Two distinct roles
For its patients’ information, each client pharmacy is the organization responsible within the meaning of the Act respecting the protection of personal information in the private sector. Oltra processes this information on its behalf, under a data processing agreement, and solely to provide the service.
For the information of platform users (name, email, licence number, role) and website visitors, RxClinique is the organization responsible.
Information collected
We collect only what is necessary:
- Account: name, work email, pharmacy, role and, where applicable, licence-to-practise number.
- Usage: questions asked, answers, sources consulted and technical logs needed for security.
- Health information entered by the pharmacy: consultation notes and information needed for clinical services.
- Billing: payment information, processed by our payment provider; we do not store card numbers.
- Website: minimal technical data (IP address, browser) for security purposes and aggregate audience measurement.
Use
Information is used to provide and secure the service, to support you, to bill and to meet our legal obligations. It is neither sold nor used to train artificial intelligence models.
Before a question is sent to the AI model, direct identifiers (health insurance number, date of birth, phone, email, postal code, name) are masked. The original text remains encrypted in the pharmacy’s database.
Hosting and service providers
Platform data and the AI model are hosted in Canada. We use service providers for hosting, authentication, email delivery and payment; each is bound by appropriate confidentiality and security obligations.
Security
Health information is encrypted at rest and in transit. Each pharmacy is isolated at the database level. Access is restricted by role and logged.
Retention
Audio recordings are deleted once the note is generated. Other information is retained for the duration of the subscription, then for the period set out in the agreement with the pharmacy, before being securely destroyed.
Your rights
You may request access to your information, its correction, its portability or the withdrawal of your consent. A patient of a client pharmacy should first contact their pharmacy, which is responsible for their information.
Confidentiality incidents
In the event of a confidentiality incident, we notify the pharmacy concerned without delay and work with it on the required notices to the Commission d’accès à l’information du Québec and to the persons affected.
Contact us
For any question or request, write to our person in charge of the protection of personal information at the address below.