Ontario, www.ipc.on.ca; 1-800-387-0073 or 416-326-3333; 2 Bloor Street East, Suite 1400, Toronto, Ontario M4W 1A8.
• Matters governed by PIPEDA: Office of the Privacy Commissioner of Canada, www.priv.gc.ca.
• Where another provincial or territorial law applies, the appropriate privacy regulator may also receive your complaint. Our pharmacy’s privacy contact can help identify the relevant authority. Quebec’s privacy regulator is the Commission d’accès à l’information, www.cai.gouv.qc.ca.

14 Changes to this policy

We post changes to this policy here and update the date above. We provide additional notice or obtain further consent where required by law. You may request a copy of the current policy from the pharmacy.