Privacy Statement

Who is responsible

Lakeside Health Pharmacy is responsible for the personal health information you share through this website. As a pharmacy in Ontario, we are a "health information custodian" and handle that information in accordance with the Personal Health Information Protection Act (PHIPA). Any other personal information you send us, such as a general question, is handled under the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Our Privacy Officer is Mark Gobran. You can reach the Privacy Officer at 289-649-0005, by email at lakesidehph@gmail.com, or by mail at 825 N Service Rd #104-B, Stoney Creek, ON L8E 0J7.

What we collect on this website

When you use a form on this website, we collect only what you type into it:

• Your name, date of birth, phone number, and email address.
• For refills: prescription numbers, medication names, and whether you want pickup or delivery.
• For transfers: your current pharmacy's name and address, and the medications you want moved.
• For appointments: the service (a vaccine, a minor ailment consultation, or a medication review), the vaccine or condition you select, and your preferred date and time.
• Anything you add in a notes or message box.

Why we collect it

We use this information to respond to your request: to prepare a refill, transfer a prescription, schedule an appointment, or answer your question, and to provide you with pharmacy care. We contact you by phone or email only to deal with your request. We do not use it for advertising and we do not sell it.

We do not ask for your health card number or any payment details on this website.

Your consent

By submitting a form you are asking us to act on your request, and you agree that we may use the information you provide for that purpose. If you would rather not use the online forms, you are welcome to call the pharmacy instead.

You may withdraw your consent at any time by giving notice to the Privacy Officer. Withdrawing consent does not undo anything we have already done with your information, and without it we may not be able to complete your request. You may also tell us that you do not want your personal health information used or disclosed for health care purposes without your express consent.

Submitting for someone else

If you complete a form for another person, for example a child or a family member you care for, please do so only if you are their parent, guardian, or substitute decision-maker, or they have asked you to. By submitting the form you confirm that you are entitled to do so.

Who can see it, and who we share it with

Only authorized pharmacy staff can view requests, and only after signing in with their own account.

We share your information outside the pharmacy only when you consent, when it is needed to provide your care (for example, contacting your prescriber about a prescription or your current pharmacy about a transfer), or when the law requires or permits it.

To operate the website we use service providers that store or deliver information on our behalf: Vercel (website hosting), Supabase (database), and Resend (email delivery). They may only handle information to provide those services. The email notifications we send to staff say only that a new request arrived; they contain no patient information.

Where it is stored

Requests submitted through this website are processed and stored on secure cloud servers in Montréal, Canada. The companies that operate those services are headquartered in the United States, so in some circumstances their staff or United States law may reach information held on their systems. The email notifications sent to staff, which contain no patient information, are delivered through a provider in the United States.

How we protect it

• All traffic between your device and this website is encrypted (HTTPS).
• The details in each request (name, date of birth, medications, and so on) are encrypted again before they are stored, so they are unreadable without a key that is held separately from the database.
• Each staff member signs in with their own account, a password, and a one-time code from an authenticator app. The code is asked for again after 24 hours and whenever someone signs in from a new location.
• Every sign-in, every request opened, and every deletion is recorded in an access log that the Privacy Officer reviews.
• Staff sessions end automatically after a period of inactivity.
• The website limits how fast any one connection can send requests, to guard against automated abuse.
• Requests are deleted automatically on a fixed schedule (see below).
• If your information is ever lost, stolen, or used or disclosed without authority, we will tell you at the first reasonable opportunity, as PHIPA requires.
• No website or storage system can be made perfectly secure. If you believe your information has been misused, please tell the Privacy Officer right away.

How long we keep it

Requests are deleted 60 days after staff mark them handled. A request that is never marked handled is deleted after 180 days.

The access log described above (who signed in and which requests they opened) is kept for 2 years.

Information that becomes part of your pharmacy record is kept in our pharmacy record system for the period required of Ontario pharmacies, which is generally at least ten years. That record is separate from this website.

Your rights

You may ask to see the personal health information we hold about you, ask for a copy, ask us to correct it if it is inaccurate or incomplete, or ask a question about how it is handled.

Requests for access or correction are made in writing. Send yours by email to lakesidehph@gmail.com or by mail to 825 N Service Rd #104-B, Stoney Creek, ON L8E 0J7, or call 289-649-0005 and we will help you put it in writing. We may need to confirm who you are before we release anything. We will respond within 30 days. In some cases we may extend that by up to 30 more days, and if we do we will tell you why. If we cannot give you access to some or all of a record, we will explain the reason in writing.

Cookies and tracking

This website does not use advertising or analytics trackers. The map on the Contact page is loaded from Google, which may receive your IP address and set its own cookies when the map appears.

Email and messages

Regular email is not a secure way to send health information, so please do not email us details about your health or medications. If you give us a phone number or email address, we may use it to contact you about your request.

Changes to this statement

We may update this statement as our practices change. The date at the top of this page shows when it was last updated.

Complaints

To make a complaint, contact our Privacy Officer at 289-649-0005 or lakesidehph@gmail.com. You may also complain to the Information and Privacy Commissioner of Ontario: 1-800-387-0073, www.ipc.on.ca.