Politique de confidentialité

Last Updated: October 26, 2026

This Privacy Policy applies to personal information collected by Mednow Digital Inc. through the mednow.ca website and online store, the Mednow mobile and web applications, and Mednow pharmacy services, and by MedVisit Inc. through MedVisit home physician visit services. References to "Mednow", "we", and "us" mean the applicable entity providing the service. Both entities follow this Privacy Policy and share the Privacy Officer identified in Section 13. This Privacy Policy also covers personal information collected from prescribers, clinic users, and other healthcare partners through the prescriber app and doctor dashboard. By using our services, you acknowledge that you have read this Privacy Policy.

1. Information We Collect

We may collect information that you provide directly to us, information generated through your use of our services, and information processed by service providers acting on our behalf. This may include your name, preferred name, email address, phone number, date of birth, sex or gender, account credentials or authentication information, physical and delivery addresses, health card or provincial health information, government identification information, insurance or benefits information, family or caregiver relationship information, order and service history, prescription and pharmacy information, appointment information, communications with us, uploaded files or images, payment-related information, and device or account identifiers such as push notification tokens.

We collect and use this information to provide and support our services, manage accounts, communicate with you, process payments, deliver orders, support pharmacy and healthcare workflows, protect security, prevent fraud, meet legal and regulatory obligations, and maintain required records.

2. Health and Pharmacy Information

To provide pharmacy, prescription, appointment, medication review, ePrescription, minor-service, delivery, and related healthcare services, we may collect and process health and pharmacy information. This may include prescriptions, medication names, dosages or strengths, allergies, self-reported medications, medical history, symptoms, conditions, health card information, prescriber or pharmacy information, appointment details, service intake responses, order details, and information about dependents or family members where you use family or caregiver features.

We use this information to provide services, verify eligibility, support pharmacy and healthcare workflows, communicate with you, comply with legal and regulatory obligations, and maintain required records.

3. Uploaded Documents and Images

You may choose or be required to upload documents or images for certain services. These may include prescription images, health card images, government identification images, insurance or benefits card images, profile photos, chat or support attachments, order-related images, receipts, or other documents. These files may contain personal information, health information, identity information, and other sensitive information.

Uploaded files are stored in Google Cloud Storage in private buckets located in Toronto, Canada. Backups are stored in the same region. Files are encrypted at rest using GCP default encryption and are accessed using signed URLs. Uploaded files are not publicly accessible. Uploaded files may be retained for up to 10 years or as otherwise required or permitted for audit, compliance, pharmacy/healthcare recordkeeping, payment, security, or operational purposes.

4. Payment Information

For customer mobile app pharmacy, prescription, appointment, and related payment flows, payment information is processed using Stripe and, where applicable, Stripe Connect. Payment information may include cardholder details, billing details such as postal code, payment method identifiers, customer identifiers, payment intent or setup intent identifiers, checkout session identifiers, payment links, refund or transfer records, transaction amounts, payment status, and connected-account metadata.

Card details may be submitted directly to Stripe or processed by Stripe payment tools. Mednow may receive and store payment-related identifiers and transaction metadata needed to complete payments, manage saved payment methods, process refunds, reconcile transactions, support users, and meet legal, accounting, audit, payment, security, and operational requirements.

5. Website Hosting / Shopify

We use Shopify to host the mednow.ca website. Shopify's role described here is website hosting; payment processing for customer mobile app services is described in Section 4. Website cookies and similar technologies are described in Section 16.

6. Service Providers

We use service providers acting on our behalf to operate, support, and deliver the services. These include Stripe and Stripe Connect for mobile app payment processing; Shopify for website hosting; Google Cloud Storage for uploaded documents and related storage; Firebase Cloud Messaging and Apple Push Notification service for push notifications; Twilio SMS, Twilio Voice/Call Center, and Twilio Conversations for communications and chat; SendGrid for transactional email; Google Places/Maps for address autocomplete, place lookup, and pharmacy search; Uber Direct for delivery services; SRFax for faxing prescriptions or external pharmacy communications; Zoho for CRM or operational workflows; Kroll/PharmacyLink for pharmacy system integrations; and Health Canada DPD for drug product database data.

These service providers may process personal information, health or pharmacy information, payment-related information, communications, uploaded files, device identifiers, or address information where required to provide their services to us.

Where service providers process SMS-related information on our behalf, including phone numbers, SMS consent, SMS opt-in or opt-out status, message content, delivery status, timestamps, and related messaging records, they may do so only as needed to provide services to Mednow and not for their own marketing or promotional purposes.

6A. Mobile App Analytics

We use Google Analytics for Firebase to understand how people use the Mednow mobile app, identify difficulties in app workflows, and improve the service. Analytics may include app launches, screen views, feature interactions, steps reached in a form, sign-in method, payment-flow outcomes, app and device information, and app-instance identifiers.

Google Analytics also derives approximate geographic information from masked IP addresses. This does not use the device's GPS or Apple Location Services.

Our app records categories of activity, such as starting a prescription request, booking a home visit, selecting delivery or pickup, or completing a payment. These events can reveal that a person interacted with a healthcare-related service even when the event does not include their clinical details.

The app's custom analytics events are designed to use predefined categories rather than names, email addresses, phone numbers, health card numbers, prescription contents, uploaded documents, chat messages, or full payment-card details. This describes our custom event fields; service providers may also process technical information through their SDKs. Analytics information may be associated with an app instance or device and is not necessarily anonymous.

The app includes Meta's software development kit. In the current mobile release, automatic Meta app-event logging and advertising-identifier collection are disabled, and the app does not forward its custom interaction events or screen views to Meta. This statement concerns the mobile app configuration and does not describe separate website cookies, advertising accounts, or other Mednow marketing systems.

Google/Firebase and other relevant providers may process technical information outside Canada. Our cross-border processing section also applies to analytics. For questions about analytics or related privacy choices, contact our Privacy Officer using the contact details below.

6B. Campaign Links and Attribution

When you open the app using a supported campaign link, we may record the campaign source and numeric campaign, ad-set, and advertisement identifiers included in that link. We associate these identifiers with app analytics to understand which campaigns bring people to the app and how those users interact with its features.

The mobile app's campaign-attribution feature accepts a limited set of fields. It does not retain campaign names, free-text campaign parameters, or Facebook click identifiers through that feature. Other information needed to open the requested app screen is handled separately.

The campaign-attribution record stored locally by this feature expires after 30 days. That period applies to the local record; it does not mean information already sent to an analytics provider is deleted after 30 days. Provider-side retention is governed by the applicable service configuration and our retention practices.

6C. App Configuration

We use Firebase Remote Config to deliver app settings, including update notices and payment-feature availability. Firebase processes technical information such as device country and language codes, time zone, operating system and SDK versions, app identifiers, and the app environment. When used with Google Analytics, Remote Config can also obtain Analytics user properties and the time the app was first opened to support configuration targeting. This processing is also subject to the cross-border processing section below.

7. Communications and Notifications

We may communicate with you by email, SMS/text message, push notification, phone, in-app message, or chat for service, transactional, operational, account, support, payment, delivery, security, or administrative purposes. Where you have separately consented, we may also send you marketing and promotional communications as described in Section 7C.

Push, SMS, email, and chat payloads are not intended to include PHI. They may include service labels, payment links, appointment references, order IDs, and generic prescription or order status text. Communications may still reveal service context. Users should avoid sending unnecessary sensitive information through communication channels unless requested for a service.

We may collect and process communication details such as email addresses, phone numbers, push notification tokens, notification preferences, message content, call metadata, conversation identifiers, delivery status, and related records.

7A. Mobile Information, SMS Consent, and SMS Privacy

Mednow does not sell, rent, share, transfer, or provide mobile phone numbers, SMS opt-in information, or SMS consent data to third parties or affiliates for their own marketing or promotional purposes.

Mobile information may be provided to service providers acting on Mednow's behalf only where necessary to operate the SMS/text messaging service, provide Mednow services, comply with applicable law, support security or fraud prevention, or fulfill legal, regulatory, pharmacy, healthcare, audit, or compliance obligations.

Service providers that process SMS-related information on Mednow's behalf are permitted to use that information only as necessary to provide services to Mednow and are not permitted to use mobile phone numbers, SMS opt-in information, or SMS consent data for their own marketing or promotional purposes.

We may process SMS-related information including mobile phone numbers, SMS consent records, opt-in and opt-out status, message content, timestamps, message delivery information, and related messaging records.

We maintain administrative, technical, and organizational safeguards designed to protect SMS-related information against unauthorized access, use, disclosure, transfer, sale, or sharing.

7B. SMS Consent, Opt-Out, and Help

When you provide your mobile number and affirmatively opt in to receive SMS/text messages from Mednow Digital Inc., you consent to receive SMS/text messages from Mednow at that number.

Depending on the consent you provide and the Mednow services you use, SMS messages may include service notifications, appointment reminders, account notices, payment or delivery updates, pharmacy or prescription status updates, customer support communications and, where you have separately opted in to receive them, marketing or promotional messages from Mednow.

Message frequency varies. You may receive approximately 2 - 3 messages per week, although actual frequency may vary depending on your account activity, use of Mednow services, and marketing preferences.

Message and data rates may apply.

Consent to receive marketing SMS messages is not a condition of purchasing goods or services from Mednow.

You may opt out of SMS/text messages at any time by replying STOP. For assistance, reply HELP. You may also contact Mednow using the contact information provided in the "Contacting the Privacy Officer" section below.

7C. Marketing Communications and Consent

Mednow may send marketing and promotional communications by email or SMS/text message, including health tips, product and service information, news, and special offers. We send these communications only where we have your express consent to do so, in accordance with Canada's Anti-Spam Legislation (CASL) and applicable privacy laws.

How we obtain consent. You may provide express consent by signing up through a marketing form on our website, by checking an unchecked marketing consent box during account creation or checkout, or by opting in through another method where the purpose is clearly identified. We will not treat your creation of an account, placement of an order, or use of pharmacy or healthcare services as consent to receive marketing communications.

Consent is not a condition of service. Consent to receive marketing communications is not a condition of purchasing goods or services, filling a prescription, or using any Mednow service.

Health and pharmacy information is not used for marketing. We do not use your prescription, medication, health condition, or other health or pharmacy information to select or personalize marketing communications unless you have separately and expressly consented to that use. Marketing communications are sent based on your general contact information and the marketing preferences you have provided to us.

Identification and unsubscribe. Each marketing communication will identify Mednow Digital Inc. as the sender, include our contact information, and include a way to unsubscribe. You may withdraw your consent at any time by using the unsubscribe link in any marketing email, by replying STOP to any marketing SMS message, by updating your communication preferences in your account where available, or by contacting our Privacy Officer using the details in Section 13. We will act on unsubscribe requests without delay and in any event within 10 business days. Withdrawing marketing consent does not affect service, transactional, or account communications necessary to provide the services you use.

Systems and service providers. Marketing communications may be sent using service providers acting on our behalf, including Zoho for marketing email and Twilio for marketing SMS. Twilio is also used for transactional messages. Shopify is used for website hosting, not for sending marketing emails. These providers process your contact information, consent records, and communication preferences only to provide services to Mednow and may not use them for their own marketing purposes. Our website may also use cookies, pixels, and advertising accounts, including with Meta and Google, for advertising and measurement; these are separate from the mobile app configuration described in Section 6A.

Consent records. We keep records of your marketing consent, including the date, method, and source of consent and any withdrawal, for as long as needed to demonstrate compliance with applicable law.

8. Address Autocomplete / Google Places / Maps

We may collect and process physical addresses, delivery addresses, service addresses, place identifiers, address search text, and selected address or pharmacy details to provide delivery, serviceability, appointment, pharmacy routing, and address autocomplete features. We use Google Places/Maps for address autocomplete, place lookup, map-related services, and pharmacy search.

9. Delivery Services

Where delivery is available, we may use delivery partners such as Uber Direct to assess serviceability, provide delivery quotes, complete deliveries, and provide delivery status. Delivery partners may receive information needed to complete delivery, such as pickup/dropoff details, recipient contact information, delivery instructions, barcode/status details, and related service information.

10. Account Deactivation, Deletion Requests, and Retention

You may submit an account deactivation or deletion request through the app or by contacting us. The in-app request deactivates your account, creates a deletion request record, and signs you out by revoking active sessions. It does not immediately hard delete or anonymize all records.

After a request is created, Mednow has a manual deletion/anonymization process handled by the tech team. Certain records may remain for up to 10 years or as otherwise required or permitted by law, pharmacy or healthcare recordkeeping obligations, audit, payment, security, compliance, dispute resolution, tax, accounting, or operational requirements.

Retained records may include patient profile data, pharmacy/prescription/order/appointment records, uploaded files/images such as health card, government ID, benefits card, and prescription images, payment records and Stripe identifiers, chat/support messages, notification history and push tokens, and audit/security logs.

11. Security and Storage

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include secure transmission methods, authentication controls, local secure storage for certain account or biometric unlock tokens, private cloud storage, encryption at rest where provided by our cloud provider, signed URLs for file access, and access controls for authorized personnel and service providers.

These safeguards also apply to SMS-related information, including phone numbers, SMS consent records, SMS opt-in and opt-out status, message content, delivery status, timestamps, and related messaging records, and are designed to protect against unauthorized access, use, disclosure, transfer, sale, or sharing.

No method of transmission or storage is completely secure. We continue to review and update our safeguards as our services and legal obligations evolve.

11A. Device Permissions and Biometric Sign-In

The app may request camera or photo access when you choose to capture or upload an image, and notification permission to send push notifications. You can manage these permissions in your device settings. Declining a permission may limit the corresponding feature.

If you choose to enable biometric sign-in, your device performs the Face ID, Touch ID, or other supported biometric check. Mednow does not receive your facial scan, fingerprint, or biometric template through this feature. The app receives the authentication result and uses a session token protected by the operating system's secure storage. You can turn biometric sign-in off in the app's Security settings.

The app also uses secure local storage for session credentials. Other temporary account and form information may be held in memory while you use the app. Signing out clears user-scoped app caches; reinstalling the app triggers a fresh-install session check. These actions do not delete service records held by Mednow or its providers. Account deletion requests are handled as described in the retention section.

12. Cross-Border / Service Provider Processing

Some service providers may process or store information outside your province, territory, or country. Where information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction. We use service providers where needed to provide the services, subject to contractual, legal, privacy, and security safeguards where applicable.

13. Contacting the Privacy Officer

The Privacy Officer listed below is the shared contact for Mednow Digital Inc. and MedVisit Inc. If you have questions about this Privacy Policy, our privacy practices, SMS/text messages, SMS consent, marketing communications, or your communication choices, you may contact us at:

Privacy Officer
Mednow Digital Inc.
61 International Blvd
Etobicoke, Ontario M9W 6K4
pharmacy-privacy@mednow.ca

For SMS/text message help, you may also reply HELP to any SMS message. To opt out of SMS/text messages, reply STOP to any SMS message.

To unsubscribe from marketing emails, use the unsubscribe link in any marketing email or contact the Privacy Officer at the address above.

14. Your Rights

Subject to applicable law, you have the right to access the personal information we hold about you, to request that inaccurate or incomplete information be corrected, and to withdraw your consent to our collection, use, or disclosure of your information. Withdrawing consent may limit our ability to provide certain services, and we will explain the consequences at the time of your request. Requests to deactivate or delete your account are handled as described in Section 10.

To exercise these rights, contact our Privacy Officer using the details in Section 13. We may ask you to verify your identity before responding. We will respond within 30 days, or within the period required by applicable law, and will tell you if we need more time. Where we refuse a request in whole or in part, we will explain why and tell you how to challenge the decision. Access to health records may be subject to additional requirements under the Personal Health Information Protection Act (Ontario) or equivalent provincial legislation.

15. Quebec Residents

If you reside in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) applies to your personal information. Our Privacy Officer, identified in Section 13, is the person in charge of the protection of personal information at Mednow.

As described in Section 12, some of your personal information may be communicated to service providers outside Quebec, including elsewhere in Canada and in the United States. We assess the privacy risks of such transfers and apply contractual and security safeguards.

In addition to the rights in Section 14, you may request that we stop disseminating your personal information or de-index it, and you may request a copy of computerized personal information you provided to us in a structured, commonly used technological format. If you are not satisfied with our response to a privacy request or complaint, you may contact the Commission d'accès à l'information du Québec.

16. Cookies and Website Tracking

The mednow.ca website and online store use cookies and similar technologies. Essential cookies are required for the site to work, including the shopping cart, checkout, and login. Analytics cookies help us understand how the site is used. Marketing and advertising cookies and pixels, including those from Meta and Google, support advertising and measure campaign performance as described in Section 7C.

Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choices at any time through the cookie settings on our website. You can also control cookies through your browser settings. Blocking essential cookies may prevent parts of the site from working. This section describes the website; the mobile app's analytics and configuration are described in Sections 6A to 6C.

17. Minors and Dependents

Account holders must be 18 or older. For both Mednow pharmacy services and MedVisit services, care for minors is managed through a parent or authorized caregiver's account. Where you use family or caregiver features to manage services for a minor or another dependent, you must have the authority required by applicable law to act on their behalf. We respect the patient's own consent rights where applicable; managing an account does not by itself give unrestricted authority over another person's health information. Information about minors and dependents is handled in accordance with this Privacy Policy. If we learn that we have collected personal information from a minor without appropriate consent or other lawful authority, we will take steps to address the collection and delete the information where permitted, subject to applicable health-record retention and other legal obligations described in Section 10.

18. Privacy Breaches

We will notify affected individuals and report privacy breaches to the appropriate regulator when required by applicable law, within the required timeframes. We maintain records of privacy breaches and review our safeguards following any incident.

19. Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first using the details in Section 13. We will investigate and respond to your complaint. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Ontario, or the privacy regulator in your province.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, service providers, or legal obligations. The "Last Updated" date at the top of this page shows when it was last revised. For material changes, we will provide additional notice, such as an email or in-app message, where required by law. Where required by applicable law, we will obtain your consent before collecting, using, or disclosing your personal information for new purposes.