Privacy Policy

1Applicable Privacy Laws and Accountability

Coastal Care Pharmacy is a private-sector pharmacy based in British Columbia. Our handling of personal information is primarily governed by British Columbia's Personal Information Protection Act ("BC PIPA"). The federal Personal Information Protection and Electronic Documents Act ("PIPEDA") may also apply when personal information crosses provincial or national borders in the course of commercial activity.

Depending on the service and the individual's location, other federal, provincial or territorial privacy, health-information, pharmacy, professional and record-keeping requirements may also apply. We comply with the privacy and confidentiality duties that apply to the activity in question, including applicable College of Pharmacists of British Columbia bylaws, standards and professional obligations. Where more than one requirement applies, we take reasonable steps to meet the applicable legal and professional standard.

Coastal Care has designated a Privacy Officer who is responsible for overseeing our privacy management program. The Privacy Officer's responsibilities include:

• maintaining and reviewing privacy policies and procedures;
• supporting staff training and confidentiality requirements;
• reviewing new systems, forms, portals, service providers and business processes for privacy risk;
• responding to access, correction and consent-withdrawal requests;
• investigating privacy complaints and coordinating responses to privacy incidents; and
• monitoring changes in applicable privacy and pharmacy requirements.

Coastal Care remains accountable for personal information under its control, including information processed on our behalf by a service provider. Pharmacy staff and other individuals who are permitted to access personal health information must follow confidentiality requirements and, where required by the College, sign an approved confidentiality undertaking before receiving access.

2Information We Collect

We collect only the information that is reasonably necessary for identified purposes, to provide pharmacy and related services, or to meet legal and professional obligations. Depending on how an individual interacts with us, we may collect the following categories of information.

Patient and Pharmacy-Service Information

• identifying and contact information, such as name, date of birth, address, telephone number, email address and preferred method of communication;
• health-card, provincial health number, insurer, plan-member or benefit information, where required for billing or pharmacy services;
• prescription and medication information, including prescriber details, medication history, allergies, sensitivities, clinical information, counselling notes, refill information and relevant communications;
• information needed to prepare, compound, dispense, assess, monitor, recall or deliver a medication or compound;
• information about an authorized representative, caregiver, substitute decision-maker or person receiving a delivery on the patient's behalf; and
• records of questions, complaints, adverse events, quality concerns and other interactions with the pharmacy.

If Coastal Care offers an online refill or other patient-facing form, the form may request information needed to identify the patient and the prescription. Information submitted through such a form is treated as personal health information and must be transmitted through an appropriately secured connection.

Professional, Pharmacy and Portal Information

• name, professional designation, licence or registration number, and the name of the clinic, pharmacy or other organization;
• business address, province, postal code, business telephone number and business email address;
• account credentials, account status, authentication and security information;
• quote requests, order details, calculator inputs, portal activity, transaction history and communications; and
• information reasonably required to verify professional standing, prescribing authority, pharmacy licensing, account eligibility or the lawful purpose of an order.

The professional portal is designed for verified prescribers, pharmacies and other authorized professional users. It is not intended to be a general repository for patient records. Users should submit patient-specific information only where a portal function expressly requests it for a lawful pharmacy service, and only to the minimum extent necessary. Professional users are responsible for ensuring that they have the authority and any required consent to submit information to us.

Payment, Transaction and Delivery Information

• payment amount, billing details, transaction identifiers, payment status, refunds and limited payment-card information made available by the payment processor;
• recipient name, delivery address, telephone number, delivery instructions, tracking information and proof of delivery or signature, where applicable; and
• information needed to confirm the recipient, destination, shipping conditions and lawful delivery of a medication or compound.

Where payment is processed through a third-party payment gateway, the payment provider processes the card details. Coastal Care generally receives only the information needed to confirm, reconcile or refund the transaction. Individuals should not send full payment-card details through ordinary email.

Website, Portal and Technical Information

Our web-hosting, security and portal systems may automatically collect limited technical information, such as IP address, browser and device type, operating system, login time, pages viewed, error logs, session information and security events. The website or portal may use essential or functional cookies for login, security, cart or wishlist functions, fraud prevention and site operation. We do not use personal health information for behavioural advertising.

Sources of Information

We may collect information directly from the individual, or from an authorized representative, prescriber, other pharmacy, insurer or benefit provider, provincial drug-information system, regulator, professional register, delivery provider, payment processor or other source that is authorized or permitted by law to provide it.

3How We Use and Disclose Information

We use and disclose personal information only for purposes that are reasonable, have been identified to the individual, are consistent with the reason the information was collected, or are otherwise permitted or required by law.

How We Use Information

• to identify and communicate with patients, caregivers, prescribers, pharmacies and professional users;
• to receive, authenticate and assess prescriptions and orders, including verification of the prescriber's or pharmacy's identity, licensing status and legal authority;
• to conduct clinical, therapeutic, interaction, allergy, dosage, appropriateness and safety reviews;
• to prepare, compound, dispense, label, counsel on, monitor, recall and deliver medications or compounds;
• to create and maintain pharmacy, professional, transaction, quality-assurance and legal records;
• to administer portal accounts, quotes, orders, support requests and professional communications;
• to submit and manage claims with insurers, benefit plans or government programs;
• to process and reconcile payments, refunds and charge inquiries;
• to arrange delivery, tracking, temperature-control handling and confirmation of receipt;
• to respond to questions, complaints, adverse events, recalls, safety issues and quality concerns;
• to protect patients, users, staff, systems and the public from fraud, misuse, security threats or unlawful activity;
• to carry out audits, quality improvement, training, business administration and service evaluation using the least amount of identifiable information reasonably necessary; and
• to comply with pharmacy, privacy, tax, insurance, regulatory, court, law-enforcement and other legal obligations.

When We Disclose Information

We may disclose personal information, using the minimum amount reasonably necessary, to:

• the patient, the patient's authorized representative, prescriber, treating healthcare provider or another pharmacy involved in care or a lawful prescription transfer;
• insurers, benefit managers, government programs and provincial drug-information systems for claim, eligibility, safety and record purposes;
• payment processors, delivery providers, technology providers and other service providers described in this Policy;
• the College of Pharmacists of British Columbia, other regulators, auditors or professional bodies where required or permitted;
• law-enforcement agencies, courts, public bodies or other authorities where disclosure is required or permitted by law;
• a person or organization where disclosure is necessary to respond to an emergency, provide medical treatment, protect an individual or the public, or prevent serious harm, where permitted by law; and
• parties to a proposed or completed business transaction, such as a financing, merger, reorganization or sale, subject to applicable confidentiality, security and use restrictions.

Delivery providers generally receive the recipient's name, address, contact information and delivery instructions. They do not need prescription or clinical details, except where a limited disclosure is necessary or legally required for safe and lawful delivery.

4Consent

We obtain meaningful consent for the collection, use and disclosure of personal information unless consent is not required or is not appropriate under applicable law. The form of consent may be express or implied, depending on the sensitivity of the information, the individual's reasonable expectations and the circumstances.

• Before or at the time of collection, we identify the purposes for which information is being collected, unless the purpose would be obvious to a reasonable person and the law permits implied consent.
• We seek clearer or express consent when the information is sensitive, the purpose is not obvious, or the disclosure is outside the ordinary delivery of pharmacy services.
• Consent may be provided by the individual or by a legally authorized representative. We may take reasonable steps to verify the representative's authority.
• Professional users who submit information through a portal, fax, email or other channel confirm that they are authorized to do so and have obtained any consent required from the individual concerned.
• We do not require consent to a collection, use or disclosure that is not reasonably necessary to provide a product or service, unless the law permits or requires it.
• An individual may withdraw consent on reasonable notice, subject to legal, contractual, professional and record-retention restrictions. We will explain any reasonably foreseeable consequences, such as an inability to provide a requested service.
• Withdrawal of consent does not require us to delete records that must be retained by law, reverse a use or disclosure that was already lawful, or stop a collection, use or disclosure that the law permits without consent.

Promotional electronic messages, if any, are sent only with consent or as otherwise permitted by law and include an appropriate unsubscribe method. Opting out of promotional messages does not stop service, safety, recall, account, payment or delivery communications.

5Security Safeguards

We use reasonable administrative, physical and technical safeguards appropriate to the sensitivity, amount, format and location of the information, and to the risks of unauthorized access, collection, use, disclosure, copying, modification, loss or disposal. Safeguards are reviewed and adjusted as technology, threats and our services change.

Administrative Safeguards

• a designated Privacy Officer and documented privacy, confidentiality, access and incident-response procedures;
• access limited to people who require the information for an authorized work purpose;
• privacy and security training, supervision and confidentiality undertakings for staff and other authorized users;
• service-provider screening, confidentiality and security requirements, and appropriate oversight;
• procedures for identity verification, access requests, correction requests, secure disposal and incident escalation; and
• periodic review of systems, forms, portals and business processes for privacy and security risk.

Physical Safeguards

• controlled access to pharmacy, compounding, records and staff-only areas;
• secure storage of paper records, labels, prescriptions and portable media;
• reasonable visitor, workstation and document-handling controls; and
• secure collection, shredding or destruction of records and media when disposal is authorized.

Technical Safeguards

• HTTPS/TLS (commonly referred to as SSL) for website pages, forms or portals used to transmit transaction, patient, medical or other sensitive information;
• user authentication, unique accounts, password controls and role-based or need-to-know access, as appropriate;
• firewalls, anti-malware, software updates, backups, logging, monitoring and other security controls appropriate to the system;
• encryption or comparable protections for sensitive information in transit and, where appropriate, at rest; and
• secure configuration, vendor support and procedures to revoke access when it is no longer required.

6Service Providers

We use service providers to perform functions that support our pharmacy operations. Depending on the service, these providers may process limited personal information on our behalf or under their own legal obligations. Examples include:

• payment processors and gateways, including a Chase payment gateway or another processor designated by Coastal Care;
• delivery and courier providers, including Purolator or another carrier used for a particular destination or service;
• website, portal, hosting, cybersecurity, pharmacy-software, communications, cloud, backup and technical-support providers;
• secure records-storage and destruction providers;
• insurers, benefit administrators and claim-processing providers; and
• legal, accounting, audit, regulatory and other professional advisers.

We provide service providers only with the information reasonably necessary for the function they perform. We use contractual, technical, organizational or other safeguards appropriate to the sensitivity of the information and the nature of the service. Service providers are not authorized to use personal information for unrelated purposes or for their own marketing.

Some service providers or their subcontractors may store or process information outside British Columbia or outside Canada. If that occurs, the information may be subject to the laws and lawful-access requirements of the jurisdiction in which it is processed. We assess providers and use reasonable safeguards appropriate to the circumstances. Individuals may contact the Privacy Officer for more information about service-provider categories and the general locations in which information may be processed.

We remain accountable for personal information under our control when a service provider processes it on our behalf. A provider that deals directly with an individual may also have its own privacy policy and independent legal obligations.

7Retention and Secure Disposal

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, provide safe and continuous pharmacy care, respond to access or complaint rights, and meet legal, professional, tax, insurance, audit, limitation-period and business requirements.

• Pharmacy, prescription, compounding, counselling and related records are retained for the periods required by applicable law, College requirements and professional standards.
• Payment, delivery, portal, business and tax records are retained for the periods reasonably required for reconciliation, audit, dispute, fraud-prevention and legal purposes.
• Where personal information has been used to make a decision that directly affects an individual, it is retained for at least the minimum period required by applicable privacy law so the individual has a reasonable opportunity to request access.
• Information subject to a complaint, investigation, audit, legal hold, recall, claim or proceeding may be retained until the matter and any required retention period are complete.
• Backup copies may remain for a limited period under secure backup and disaster-recovery schedules and are not used for ordinary business purposes.

When retention is no longer required, we securely destroy the information or remove the means by which it can be associated with an identifiable individual. Disposal methods may include cross-cut shredding, secure destruction by an approved provider, secure deletion or overwriting, physical destruction of media, and de-identification.

Service providers are required, where appropriate, to return or securely destroy information when their work ends or when retention is no longer authorized.

8Access and Correction

Subject to legal exceptions, an individual may request access to personal information about them that is under our control, information about how it has been used, and information about the persons or organizations to which it has been disclosed. An individual may also request correction of an error or omission.

Requests should be made in writing to the Privacy Officer and should provide enough detail to identify the individual and the records or correction being requested. We may ask for reasonable proof of identity or authority before releasing or changing information. This helps prevent unauthorized access. We will make reasonable efforts to assist the requester and respond accurately and completely.

Under BC PIPA, the usual response period is 30 days, subject to permitted extensions. A minimal fee may be charged where the law permits; if so, we will provide a written estimate before proceeding.

Access may be limited or refused where permitted or required by law, including where disclosure would reveal another person's information, create a serious safety risk, compromise an investigation, reveal privileged or protected information, or disclose confidential commercial information. Where reasonably possible, we will remove the restricted information and provide the remainder. If access is refused, we will explain the reason and available review rights as required by law.

When a correction is justified, we will correct the information as soon as reasonably possible and, where required, notify organizations to which the incorrect information was disclosed. If a requested correction is not made, we will annotate the record with the requested correction where required. For clinical or pharmacy records, professional record-keeping rules may require an amendment or addendum rather than deletion of the original entry.

9Privacy Incidents and Complaints

Privacy Incidents

A privacy incident may include loss, theft, misdirection, unauthorized access, unauthorized disclosure, improper disposal, ransomware, credential compromise or any other failure of a privacy or security safeguard. Staff and service providers are expected to report suspected incidents promptly to the Privacy Officer. When an incident is identified, we take reasonable steps to:

• contain the incident and prevent further unauthorized activity;
• preserve relevant evidence and determine what happened;
• identify the information and individuals affected;
• assess sensitivity, potential misuse and risk of harm;
• mitigate foreseeable harm and restore secure operations;
• document the incident, decisions and corrective actions;
• address control, training, vendor or process weaknesses; and
• notify affected individuals, regulators, law-enforcement agencies or other organizations where required by law or where notification is appropriate to reduce harm.

Where PIPEDA applies, we maintain breach records and report and notify breaches that meet the applicable legal threshold. We may also notify the Office of the Information and Privacy Commissioner for British Columbia or another relevant authority where appropriate.

Privacy Complaints

An individual may ask a question or make a complaint about our privacy practices without charge. Complaints should be sent to the Privacy Officer and should include enough information for us to understand and investigate the concern. We will acknowledge the complaint, review the relevant facts and records, consult appropriate personnel or service providers, and communicate the outcome and any corrective action within a reasonable time.

We do not retaliate against an individual for raising a good-faith privacy concern or exercising a privacy right.

An individual may also contact the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada, or another privacy regulator with jurisdiction. Contacting us first is encouraged because it may allow the matter to be resolved quickly, but it is not a condition of contacting a regulator.

10Contacting Our Privacy Officer

Questions about this Policy, the collection of personal information, a request for access or correction, withdrawal of consent, a suspected privacy incident, or a privacy complaint may be directed to:

Please do not include more sensitive information than is necessary in an initial email. We may contact the requester through a more secure channel and may require identity verification before discussing or releasing personal information.

A copy of this Policy is available in an accessible format on request. The Privacy Officer can also provide general information about our privacy practices, service-provider categories and complaint process.

Changes to This Policy

We may update this Policy to reflect changes in law, professional requirements, technology, service providers or our operations. The current version will be posted on our website with the effective date and last-updated date. Where required, we will provide additional notice or obtain consent before using or disclosing personal information for a materially new purpose.