How we handle your information

What we collect

• Information you submit through the "Book a demo" or "Reserve" forms: name, work email, pharmacy name, role, number of locations, and any message you include.
• Standard analytics data about how visitors use the site (pages viewed, referring source, approximate location from IP, device/browser type), collected through Google Analytics (GA4).

How we use it

• To respond to your demo request or inquiry.
• To keep a record of the inquiry in our CRM (HubSpot) so we can follow up.
• To send you marketing or product updates only if you opted in to that on the form — we do not add you to a marketing list from a form submission alone.
• To understand and improve the site (aggregate analytics only).

Sharing

We share website form data with the service providers that run the site’s infrastructure — currently Resend (email delivery) and HubSpot (CRM) — solely to operate the site and respond to you. We do not sell this information.

Roles under PHIPA

• Each subscribing pharmacy is the Health Information Custodian (HIC) — it owns and is accountable for the personal health information in the app, the same as it is for the records in its dispensing system.
• Agile Pharmas Inc. acts as the pharmacy's agent / electronic service provider — we process personal health information only on the pharmacy's behalf, only as needed to provide the application, and only as the pharmacy directs. We do not use it for our own purposes.
• The pharmacy’s dispensing system (for example Fillware) remains the system of record. AgileRx is designed to work alongside it, holding working copies of clinical documentation, not replacing it.

What the application collects

• Staff account information: name, username, and login activity for each pharmacy employee provisioned to use AgileRx.
• Patient information entered by pharmacy staff in the course of a clinical service: demographics, health number where recorded, medications and allergies, clinical notes, consent records, appointment details, and billing/claim records tied to a service.
• For incident reports specifically: AgileRx is built to exclude patient identifiers by design — incidents are recorded with age ranges, not names or health numbers, and free-text fields are screened to catch identifiers before they’re saved.

What we do with it — and what we never do

• We use it only to provide the application’s modules to the subscribing pharmacy, to maintain and secure the platform, and to meet the pharmacy’s record-keeping obligations.
• We never sell personal health information, and we never use it for advertising.
• We never use identifiable patient information to train AI models. Where the app offers AI-assisted drafting of clinical notes, patient name and health number are stripped out before anything is sent to our AI provider, and drafts are never saved without a pharmacist reviewing them first.
• Anonymous incident data is submitted daily to ISMP Canada’s National Incident Data Repository (NIDR) as required by Ontario’s AIMS program — this data contains no patient identifiers.

Consent

Each pharmacy relies on its patients’ knowledgeable consent, within the existing circle of care, for the collection and use of their health information for the purpose of providing care — the same consent basis the pharmacy already relies on for dispensing. AgileRx does not separately collect or manage patient consent; it operates under the pharmacy’s consent framework and instructions.

Where information is stored

Personal health information handled by the AgileRx application is stored and processed in Canada — application hosting is based in Montréal, and the database is hosted in the AWS Canada (Central) region, including backups.

Retention

Clinical records are retained for at least 10 years from the last recorded service to the patient, or until 10 years after the patient turns 18, whichever is longer — the same retention period pharmacies already follow for dispensing records under Ontario’s pharmacy regulations.

Sub-processors

• Vercel — application hosting, Canada (Montréal).
• Supabase (AWS Canada Central) — primary database, including backups.
• Anthropic — AI-assisted drafting of clinical note text only; patient name and health number are excluded before any request is sent, and inputs/outputs are not used to train Anthropic’s models under our commercial terms.
• ISMP Canada (NIDR) — receives anonymous medication incident reports as required by the OCP AIMS program; no patient identifiers are included.

Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including unique staff logins, role-based access, an audit log of who accessed or changed a record, and encryption of data in transit and at rest.