Privacy Policy

MediSyn Compounding Pharmacy ("MediSyn", "we", "our", or "us") is a licensed pharmacy operating in Ontario, Canada. We operate the MediSyn platform at medisyn.ca, which allows patients to manage prescriptions, book appointments, and communicate with pharmacists online.

Privacy Officer: Our designated Privacy Officer can be reached at privacy@medisyn.ca. You may also write to us at our registered pharmacy address.

As an Ontario pharmacy, we are subject to:

• PHIPA — Personal Health Information Protection Act (Ontario) — governs your Personal Health Information (PHI)
• PIPEDA — Personal Information Protection and Electronic Documents Act (Federal) — governs personal information in commercial activities
• CASL — Canada's Anti-Spam Legislation — governs commercial electronic messages
• Ontario College of Pharmacists standards and regulations

We collect your information only for the purposes described at the time of collection. These include:

• Filling and managing your prescriptions
• Booking and managing pharmacy appointments and vaccinations
• Responding to your Ask-a-Pharmacist consultations
• Processing your ecommerce orders and returns
• Creating and managing your patient account
• Sending you transactional communications (order confirmations, appointment reminders, prescription status updates)
• Complying with our legal and regulatory obligations as a licensed pharmacy
• Improving the safety and quality of our services

We will never use your personal health information for marketing, research, or any purpose other than providing pharmacy services, unless you give us separate explicit consent.

By registering an account and using our services, you consent to the collection and use of your information as described in this policy. For Personal Health Information, your consent is collected explicitly during registration and is recorded with a timestamp, your IP address, and the version of this policy you agreed to.

You may withdraw consent at any time by contacting our Privacy Officer. Note that withdrawing consent for PHI collection may prevent us from providing pharmacy services to you.

We do not sell your personal information. We may share it only in the following circumstances:

• Healthcare providers: With your prescribing physician or clinic where required to fulfill a prescription
• Regulatory bodies: With the Ontario College of Pharmacists or other regulators as required by law
• Service providers: With third-party vendors who process data on our behalf (see Section 8) under data processing agreements
• Legal requirements: Where required by court order or applicable law

• All data is transmitted over encrypted HTTPS/TLS connections
• Data at rest is encrypted in our cloud database and file storage
• Passwords are hashed using Argon2 (a healthcare-grade algorithm)
• Access to PHI is restricted to authorized staff and logged for every access
• We use role-based access control — staff can only access records relevant to their role
• Authentication tokens expire after 15 minutes; sessions require regular re-authentication
• We log all login attempts and lock accounts after repeated failed attempts

We use the following third-party services to operate our platform. Each provider has signed a data processing agreement and is required to protect your data in accordance with PHIPA and PIPEDA:

• Cloud database: MongoDB Atlas (encrypted at rest, Canadian or US region)
• File storage: S3-compatible storage for prescription documents (private, access-controlled, encrypted)
• Email delivery: Brevo / Resend (transactional emails only)

We do not transfer your PHI outside Canada without your explicit consent, except where required by law.

We retain your Personal Health Information for a minimum of 6 years following your last prescription or healthcare transaction, in accordance with Ontario pharmacy regulations. After this period, records are securely deleted or anonymized.

Non-health personal information (account data, order history) is retained for as long as your account is active, or for up to 3 years after account closure.

Under PHIPA and PIPEDA, you have the right to:

• Access: Request a copy of all personal and health information we hold about you
• Correction: Request corrections to inaccurate information
• Withdraw consent: Withdraw consent for non-essential data uses at any time
• Data portability: Request your data in a machine-readable format
• Erasure: Request deletion of your data (subject to legal retention obligations)

To exercise any of these rights, contact our Privacy Officer at privacy@medisyn.ca. We will respond within 30 days.

We will only send you promotional or marketing emails if you have explicitly opted in during registration or at a later time. Every marketing email includes an unsubscribe link. You may also unsubscribe at any time by emailing privacy@medisyn.ca or visiting our unsubscribe page.

Transactional emails (appointment reminders, prescription status updates, order confirmations) are operational communications and are not subject to marketing opt-out.

In the event of a privacy breach involving your personal health information, we will notify you and the Ontario Privacy Commissioner as required by PHIPA §12. Notification will occur within 30 days of discovering the breach.

We use essential cookies to keep you logged in and secure your session. We do not use advertising or tracking cookies. You may disable cookies in your browser settings, but this will prevent login.

If you believe we have violated your privacy rights, you may contact our Privacy Officer at privacy@medisyn.ca.

You may also file a complaint with:

• Privacy Commissioner of Canada (PIPEDA): www.priv.gc.ca
• Information and Privacy Commissioner of Ontario (PHIPA): www.ipc.on.ca

We may update this Privacy Policy from time to time. When we do, we will update the effective date and version number above, and notify you by email if the changes are material. Continued use of our services after changes take effect constitutes acceptance of the new policy.