Privacy policy

This policy explains what personal information Herb Dispenser collects, why, who we share it with, and the choices and rights you have. It covers practitioners, patients (including minors, through a parent or guardian), and visitors to herbdispenser.com and our ordering system.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for patient health information we receive from Ontario practitioners, Ontario's Personal Health Information Protection Act, 2004 (PHIPA). Where the privacy laws of the place you live also apply to us, such as the GDPR for people in the European Union or the UK, we respect the rights they give you.

1. Who is responsible

1591659 Ontario Corp. o/a Herb Dispenser, 213 Queensway S., Unit 400, Keswick, Ontario L4P 0A2, Canada. Our privacy officer is Jason Tarter. Contact them through our contact form, by phone at 905-535-0908, or by mail at the address above.

2. What we collect

From practitioners

• Name, email, phone, clinic name and business address
• Professional registration or credential details, for verification
• Your logo and branding, printed on patient labels
• Formulas, templates, orders, refill settings, invoices and payment records
• Messages you send us, and your email preferences
• Login and security records for your account

About patients

Most patient information reaches us from the patient's practitioner when they place an order. It includes:

• Name, delivery address, email and phone number (for a minor, the parent's or guardian's contact details)
• The formula prescribed, dosage and instructions, and any allergies or sensitivities the practitioner records. This is personal health information.
• Orders, refills, invoices, payment records and shipment tracking
• Patient account details: username, saved addresses and preferences

From website visitors

• If you allow analytics: pages viewed, how you arrived, approximate location, device and browser type, collected by Google Analytics. See our cookie policy.
• If you use the contact form, email or call us: your contact details and message.

Card details. Payments are handled by our payment processor. We don't receive or store full card numbers. If a patient saves a card, the processor stores it securely.

3. How we use it

• To verify practitioners and run their accounts
• To prepare, label and dispense formulas exactly as prescribed
• To send invoices and payment links, take payment, and ship or hold orders for pickup
• To run refills a practitioner has authorized
• To answer questions and provide support
• To keep records the law requires, including tax and financial records
• To protect the service against fraud and misuse
• If you allow analytics: to understand how the website is used and improve it
• With your consent only: to send news or promotions. You can unsubscribe at any time.

We use patient health information only to fill the practitioner's orders and run the service. We never use it for marketing, and we never sell personal information.

4. Consent

Practitioners confirm that they have their patients' consent to share the information needed to fill an order. Where a practitioner is a health information custodian under PHIPA, we act as their agent and handle patient information on their behalf and under their instructions. Where the GDPR applies, we rely on performance of a contract, our legal obligations, our legitimate interest in running a safe service, and your consent (for analytics and marketing). You can withdraw consent, subject to legal and contractual limits, although we may then be unable to fill orders.

5. Who we share it with

We share personal information only as needed for these purposes:

• The patient's practitioner, who sees their patients' orders, payments and refills.
• Dispensary Tree, which provides and hosts the ordering system for us.
• Our payment processor, to take and secure payments.
• Shipping carriers, who receive the name, address and phone number needed for delivery. For international parcels, customs authorities also receive the contents description the declaration requires.
• Email and text-message providers, to send invoices, payment links and notices.
• PiggyButler, which hosts the contact form on our website and delivers your message to us.
• Google, for website analytics, only if you allow it.
• Professional advisers, such as our accountant or lawyer, under confidentiality.
• Authorities, when the law requires or permits it.

Our service providers may only use the information to provide their service to us, and must protect it. If the business is sold or reorganized, information may transfer to the new owner under the same protections.

6. Where information is stored

We are based in Ontario. Some of our service providers store or process information outside Ontario or Canada, including in the United States, where it may be accessible to authorities under local law. We choose providers that protect personal information to a standard comparable to Canadian law.

7. How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires. Financial and tax records are kept for at least six years, as Canadian tax law requires, and order records are kept so that practitioners and patients can reorder and review their history. When information is no longer needed, we securely delete or anonymize it.

8. How we protect it

We use administrative, technical and physical safeguards suited to the sensitivity of the information, including encrypted connections, access limited to people who need it, and secure storage. No system is perfectly secure. If a privacy breach creates a real risk of significant harm, we will notify the people affected, the practitioner concerned and the regulators as the law requires.

9. Children

Formulas for patients under 18 are ordered by their practitioner. A parent or legal guardian receives the notices, pays, and manages the child's patient account, and can exercise the child's privacy rights. We don't knowingly collect information directly from children.

10. Your rights

You can ask to:

• see the personal information we hold about you;
• correct information that is wrong or incomplete;
• withdraw consent to optional uses such as analytics and marketing;
• have information deleted, where we aren't required to keep it (the GDPR and some other laws give additional rights, such as portability and objection).

Patients: your practitioner controls much of your health record. We may refer a request to them, or answer it together with them. Write to our privacy officer through our contact form or by mail. We respond within 30 days and may ask you to confirm your identity.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Information and Privacy Commissioner of Ontario (ipc.on.ca) for health information, or the data protection authority where you live.

11. Changes to this policy

We'll update this policy when our practices change. The date at the top shows the latest version. We will tell account holders about significant changes.

12. Contact

Privacy officer: Jason Tarter
1591659 Ontario Corp. o/a Herb Dispenser, 213 Queensway S., Unit 400, Keswick, Ontario L4P 0A2, Canada
Contact form · 905-535-0908