1. Scope and responsibility

This policy describes how TCM Prescription Platform (tcmprescription.ca, "we" or "us") handles personal information about website visitors, registered practitioners, clinic contacts, patients, and people who contact us. It covers our website, practitioner portal, prescription fulfillment, and the current TCM Assist trial. The service is for practitioners, not a public or retail pharmacy.

Patient-linked prescriptions can be personal health information. The prescribing practitioner or clinic is generally responsible for its clinical records and patient relationship. We support authorized prescription and dispensing activities and are responsible for our own information handling. Our legal role depends on the activity and applicable law; calling us a service provider does not remove our obligations.

Ontario's Personal Health Information Protection Act, 2004 (PHIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may apply, as may other provincial laws. This notice is not a certification of compliance, a replacement for a clinic's privacy notice, or a waiver of your rights.

2. Information we handle

• Practitioner accounts: name, email, phone, clinic mailing address, registration or licence number, authentication and email-verification records, account settings, and support correspondence. Authentication is handled through Supabase.
• Professional verification: qualification status, reviewer decisions, and the practitioner identity used to determine assistant eligibility. Accounts confirmed to belong to the same practitioner may share trial limits.
• Patients and prescriptions: patient name, email, phone, delivery address or clinic destination, prescribing practitioner, herbs and variants, quantities, dosing directions, duration, submitted notes, labels, order history, and fulfillment status. Only include information needed for the relevant task.
• Financial records: order amounts, discounts, practitioner markup or commission, balances, payout requests and status, checkout references, payment confirmations, and payment-event records. Our application does not collect or store full card numbers or card security codes.
• Communications: messages you send us, transactional email content, recipient addresses, delivery or failure information, and notification references.
• Technical and usage information: authentication events, IP addresses and browser/request information processed by our infrastructure, operational logs, errors, and account-linked assistant usage and feedback described below.

Our standard prescription form does not request health-card numbers, government ID documents, or a complete medical record. Do not put these into notes or support messages. Information about another person must be submitted with appropriate authority.

3. Sources and purposes

Information comes from you, the prescribing practitioner or clinic, checkout details supplied by the payer, payment and email service responses, and use of the platform. Qualification review may also involve relevant professional registration information.

• Create and secure accounts, verify practitioner eligibility, and provide support.
• Prepare prescriptions, labels and orders; arrange dispensing, delivery or clinic pickup; and support practitioner follow-up.
• Process payments, reconcile orders and commissions, handle payout requests, and maintain financial records.
• Send account, password-reset, payment, order and fulfillment communications.
• Provide requested AI assistance, administer trial limits, measure adoption and costs, and understand whether the assistant is useful.
• Investigate failures or misuse, protect accounts, resolve disputes, and meet applicable legal obligations.

The platform is not an advertising marketplace. Patient information and prescriptions are not used by the platform for behavioural advertising.

4. Consent and your choices

Practitioners must explain the relevant fulfillment and information-sharing arrangements to patients and obtain any required consent or other lawful authority before submitting their information. This includes selecting the correct patient or clinic delivery destination and confirming contact details. A practitioner's agreement to website terms is not a substitute for a patient's required consent.

You can choose not to use the floating AI assistant. Its privacy confirmation is a statement that identifiers have been removed, not proof that a patient has consented or that re-identification is impossible. The separate prescription-review workflow also uses AI, as explained below.

Contact us to discuss withdrawing consent or restricting future processing. We will explain any legal or contractual limits and the effect on an account or order; for example, fulfillment requires a recipient and delivery information. Withdrawal does not undo completed processing or require deletion of records that must lawfully be retained. Simply visiting this policy does not authorize unrelated uses of your information.

5. AI assistance and prescription review

TCM Assist: de-identified trial only

When a qualified practitioner chooses to generate a suggestion, the entered case notes and selected output language are sent through our server to OpenAI. Do not enter names, initials that identify a person, contact details, exact birth dates, health-card or chart numbers, or other identifying details. Rare conditions and combinations of facts can still identify someone even after a name is removed.

The current floating assistant does not write case notes or generated suggestions to a patient profile, conversation history, or our application database. They are held in browser and request memory while being processed. Ending or clearing a consultation, refreshing, leaving the page, or signing out clears the page's working content; minimizing the assistant does not. This is not a guarantee of forensic erasure from a device, browser, or service provider.

We do retain account-linked operational records: trial eligibility and activation, usage counts, timestamps, request identifiers, model/configuration versions, token and cost information, completion or error status, and structured feedback such as helpful/not helpful or copied. Administrators can review these records to manage access, costs, reliability, and trial adoption. They are not anonymous just because they exclude case text. Trial expiry does not automatically delete these records.

Other AI features are separate

The prescription-review step sends the formula, per-dose quantities, frequency, duration, and the directions/notes field to OpenAI. Patient identity fields are not deliberately included in that review request, but identifiers typed into notes will be sent. Herb-name translation for labels sends herb names; patient and practitioner details are added to the label by our application, not by that translation request. Submitted prescriptions and labels are not covered by the floating assistant's no-saved-case-history behaviour.

Provider retention and human review

The floating assistant requests store: false. This does not mean zero retention: OpenAI describes default abuse-monitoring retention of up to 30 days, with exceptions for legal or safety needs. Its API data is not used for model training by default unless the customer opts in. We do not represent this trial as a Zero Data Retention arrangement. See OpenAI's API data controls for provider-specific details.

AI output can be inaccurate and must be assessed by the practitioner. The floating assistant does not independently diagnose, prescribe, create an order, or make a payment. Copying a suggestion places it on your device clipboard; pasting it into a prescription, clinical record, email, or another service creates a separate record subject to that destination's handling. Clearing the assistant does not remove those copies.

6. Service providers and payments

The following services support the current platform. The information they receive depends on the feature used; not every provider receives every category of information.

Supabase

Account authentication, database storage, backend functions, and related operational records for accounts, prescriptions, payments, and assistant usage.

Vercel

Website hosting and server execution, including processing requests and technical information needed to deliver and protect the service.

Stripe

Hosted checkout and payment processing. Stripe receives payer and billing details, shipping details where collected, amounts and order references, and checkout metadata that can include patient name, email, phone, practitioner name, and delivery choice. Some existing checkout records may also contain a herb summary. Stripe returns payment and checkout information to us, including through stored webhook events.

Resend

Transactional email delivery, including recipient addresses, message contents, and delivery metadata. Account emails also involve our authentication service and its configured email delivery service.

OpenAI

Case suggestions, formula review, and herb-name translation as described in the AI section. These requests may contain sensitive information even when direct identifiers have been removed.

Provider processing is governed by applicable service arrangements, configuration and law. Some providers, particularly payment providers, also process information for their own fraud-prevention, security, or legal responsibilities under their privacy notices. These links offer additional detail; they do not replace our responsibilities for information we handle.

7. Fulfillment, emails and other disclosures

The prescribing practitioner and authorized platform administrators or dispensing personnel can access information needed for their work. Payment and fulfillment notifications can include patient and practitioner names, patient contact details, prescription items and directions, order references, and the selected delivery destination. Couriers or delivery partners receive the recipient and delivery information necessary to arrange delivery. A clinic destination is different from a patient home address.

Order information may also be transmitted to an operational scheduling integration if one is enabled for fulfillment. Please contact us for the providers and arrangements relevant to your order.

Email and payment links are not the same as a private clinical messaging system. Messages can be misdirected, forwarded, retained by recipients, or seen by someone with access to their mailbox or device. Check recipient details before submission; do not forward payment or password-reset links unnecessarily. Do not email a complete medical record, password, or card details to support.

We may disclose information where authorized or required by law, for a valid legal demand, or to address fraud, security incidents, or a serious threat as permitted by law. Any transfer associated with a business reorganization must also have a lawful basis and appropriate protections; this policy does not authorize unrestricted disclosure.

8. Data location and cross-border processing

A Canadian service does not mean that all of its data stays in Canada. Hosting, authentication, email, payments, AI processing, support, and backups can involve Canada, the United States, or other locations used by service providers and their subprocessors. We do not promise Canada-only storage or processing.

Information processed abroad may be subject to that jurisdiction's laws and accessible to its courts, law-enforcement or other authorities. Contractual and technical safeguards do not override those laws. Contact us before submitting information if your clinic has particular residency, contracting, or transfer restrictions. The OPC's cross-border processing guidance explains these considerations.

9. Browser storage and usage measurement

The browser authentication client uses local storage to maintain sign-in sessions. The administration interface also stores a label-preparer preference on that device. Our service providers may use cookies or similar technologies for authentication, security, and checkout. Clearing browser storage can sign you out or remove preferences; it does not delete server-side records.

The current website does not integrate advertising pixels, session-replay software, or third-party marketing analytics. The assistant does record first-party, account-linked events such as exposure, opening, blocked access, and reaching a limit, along with the usage and feedback described above. Hosting and service providers may keep their own operational logs.

On shared devices, sign out and consider downloaded labels, printouts, clipboard history, and browser autofill. Those copies are not controlled by clearing an assistant consultation.

10. Retention, deletion and backups

Our retention standard is to keep personal information only as long as reasonably necessary for its purposes or required by law. The appropriate period depends on the record, clinic instructions, financial reconciliation, security investigations, and disputes. We do not apply a single automatic deletion period to all records or promise that closing an account immediately erases them.

• Account and qualification records support access, verification, account administration and prevention of duplicate trial use.
• Prescription, dispensing and financial records support fulfillment, follow-up, payment and commission reconciliation, accounting and applicable recordkeeping duties. They can remain after payment, delivery, or account closure.
• Assistant case text follows the transient handling described above; stored usage and review records have different retention needs. Provider retention is separate.
• Emails, support and technical logs can remain in operational systems and provider records for delivery troubleshooting, account support and security.
• Backups may contain account, authentication, prescription and financial records. Encrypted administrative backups are used for recovery. A change or deletion in the active database does not immediately remove a previous backup copy.

We assess deletion requests against these needs and applicable law and can explain what can be removed, what must be retained, and why. Backup and provider copies may remain until their applicable retention or disposal processes complete. We do not promise a fixed purge deadline that the current system does not implement.

Practitioners remain responsible for their clinical records and professional retention duties. The assistant is not a clinical record archive. Keep any necessary, reviewed clinical documentation in your authorized record system.

11. Access, correction and account closure

You may ask what personal information we hold about you, how it is used and disclosed, request access or correction, raise a privacy concern, or request account closure or deletion where available under applicable law.

Patients should generally direct clinical-record requests to their prescribing practitioner or clinic. You may also contact us about information handled by this platform; we will help identify the responsible party rather than treat the absence of a patient account as a reason to ignore your request. An authorized representative or substitute decision-maker can contact us where legally permitted.

Email admin@tcmprescription.ca with the subject "Privacy request", your relationship to the service, and a brief description. Initially provide only enough information to locate your account or order. We may need to verify your identity and authority using a proportionate method before releasing information; do not send ID documents or detailed health information unless a suitable method has been arranged.

Where PIPEDA applies, access requests generally require a response within 30 days of receipt, subject to permitted extensions and notice. PHIPA requests to a custodian also normally have a 30-day response period, with limited extensions. Any applicable refusal, extension, fee estimate, and complaint route must be explained. Rights can be limited by law, including another person's privacy or legally protected records. See the OPC access guidance and Ontario health-record guidance.

12. Safeguards and privacy incidents

The platform uses HTTPS, authenticated access, authorization checks for practitioner and administrator functions, database access restrictions, and server-side handling of privileged credentials. Operational records support troubleshooting and investigation. Administrative recovery backups are encrypted. These measures reduce risk but cannot make any system or email delivery completely secure.

Protect your credentials and devices, do not share accounts, and report suspected unauthorized access or misdirected messages to admin@tcmprescription.ca. Identify the issue without including unnecessary patient details.

When an incident is identified, our response is to investigate and contain it, assess affected information, and coordinate with relevant practitioners and providers. Notification and reporting depend on the applicable law and our role. PHIPA can require notice at the first reasonable opportunity, and PIPEDA requires reporting and individual notification for breaches posing a real risk of significant harm. We must also maintain breach records where required. See Ontario's health privacy breach protocol and the OPC's breach guidance.

13. Children and representatives

Practitioner accounts are not intended for children. A practitioner may submit a prescription for a minor only with appropriate clinical and legal authority, including consent from the patient or an authorized substitute decision-maker as applicable. Capacity and health-information rights are determined by applicable law, not solely by age. The assistant's de-identification requirement applies to all cases.

14. Changes to this policy

The effective date identifies this version of the policy. We will update the notice when material practices change and provide additional notice or obtain consent when required. Posting an update does not, by itself, authorize a new incompatible use of previously collected health information.

This version expands the explanation of AI processing, account-linked trial measurement, service providers, payment metadata, browser storage, retention, backups, and privacy requests. It does not enable paid AI subscriptions or referral rewards.

15. Privacy contact and complaints

TCM Prescription Platform, privacy inquiries
admin@tcmprescription.ca

Use this contact for questions, access or correction requests, account-closure requests, provider or retention questions, and privacy complaints. Please tell us how to reach you safely. You can request an accessible copy of this notice or assistance understanding the process.

You may also contact the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Ontario, or the relevant provincial authority. You do not have to waive your right to complain to use the service.

Related: Terms & Conditions. Practitioners should make this policy available in patient-facing communications and ensure their clinic's own notice covers the services they use.