Pharmia Privacy Policy

Last updated: 2026-05-19

About this revision. This is a substantive revision of our previous Privacy Policy. It changes how we describe the basis on which health information is processed, who is responsible for it, how automated processing works, and how long information is kept. If you were enrolled under an earlier version of this policy, certain newly described purposes — in particular the retention of intake conversations for quality assurance and evaluation (see Section 6) — require fresh consent and do not rely on consent you may have given before. Your pharmacy will obtain that consent from you.

1. Introduction and scope

Pharmia is an AI-assisted patient-intake service used by community pharmacies in Quebec. It is operated by Bento Studio Inc. ("Bento Studio", "Pharmia", "we", "us", "our").

2. Our role: a service provider for your pharmacy

Your relationship is, first and foremost, with the pharmacy you visit.

The pharmacy is the controller (in Quebec law, the enterprise responsible for the information). The pharmacy — and the pharmacist responsible for your care — decides why your information is collected and how it is used, and holds your patient record under the Pharmacy Act and the rules of the Ordre des pharmaciens du Québec. The pharmacy is the organization legally responsible for that record.
Pharmia is the processor. Bento Studio, operating Pharmia, acts as a service provider (a mandatary) for the pharmacy. Pharmia processes your information only on the pharmacy's documented instructions, and we do not decide, on our own, why your information is used — except for the separately-consented evaluation and quality-assurance purpose described in Section 6, for which Pharmia acts as the entity responsible (controller) in its own right and not as the pharmacy's processor.

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply to certain processing alongside the Quebec regime, and where it does, this policy's references to "the federal regime" mean that Act.

Who at Pharmia can access your information. Intake and health information is accessible inside Pharmia only on a need-to-know basis. Pharmia personnel who can access it do so only to operate, support, evaluate, and troubleshoot the service, and are bound by confidentiality undertakings. Where Pharmia uses other service providers (sub-processors) to deliver the service, those providers are bound by written contracts that require them to protect the information and to handle it only as instructed, with the same obligations flowing down to them. Because identifiable intake conversations are retained for quality assurance and evaluation (Section 6), this disclosure lets you know who can read an intake conversation.

Security safeguards. Pharmia applies reasonable technical and organizational security measures appropriate to the sensitivity of the information it processes — health information in particular. These measures include encryption of personal information in transit and at rest, access controls that enforce the need-to-know basis described above, and the Canadian-storage baseline for primary storage of patient information described in Section 7.

3. Privacy officer and how to contact us

Pharmia's designated person responsible for the protection of personal information is:

Mohammed Larbi Turki, Chief Executive Officer, Bento Studio Inc.
Email: privacy@pharmia.com

4. Information we process

Through the pharmacy, Pharmia processes the following categories of information:

Intake and health information — the symptoms, health history, medications, and related details you describe during an intake conversation, and any information your pharmacy provides to support that conversation. This is sensitive personal information.
Account and identity information — information used to identify you and to associate an intake with the correct patient and pharmacy, such as your name and contact details.
Device and usage information — technical information collected automatically when you use Pharmia, such as device and browser type, general location derived from network information, and interaction logs. Section 13 describes this category in detail.
Audio recordings — where an intake is conducted by voice, the audio of that conversation and its transcription.
AI-derived outputs — the structured pre-analysis Pharmia produces from an intake conversation for the pharmacist to review (see Section 6).

5. Why we process information and the basis for it

Pharmia processes your information so that the pharmacy can conduct an efficient intake, prepare a clinical pre-analysis for the pharmacist, manage your interaction with the service, and maintain and secure the service.

Health information is processed on your express consent. Health information is sensitive personal information. Because of that heightened sensitivity, it is processed only on your express, informed, specific, and granular consent.

"Granular" means your consent to the processing of health information is presented as a separate, free-standing request — it is not bundled with your acceptance of the Terms of Service, with consent for non-health information, or with the consent for non-essential cookies described in Section 13. Each consent to sensitive information stands on its own.
The pharmacy obtains this consent from you. As the pharmacy's service provider, Pharmia does not itself seek or hold your consent; this policy describes the consent you give to the pharmacy and the standard that consent must meet. The one exception is the separate evaluation and quality-assurance consent described in Section 6: although it is presented to you at intake alongside the intake consent, it is consent to a purpose for which Pharmia — not the pharmacy — is the entity responsible (controller).
We do not rely on "implied consent", and we do not invoke "legitimate interests", as a basis for processing health information.

You may withdraw your consent at any time. You can withdraw your consent by contacting your pharmacy or Pharmia's privacy officer (Section 11). Withdrawal does not undo processing already lawfully carried out, but it stops further processing. To be clear about what withdrawal does and does not do:

It ends future processing of your information for the purposes you have withdrawn from.
It ends the separate evaluation and quality-assurance retention — the identifiable QA copy of your conversation described in Section 6 and in Section 9 row (a) — so no further QA copy is retained and processing for that purpose stops.
It does not destroy the clinical consultation record. The clinical consultation record described in Section 9 row (b) remains subject to your pharmacist's professional record-keeping obligation, which always requires that record to be kept for the period set by Quebec pharmacy law and the rules of the Ordre des pharmaciens. Withdrawal does not cause your health record to be destroyed; that record continues to run on the professional record-keeping clock in Section 9 row (b).

Information already transmitted to a sub-processor. Before a withdrawal is made, some intake information will already have been transmitted to a service provider (sub-processor) — in particular the AI language model and inference infrastructure that supports the intake conversation. Withdrawal stops further transmission, but it does not, by itself, instantly purge information already held in a sub-processor's systems. Information already transmitted is handled in accordance with that sub-processor's contractual terms, and deletion is requested from the sub-processor where the sub-processor's terms support such a request. The specifics — what each sub-processor retains, for how long, and the deletion options available — are addressed by the privacy impact assessment described in Section 7.

6. Automated processing and artificial intelligence

Pharmia uses artificial intelligence to conduct your intake and to prepare a pre-analysis for your pharmacist.

How it works. An AI language model conducts a structured interview with you, asking about your symptoms and relevant health context, and produces a written pre-analysis. The information the model considers includes your reported symptoms, their duration and severity, your health history, and your current medications; the factors that weigh in producing the pre-analysis include reported symptom severity, how long symptoms have lasted, and indicators of urgency or red-flag symptoms.

For the full medical disclaimer governing this automated processing, including the emergency exclusion, see Section 4 of the Terms of Service.

How the workflow is designed. The pre-analysis is a working document for the pharmacist. The intended workflow is that Pharmia's artificial intelligence conducts the intake and produces the pre-analysis, the pharmacist then reviews that pre-analysis, and the pharmacist is the person who exercises clinical judgment and makes the clinical decision about your care. As a matter of fact, the clinical decision about your care is made by the pharmacist; it is not made by Pharmia's automated processing alone.

Whatever the legal characterization of that workflow, you have the transparency rights described below. This description of how the workflow is designed does not displace or limit any recourse you may have directly against Pharmia for harm caused by Pharmia's own fault, including a defective AI output. It describes how the service is intended to operate; it is not a statement that Pharmia is not responsible for its own errors.

Your rights regarding automated processing. You have the right to:

be informed that Pharmia's automated processing is used in your intake, as described in this section;
obtain, on request, the personal information used to produce the pre-analysis in your case and the principal factors that led to that pre-analysis in your case — the generic description above states the categories of information and the kinds of factors involved, and this right lets you ask for that information as it applies to your own intake;
submit observations about the pre-analysis;
obtain a review of the matter by a person — your pharmacist — exercisable on your request, distinct from the routine clinical review the pharmacist already carries out; and
have corrected any personal information used in the automated processing that is inaccurate (this connects to the general right of rectification in Section 11).

You exercise these automated-processing rights the same way as the other rights in Section 11 — by contacting your pharmacy directly, or Pharmia's privacy officer, who forwards the request to the pharmacy; the human review is carried out by your pharmacist.

Use of intake information for evaluation and quality assurance. We want to be clear and explicit about this:

Training and fine-tuning of AI models. Identifiable patient health information is not used to train or fine-tune Pharmia's AI models. Only de-identified or anonymized and aggregated data may be used for that. Any training or fine-tuning on identifiable health information would require separate express consent, which is not currently sought.
Evaluation, quality assurance, and troubleshooting. Identifiable intake conversations are retained, for a bounded period, so that Pharmia can carry out human review and diagnostics of the quality of the service — monitoring, tracing, and evaluating intakes and diagnosing problems. This is a quality-assurance purpose, not a model-training purpose: identifiable transcripts retained for quality assurance are not an input to any model training or fine-tuning pipeline, and the training carve-out stated immediately above is unaffected by this retention. This is a distinct, named purpose with its own consent basis: the retention of identifiable conversations for evaluation and quality assurance is consented to separately — through its own express, separable consent, distinct from and not bundled with the intake consent described in Section 5, and not riding on it. Pharmia is the entity responsible (controller) for this purpose; the separate consent is presented to you at intake but is consent to a purpose Pharmia, not the pharmacy, is responsible for. Its retention period is set out in the table in Section 9. It is not "improvement on de-identified data only" — it involves identifiable conversations, and we disclose it as such. For this evaluation, quality-assurance, debugging, and observability purpose, the retained identifiable transcript is accessible to Pharmia's own quality-assurance and engineering personnel — who are bound by confidentiality undertakings, and who are not your treating pharmacist. Because this consent is separate from the intake consent, you may grant the intake consent and decline this one; if you do, no identifiable quality-assurance copy of your conversation is retained for this purpose.

7. Where your information is processed

Your personal information may be processed outside Quebec. Your personal information, including the health information you provide during an intake, may be communicated to and processed by service providers located outside Quebec — whether elsewhere in Canada or outside Canada. You are informed of this so that you know, before you provide your information, that it may leave Quebec. The remainder of this section explains the storage baseline and the assessment regime that governs any such communication.

Canadian baseline. As a matter of security practice, primary storage of patient information is in Canada. This Canadian-storage baseline is a security fact; it is separate from the assessment trigger described next, which turns on communication outside Quebec rather than on communication outside Canada.

Processing outside Quebec. To deliver the service, some processing may be carried out by service providers located outside Quebec — whether elsewhere in Canada or outside Canada — in particular, the AI language model and related infrastructure that supports the intake conversation. The assessment trigger is any communication of personal information outside Quebec, including a communication to a service provider elsewhere in Canada: where information is communicated to a service provider outside Quebec, a privacy impact assessment and an assessment of the adequacy of the protection the information will receive are conducted before the transfer, and the transfer proceeds only where that assessment supports it. The protection of information transferred outside Quebec is secured in part by the written contract Pharmia has with the sub-processor, which flows down the protection obligations described in Section 2.

A privacy impact assessment has been carried out for the sub-processors currently used, and it is reviewed whenever a sub-processor changes. That assessment identifies the following:

Categories of sub-processors involved in extra-Quebec processing: providers of artificial-intelligence language-model inference, which support the intake conversation and the pre-analysis; a speech-to-text provider, which transcribes voice intakes and recordings; a text-to-speech provider, which generates the assistant's voice on telephone intakes; and an email-delivery provider, which sends service messages.
Countries where that processing may occur: the United States and the United Kingdom.
Basis on which the adequacy of the protection is established: each sub-processor processes the information only under a written data-processing agreement that flows down the protection and confidentiality obligations described in Section 2; the artificial-intelligence inference providers are configured so that the information is not retained once the request is processed and is not used to train their models; the speech-to-text provider does not store the audio of real-time transcription, and audio submitted for batch transcription is deleted immediately once the transcript has been retrieved; the text-to-speech provider processes the information under a written data-processing agreement that includes standard contractual clauses; and the assessment weighs the sensitivity of the health information, the purposes of the processing, those contractual and technical measures, and the legal framework of the country concerned. Where the assessment does not support a transfer, the transfer does not proceed.

8. Anonymization and de-identification

These two terms mean different things, and this policy uses them distinctly.

De-identified information is information from which direct identifiers have been removed but for which it remains reasonably possible to re-identify the individual. De-identified information is still personal information. It remains covered by this policy, subject to retention limits, and subject to your rights. Because the rights in Section 11 — such as access and rectification — depend on locating the information that relates to you, those rights over de-identified information are exercisable only so far as the de-identified data can still be associated with you; where a de-identified copy can no longer be linked to you, it can no longer be the subject of an individual request. Pharmia does not de-identify information for the purpose of defeating a pending request to exercise your rights.
Anonymized information is information that has been irreversibly altered, according to generally accepted best practices, so that it is no longer reasonably foreseeable, in the circumstances, that the individual can be identified. Anonymization to that standard is carried out through a documented process: the criteria and the process applied — including the re-identification risk analysis performed — are recorded, as the applicable anonymization rules require. Only information that is anonymized to that standard, by that documented process, may be retained indefinitely, and only for serious and legitimate purposes.

9. Retention and destruction

Pharmia keeps your information only as long as needed for the purposes for which it is processed, or as long as a legal requirement obliges it to be kept. When the purpose is fulfilled and no legal requirement applies, the information is destroyed or anonymized.

Data category	Retention period or criterion	Justification
Intake and health information — the operational intake artifacts (the raw intake conversation, working notes, and supporting details) that are not the patient-record-grade clinical consultation file of row (b). This is the operational copy of the intake conversation held by Pharmia for, and on behalf of, the controller pharmacy; row (a) below covers Pharmia's own quality-assurance copy of that same conversation, on a separate clock — see the note after the table	Retained for the duration of the pharmacy's mandate and for as long as the pharmacy needs them to operate the intake, then destroyed or anonymized once they are no longer needed for that operational purpose; the patient-record-grade clinical consultation file is governed instead by row (b)	The pharmacy, as controller, decides why these operational intake artifacts are kept and for how long; Pharmia keeps them no longer than the pharmacy's instruction requires. Content that rises to the patient-record-grade clinical consultation file is retained under row (b), whose professional-retention clock is not tied to the pharmacy's mandate. The end of this operational copy does not end Pharmia's own quality-assurance copy of the same conversation, which is governed by row (a)
Account and identity information	For as long as the patient is associated with a participating pharmacy using Pharmia, then destroyed or anonymized once it is no longer needed to identify the patient or link an intake	Needed only to associate an intake with the correct patient and pharmacy
Device and usage information	Retained for a limited period for security, fraud-prevention, and service-operation purposes, then deleted or aggregated	Needed to operate and secure the service; not needed in identifiable form beyond that
Audio recordings	Retained only as long as needed to produce and verify the transcription and the pre-analysis, then deleted; the transcription follows the intake-information row above	Needed only to generate and confirm the intake record
AI-derived outputs (pre-analysis)	Retained as part of the clinical consultation record, on the same basis and for the same period as row (b)	Forms part of the record the pharmacist reviews and relies on, so it follows the clinical-record retention clock
(a) Pharmia's own evaluation and quality-assurance copy of identifiable intake transcripts — Pharmia's processor-side QA copy of the same intake conversation covered, in its operational form, by row 1: the same underlying data, held by a different custodian (Pharmia in its own right, not for the pharmacy) on a separate retention clock — see the note after the table	Retained by Pharmia, in identifiable form, for 12 months, then deleted. Pharmia minimizes identifiability before then where the quality-assurance purpose allows — it de-identifies a transcript once the identifiable form is no longer needed — and in any event deletes the identifiable copy by the end of the 12 months. If a transcript is instead anonymized to the Section 8 standard, then once anonymized it is no longer the identifiable quality-assurance copy, is no longer used for the quality-assurance purpose, and is governed by Section 8; anonymization is therefore not a route to retaining identifiable quality-assurance transcripts beyond the 12-month period	Identifiable retention for this bounded period is necessary and proportionate: tracing, evaluating, and debugging an intake against the actual conversation that produced it requires the conversation in its identifiable form, because de-identification can itself mask the quality issue under review (Section 6). Retention is kept to what that purpose requires and no longer; identifiability is minimized as soon as it is no longer needed
(b) The clinical consultation record (the structured, patient-record-grade consultation file the pharmacist relies on and that forms part of, or supports, the patient record)	Retained by Pharmia on the controlling pharmacy's behalf, under the data-processing agreement, for the period the pharmacist is professionally required to keep the patient record under Quebec pharmacy law and the rules of the Ordre des pharmaciens — a period the controlling pharmacy (the controller) determines, as the party bound by that professional obligation. That professional record-keeping obligation does not end when the pharmacy stops using Pharmia. Pharmia retains the record for at least as long as the controlling pharmacy requires and does not destroy it without the pharmacy's instruction. As a backstop, if the controlling pharmacy becomes unreachable or gives no destruction instruction, Pharmia's retention of the record is bounded by the maximum period the pharmacist's professional record-keeping obligations could require; once that period elapses, Pharmia destroys or anonymizes the record without awaiting further instruction, so destruction does not depend solely on the pharmacy acting. This long-horizon clinical-record store is held within the Canadian baseline described in Section 7	The pharmacy, as controller, is bound by the professional record-keeping rules and determines the applicable period; Pharmia retains this record on the pharmacy's behalf under the data-processing agreement and keeps it no longer than the pharmacy's instruction requires — the obligation is the pharmacist's, not Pharmia's own

One intake conversation, more than one retained copy. Your single intake conversation is not held in only one place. Row 1 and row (a) describe the same underlying conversation held by two custodians on two distinct clocks: row 1 is the operational copy Pharmia holds for, and on behalf of, the controller pharmacy — it exists to run the intake and is destroyed or anonymized when the pharmacy no longer needs it for that operational purpose; row (a) is Pharmia's own processor-side quality-assurance copy of that very same conversation — retained by Pharmia in its own right for the bounded 12-month evaluation/QA purpose described in row (a) and Section 6. They are not different categories of data; they are the same data, retained twice, for two different reasons, on two clocks. The end of the operational copy under row 1 does not end Pharmia's QA copy under row (a), and the deletion of the QA copy under row (a) does not affect the operational copy under row 1. Row 1 and row (b) are reconciled the same way: row 1 covers the operational intake artifacts, while the patient-record-grade clinical consultation file is governed exclusively by row (b), with no overlap and no gap between them.

If your pharmacy stops using Pharmia. When a pharmacy ends its use of the service, the patient information Pharmia holds for that pharmacy is, on the pharmacy's instruction, returned to the pharmacy or destroyed, at no charge to the pharmacy, and Pharmia confirms the return or destruction.

If Pharmia is acquired, ceases operations, or becomes insolvent. Patient health information does not become a freely transferable asset detached from the pharmacy that controls it. If Pharmia is acquired, ceases operations, or becomes insolvent, the information is returned to or destroyed for the controlling pharmacies, and Pharmia commits to require any successor to assume obligations equivalent to those in this policy. This is Pharmia's own undertaking to bind a successor; it is addressed separately here because it is a distinct situation from a single pharmacy ending its use of the service.

10. Confidentiality incidents

If a confidentiality incident occurs, it is assessed against the threshold of a risk of serious injury to the individuals concerned, considering the sensitivity of the information, the likely consequences, and the likelihood of misuse.

The notification chain. As the pharmacy's service provider, Pharmia notifies the pharmacy's privacy officer of a confidentiality incident without delay, and in any event promptly after becoming aware of it. Where the incident presents a risk of serious injury, the pharmacy, as controller, notifies both the Commission d'accès à l'information and the affected individuals with diligence — the same standard applies to each.

Pharmia's own obligations. Pharmia does not reduce its role to "we tell the pharmacy". Pharmia maintains its own incident response. Where a confidentiality incident occurs in Pharmia's own systems — for example its evaluation or operational stores — Pharmia is itself an enterprise holding personal information with its own statutory duties: it assesses the incident, records it in its own register — each register record is kept for a minimum of five years from the date Pharmia becomes aware of the incident — takes measures to reduce the risk of injury, and notifies the affected pharmacies without delay. Where such an incident presents a risk of serious injury, Pharmia, as the enterprise holding the information, itself notifies the Commission d'accès à l'information and the affected individuals — this is Pharmia's own obligation and is not discharged by notifying the pharmacy. The pharmacy is not the sole path to a regulator.

Federal regime. Where the federal breach-of-security-safeguards regime applies, an incident that creates a real risk of significant harm is also reported to the Office of the Privacy Commissioner of Canada and the affected individuals are notified, and a record of the breach is kept for 24 months after the day Pharmia determines the breach occurred. The "risk of serious injury" threshold above and this "real risk of significant harm" threshold are two distinct legal standards under two different regimes; each is assessed on its own terms against an incident, so an incident may meet one threshold and not the other.

Where the public health-information regime governs. To the extent Pharmia's deployment brings it within the scope of the Act respecting health and social services information, the notification chain additionally reaches the Minister of Health and Social Services. This limb applies only where that Act governs the deployment.

11. Your rights

You have the following rights regarding your personal information:

Access — to obtain a copy of, and information about, the personal information held about you.
Rectification and destruction — to have inaccurate, incomplete, or ambiguous information corrected, and to require the destruction of personal information collected in contravention of the law.
Withdrawal of consent — to withdraw your consent to the processing of your information, as described in Section 5.
Portability — to obtain the computerized personal information you provided, in a structured and commonly used technological format. This right covers personal information you provided to the service or that was collected from you. Your own intake answers and the conversation transcript are information you provided, and they are portable. Where an intake was conducted by voice and an audio recording of it still exists, that recording is likewise personal information you provided and is portable while it exists; as Section 4 and Section 9 explain, the audio recording is deleted promptly after the transcription is verified, so once that has occurred an audio recording is typically no longer available to be ported. The right does not extend to information the platform inferred or generated that was not collected from you, such as the AI-derived pre-analysis — only that inferred or generated information is excluded. The AI-derived pre-analysis being outside the portability right does not place it outside the access right: it remains personal information held about you and is subject to the access right described in the access bullet above. Portability and access are distinct rights.
De-indexing and cessation of dissemination — to require that the dissemination of your information cease, or that a hyperlink to it be de-indexed, where the conditions for that right are met. Pharmia does not publish or index patient health information; this right is disclosed because it is yours to hold, and a request to exercise it is routed to your pharmacy as the controller.
Complaint — to make a complaint about the handling of your information to the Commission d'accès à l'information, and, where the federal regime applies, to the Office of the Privacy Commissioner of Canada.

You may exercise any of these rights by contacting your pharmacy directly, or by contacting Pharmia's privacy officer (Section 3). When a request reaches Pharmia, Pharmia receives it, acts on it to the extent it can as a service provider, and forwards it to the pharmacy without undue delay while assisting the pharmacy in responding.

The time within which a request is answered. A request to access or rectify your personal information is answered within the period prescribed by law — 30 days of the request under Quebec law. Pharmia's "without undue delay" routing of a request it receives is separate from, and does not displace, that 30-day statutory period.

If your pharmacy can no longer be reached. If the participating pharmacy ceases to exist or loses its licence during its mandate, you may still contact Pharmia's privacy officer, who will handle the information Pharmia holds as a service provider — including its return or destruction and access to what Pharmia holds. The patient record itself passes to the successor custodian of pharmacy records under the Pharmacy Act and OPQ rules, and you may direct record-related requests to that successor custodian. The Commission d'accès à l'information is the authority for a complaint; it is not the custodian of your record.

12. Minors and persons unable to consent

A minor under 14 years of age. Consent to the processing of the minor's information is given by the person having parental authority (or the minor's tutor).
A minor 14 years of age or over. Under the Quebec rules on consent to care, a minor 14 or over consents personally to their own care, and the health information tied to that care follows the same rule — it is confidential from the parent. For that reason, this policy does not state that a parent may access a 14-or-over minor's information: a parent-held account does not by itself give a parent access to a 14-or-over minor's health information.
An adult unable to consent. Consent is given by the person legally authorized to act for the adult — a tutor, or a mandatary acting under a protection mandate, under Quebec's protective-supervision rules as reformed in 2022.

13. Cookies and automatic collection

Pharmia does not use advertising, analytics, or tracking technologies. We do not build advertising profiles, and we do not share your activity with third parties for marketing.

The only information collected automatically is what the service needs to run securely:

Strictly necessary — session identifiers and security tokens that load the service, keep you signed in, and protect against fraud and abuse. The service cannot function without these.
Operation and security — device and browser type, general location derived from network information, and interaction and error logs, used to operate the service, keep it secure, and diagnose problems.

Because Pharmia uses only these strictly necessary technologies, there are no non-essential cookies for which to request your consent. If we ever introduce non-essential cookies or analytics, we will obtain your consent first — separately from your consent to the processing of health information (Section 5) and from your acceptance of the Terms of Service — and we will update this section before doing so.

14. Disclosures to others and disclosures required by law

Pharmia may be legally compelled to disclose patient information — for example under a court order, a demand by a lawful authority, or an inquiry by the Ordre des pharmaciens du Québec or the Régie de l'assurance maladie du Québec. Where that occurs:

Pharmia discloses only the information the demand legally requires;
Pharmia notifies your pharmacy of the demand where it is lawfully able to do so.

Pharmia does not sell patient information and does not disclose it for any purpose other than delivering the service or complying with a legal obligation.

15. Changes to this policy

This policy may be revised; the "Last updated" date is changed, a substantive revision is communicated to patients and pharmacies, your pharmacy will obtain any fresh consent required for a newly disclosed purpose, and the version in force is the one published on the date shown at the top of this policy.

16. Languages

This policy is published in French and in English. The two versions are equally authoritative, each a faithful rendering of the other, and neither is subordinate to the other. Both versions are published on the Pharmia website; you may obtain the version in the other language directly on the website, from your pharmacy, or by contacting Pharmia's privacy officer.